joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e85f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, rdx
mov rdx, qword [rcx + 0x1d0]
xor ebx, ebx
mov rsi, r8
mov rdi, rcx
mov r14d, 0x200
test rdx, rdx
je 0x100065502
mov rax, rdx
and rax, 0xffffffffffffe000
je 0x1000654cd
cmp word [rax + 4], r14w
jne 0x1000654cd
mov rax, qword [rax + 0x28]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x10]
dec rcx
not rcx
and rcx, rdx
je 0x1000654eb
cmp word [rcx + 4], r14w
jne 0x1000654eb
mov rcx, qword [rcx + 0x28]
mov rcx, qword [rcx + 8]
test byte [rcx + 0x28], 8
jne 0x1000654fb
mov rax, qword [rcx]
call qword [rax + 0x28]
mov qword [rdi + 0x1d0], rbx
test rbp, rbp
je 0x10006559b
test rsi, rsi
je 0x10006559b
mov rdx, qword [rdi + 0x228]
mov rax, qword [rdx + 0xd8]
mov ecx, dword [rax + 0x2d8]
test r14d, ecx
jne 0x10006559b
bt ecx, 0xa
jb 0x10006559b
mov eax, dword [rdx + 0xe0]
test al, 1
jne 0x10006559b
test al, 2
jne 0x10006559b
mov rcx, qword [rdi + 0x390]
inc rsi
mov eax, 2
mul rsi
mov rdx, rax
mov rax, 0xffffffffffffffff
cmovo rdx, rax
cmp rdx, rax
je 0x100065581
mov rax, qword [rcx]
lea r8, [0x1000062a8]
mov r9d, 0xc70
mov byte [rsp + 0x20], 6
call qword [rax + 0x48]
mov rbx, rax
mov qword [rdi + 0x1d0], rbx
test rbx, rbx
je 0x10006559b
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.10005fc80
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e8635
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000e8646
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x1000e867d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e8676
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov r8, rsi
mov rdx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x100065480

Function at 0x1000e86b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000e86ed
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rsi, qword [rdi + 0xd8]
mov rcx, qword [rsi + 0x1d8]
test rcx, rcx
je 0x1000e8711
cmp rcx, 0xffffffffffffffff
je 0x1000e8711
cmp rcx, rbx
je 0x1000e8711
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x1d8], rbx
mov rsi, qword [rsp + 0x38]
mov qword [rdi + 0x108], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000e8740
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x290], rax
inc dword [rcx + 0x10]
inc dword [rcx + 0x14]
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1000d327b
mov qword [rcx], rdx
jmp 0x1000d3283
mov rax, qword [rcx + 8]
mov qword [rax + 0x20], rdx
mov qword [rcx + 8], rdx
mov qword [rdx + 0x20], 0
call fcn.10011b7d0
test eax, eax
je 0x1000d32ae
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x20]
mov qword [rdi + 0x48], r11
jmp 0x1000d32ba
mov rax, qword [0x7ffe0008]
mov qword [rdi + 0x48], rax
dec dword [rbx + 0x10]
call fcn.10006d280
test eax, eax
je 0x1000d331b
lea rcx, [rsp + 0x30]
call fcn.10006d230
mov edx, dword [rdi + 0x14]
mov eax, dword [rdi + 0x10]
shl rdx, 0x20
lea rcx, [rsp + 0x30]
and rdx, rax
call fcn.10006d2a0
mov rdx, qword [rdi + 0x28]
lea rcx, [rsp + 0x30]
call fcn.10006d2b0
mov rdx, qword [rdi + 0x38]
lea rcx, [rsp + 0x30]
call fcn.10006d2c0
mov rdx, qword [rdi + 0x40]
lea rcx, [rsp + 0x30]
call fcn.10006d2d0
lea rcx, [rsp + 0x30]
call fcn.10006d2e0
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000d3346
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000d3357
mov r8, qword [rdi + 0xd8]
test r8, r8
jne 0x1000d338e
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000d3387
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov r8, qword [rdi + 0xd8]
xor edx, edx
mov rcx, rbx
call fcn.1000d33d0
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.10005f420
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbp, edx
mov rsi, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e8785
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000e8796
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x1000e87cd
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e87c6
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
inc dword [rcx + 0x8c]
mov rdx, qword [rcx + 0x218]
mov eax, dword [rsi + 0x30]
add qword [rcx + 0x90], rax
mov eax, 0xa3ca
lea rcx, [rbp*2 + 0x1fa]
add rcx, rbp
mov word [rsi + 0x50], ax
lea rcx, [rdx + rcx*8]
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x1000d3240
