Function at 0x14001b248
Capabilities:
Allocate thread local storage
Get system information on windows
Map section object

Disassembly:
push rbp
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x90]
lea rax, [0x1400b8200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov qword [0x1400b81e0], rax
mov rax, qword [0x1400b81e0]
test rax, rax
jne 0x14001b297
lea rax, str.do_on_process_attach
mov rcx, rax
call sym.__MCF_runtime_failure
lea rax, [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call rax
test eax, eax
jne 0x14001b2ba
lea rax, str.do_on_process_attach
mov rcx, rax
call sym.__MCF_runtime_failure
mov rax, qword [rbp - 0x28]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
movsd xmm0, qword [0x1400c1718]
divsd xmm0, xmm1
movsd qword [0x1400b81e8], xmm0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp - 4], eax
mov edx, dword [rbp - 4]
mov rax, rdx
shl rax, 0x20
add rax, rdx
not rax
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EncodePointer]
call rax
mov rdx, rax
movabs rax, 0x9e3779b97f4a7c15
imul rax, rdx
mov qword [rbp - 0x10], rax
movzx eax, word [0x1400b8272]
cmp ax, 0x2a
mov edx, dword [rbp - 4]
lea rax, [0x1400b8272]
lea r9, str.0123456789ABCDEF
mov r8, rdx
mov edx, 8
mov rcx, rax
call sym.do_encode_numeric_field
movzx eax, word [0x1400b8284]
cmp ax, 0x23
lea rax, [0x1400b8284]
mov rdx, qword [rbp - 0x10]
lea r9, str.GHJKLMNPQRSTUWXY
mov r8, rdx
mov edx, 0x10
mov rcx, rax
call sym.do_encode_numeric_field
movzx eax, word [0x1400b82a4]
test ax, ax
lea rax, [0x1400b82c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_BaseGetNamedObjectDirectory]
call rax
test eax, eax
jns 0x14001b3a1
lea rax, str.do_on_process_attach
mov rcx, rax
call sym.__MCF_runtime_failure
mov rax, qword [0x1400b82c8]
test rax, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 4
lea r9, [0x1400b82f0]
lea r8, [0x