Function at 0x1000ecc80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000eccb5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000eccc6
mov r8, qword [rbx + 0xd8]
test r8, r8
jne 0x1000eccfd
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000eccf6
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov r8, qword [rbx + 0xd8]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdx, qword [r8 + 0x2f8]
cmp rax, rdx
ja 0x1000ecd7e
mov rcx, rdx
sub rcx, rax
mov rax, qword [r8 + 0x218]
cmp rcx, qword [rax + 0xab0]
jbe 0x1000ecd37
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
jne 0x1000ecd7e
mov rcx, qword [r8 + 0x210]
mov eax, dword [rcx + 0xb4]
test al, 4
je 0x1000ecd90
mov rax, qword [rcx + 0x98]
test byte [rax + 0x220], 1
jne 0x1000ecd90
mov eax, dword [rax + 0x2d8]
test al, al
js 0x1000ecd90
bt eax, 8
jb 0x1000ecd90
mov eax, 2
mov ecx, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1000e8a00
lea rdx, [0x10023f400]
xor ecx, ecx
call fcn.100058870
test eax, eax
jne 0x1000ecd6d
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1000ecdb0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000ecded
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000ecdfe
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000ece35
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000ece2e
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x210]
mov rbx, qword [rsp + 0x30]
mov qword [rsi], rax
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1000ece60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov edi, 0x80000000
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000ecea8
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0x100]
test rcx, rcx
jne 0x1000ecec3
mov rcx, rbx
call fcn.1000648e0
mov rcx, qword [rbx + 0x100]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
test rcx, rcx
mov qword [r14], rcx
cmovne edi, eax
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1000ecef0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov ebp, edx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000ecf34
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov qword [rbx + rbp*8], rsi
mov rbx, qword [rsp + 0x30]
mov rax, qword [rax + 0x38]
mov qword [rax + rbp*8], rsi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1000f2170
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rdx
mov rbx, rcx
xor eax, eax
mov qword [rcx + 4], rax
mov dword [rcx], 2
xor edx, edx
lea rax, [0x1001152d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.10005b410
nop
call fcn.100058ba0
mov dword [rsp + 0xc0], eax
xor ecx, ecx
call fcn.100058c40
lea r11, [rsp + 0xc0]
mov qword [rsp + 0xc8], r11
mov dword [rbx], 4
movsxd rcx, dword [rdi + 0x10]
add rcx, qword [rdi]
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdi + 0x28]
mov r8, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
call qword [rdi + reloc.WS2_32.dll_htonl]
mov dword [rbx + 8], eax
mov dword [rbx], 5
mov ecx, dword [rsp + 0xc0]
call fcn.100058c40
nop
lea rcx, [rsp + 0x60]
call fcn.10005b4f0
nop
jmp 0x1000f222c
call fcn.100068a00
mov rsi, rax
mov rdi, qword gs:[0x30]
add rdi, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000f2257
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000f2268
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x1000f229f
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rdi, qword gs:[0x30]
add rdi, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000f2298
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
cmp dword [rax + 0x204], 0
je 0x1000f22ad
call fcn.1000618f0
mov rax, rbx
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000f2390
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rdx
mov rbx, rcx
mov qword [rcx], 2
xor edx, edx
lea rax, [0x1001152d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.10005b410
nop
call fcn.100058ba0
mov dword [rsp + 0xc0], eax
xor ecx, ecx
call fcn.100058c40
lea r11, [rsp + 0xc0]
mov qword [rsp + 0xc8], r11
mov dword [rbx], 4
movsxd rcx, dword [rdi + 0x10]
add rcx, qword [rdi]
call qword [rdi + reloc.WS2_32.dll_htonl]
mov dword [rbx], 5
mov ecx, dword [rsp + 0xc0]
call fcn.100058c40
nop
lea rcx, [rsp + 0x60]
call fcn.10005b4f0
nop
jmp 0x1000f242f
call fcn.100068a00
mov rsi, rax
mov rdi, qword gs:[0x30]
add rdi, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000f245a
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000f246b
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x1000f24a2
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rdi, qword gs:[0x30]
add rdi, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000f249b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
cmp dword [rax + 0x204], 0
je 0x1000f24b0
call fcn.1000618f0
mov rax, rbx
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000f9ab0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rdi, rcx
call fcn.10006b940
xor edx, edx
test eax, eax
sete dl
test edx, edx
je 0x1000f9af1
call fcn.10006c150
mov rcx, rax
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.100068a00
mov r14, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000f9b1e
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000f9b2f
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000f9b67
call fcn.100063d30
call fcn.100068a00
mov rbx, rax
mov rcx, qword gs:[0x30]
lea r14, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000f9b60
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov rax, qword [r14 + 0xd8]
mov rax, qword [rax + 0x210]
mov qword [rdi + 0x20], rax
mov dword [rsp + 0x30], 0xffffffff
lea r15, [fcn.100062040]
mov r12d, gethostbyname
nop word [rax + rax]
xor edx, edx
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.10005b410
nop
mov dword [rdi + 0x380], 0
xor ebx, ebx
mov dword [rsp + 0x34], ebx
cmp ebx, 2
jae 0x1000f9bd2
xor edx, edx
test ebx, ebx
setne dl
inc edx
mov rcx, rdi
call fcn.1000f9d70
inc ebx
jmp 0x1000f9bb4
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax + 0x140]
mov dword [rsp + 0xe8], ecx
test ecx, ecx
je 0x1000f9c1f
mov dword [rsp + 0xd8], ecx
mov eax, dword [rdi + 0x380]
xor edx, edx
div dword [rsp + 0xd8]
mov dword [rsp + 0xe0], eax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x38], rax
mov ecx, dword [rsp + 0xe0]
mov rax, qword [rsp + 0x38]
mov dword [rax + 0xd8], ecx
call fcn.10006bba0
test eax, eax
je 0x1000f9c3c
mov ecx, dword [rdi + 0x10]
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul edx, edx, 0x64
cmp ecx, edx
jne 0x1000f9c90
mov rcx, rdi
call fcn.1000fa780
xor edx, edx
mov rcx, rdi
call fcn.1000fb1f0
mov rcx, rdi
call fcn.1000fb3c0
mov rcx, rdi
call fcn.1000fb7e0
mov r11, qword [0x1002966b0]
cmp qword [rdi + 0x18], r11
jne 0x1000f9c70
call fcn.1000cf0a0
mov rcx, qword [rdi + 0x18]
add rcx, 0x1d8
call fcn.1000fe930
mov rcx, qword [rdi + 0x18]
add rcx, 0x318
call fcn.1000fe930
call fcn.10006bba0
mov ecx, 0x1388
test eax, eax
cmovne ecx, r12d
mov dword [rsp + 0x40], ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [rdi + 0x10]
lea rcx, [rsp + 0x60]
call fcn.10005b4f0
nop
jmp 0x1000f9ccf
call fcn.100068a00
mov r14, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000f9cfb
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000f9d0c
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000f9d44
call fcn.100063d30
call fcn.100068a00
mov r14, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000f9d3d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
cmp dword [rax + 0x204], 0
je 0x1000f9b90
call fcn.1000618f0
jmp 0x1000f9b90
Function at 0x1000fcc90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rsi, rdx
mov r14, rcx
mov dword [rsp + 0x30], 0
call fcn.100068a00
mov rdi, rax
mov r8, qword gs:[0x30]
lea rbx, [r8 + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fcce7
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000fccf8
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000fcd30
call fcn.100063d30
call fcn.100068a00
mov rbx, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fcd29
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
mov rdi, qword [rax + 0x3f8]
mov qword [rsp + 0xc0], rdi
lea rcx, [0x100061000]
mov qword [rax + 0x3f8], rcx
mov qword [rsp + 0xc8], rdi
xor edx, edx
lea rax, [0x100062030]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x68]
call fcn.10005b410
nop
mov rdx, rsi
mov rcx, r14
call fcn.100065780
nop
lea rcx, [rsp + 0x68]
call fcn.10005b4f0
nop
jmp 0x1000fcd95
call fcn.100068a00
mov rsi, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fcdc1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000fcdd2
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000fce0a
call fcn.100063d30
call fcn.100068a00
mov rbx, rax
mov rcx, qword gs:[0x30]
lea rsi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fce03
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rax, qword [rsi + 0xd8]
cmp dword [rax + 0x204], 0
je 0x1000fce19
call fcn.1000618f0
nop
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fce44
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000fce55
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000fce8c
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fce85
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov qword [rax + 0x3f8], rdi
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
Function at 0x1000fda20
Capabilities:
Get thread local storage value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rbx, rcx
mov eax, dword [rcx + 0x30]
mov rcx, qword [rcx + 0x28]
cmp qword [rbx + 0x18], 0
jne 0x1000fdbbf
test rcx, rcx
je 0x1000fdbbf
test eax, eax
je 0x1000fdbbf
mov qword [rbx + 0x18], rcx
mov dword [rbx + 0x20], eax
mov dword [rsp + 0x38], 0x40006f
xor r14d, r14d
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x28], r14
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x20], r14
lea edx, [r14 + 1]
lea rcx, [r11 - 0x50]
call fcn.100057f20
nop
mov esi, dword [rbx + 0x20]
mov rbx, qword [rbx + 0x18]
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fdac4
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000fdad5
mov rdi, qword [rdi + 0xd8]
test rdi, rdi
jne 0x1000fdb0d
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea rbp, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fdb06
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
mov rdi, qword [rbp + 0xd8]
mov rcx, qword [rdi + 0x210]
test rcx, rcx
je 0x1000fdb43
mov eax, dword [rcx + 0xb4]
test al, 4
je 0x1000fdb43
mov rax, qword [rcx + 0x98]
test byte [rax + 0x220], 1
jne 0x1000fdb43
mov eax, dword [rax + 0x2d8]
test al, al
js 0x1000fdb43
bt eax, 8
jae 0x1000fdbae
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx], edx
mov ecx, r14d
sete cl
test ecx, ecx
jne 0x1000fdb62
mov rcx, rbx
call fcn.100076600
cmp esi, 1
jne 0x1000fdb7b
cmp dword [rbx + 0x20], 2
je 0x1000fdb8e
cmp dword [rbx + 0x1c], 0
jne 0x1000fdb8e
inc dword [rbx + 0x18]
mov dword [rbx + 0x20], esi
jmp 0x1000fdb89
cmp esi, 2
jne 0x1000fdb8e
cmp dword [rbx + 0x20], 0
jne 0x1000fdb8e
mov dword [rbx + 0x20], esi
mov dword [rbx], r14d
jmp 0x1000fdba5
lea r9, [rsp + 0x38]
or r8d, 0xffffffff
mov edx, esi
mov rcx, rbx
call fcn.1001049c0
test eax, eax
jne 0x1000fdbae
cmp esi, 2
jne 0x1000fdbae
mov qword [rbx + 0x28], rdi
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
not eax
and dword [rcx + 0x220], eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1000fde30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea rax, [rcx + 0x128]
mov rbx, rcx
mov dword [rcx + 0x10], edi
mov dword [rcx + 0x14], edi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x118], rdi
mov qword [rax + 8], rax
mov qword [rax], rax
mov qword [rax + 0x10], rdi
mov qword [rcx + 0x140], rdi
mov qword [rcx + 0x148], rdi
mov qword [rcx + 0x158], rdi
mov eax, dword [0x100282c58]
mov dword [rcx + 0x160], eax
mov qword [rcx + 0x168], rdi
mov qword [rcx + 0x178], rdi
lea rax, [rcx + 0x180]
mov qword [rax + 8], rax
mov qword [rax], rax
mov qword [rax + 0x10], rdi
lea rax, [rcx + 0x198]
mov qword [rax + 8], rax
mov qword [rax], rax
mov qword [rax + 0x10], rdi
call fcn.10011b7d0
test eax, eax
je 0x1000fded4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x30]
jmp 0x1000fdedc
mov r11, qword [0x7ffe0008]
mov rax, qword [0x1002465c8]
cmp r11, rax
jb 0x1000fdeed
sub r11, rax
jmp 0x1000fdef0
mov r11, rdi
mov qword [rbx + 0x1b0], r11
call fcn.10011b7d0
test eax, eax
je 0x1000fdf12
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x38]
jmp 0x1000fdf1a
mov r11, qword [0x7ffe0008]
mov rax, qword [0x1002465c8]
cmp r11, rax
jb 0x1000fdf2b
sub r11, rax
jmp 0x1000fdf2e
mov r11, rdi
mov qword [rbx + 0x1b8], r11
lea rcx, [rbx + 0x40]
lea rdx, [0x100282c60]
mov r8d, 0xc0
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
call sub.MSVCR100.dll_memcpy
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret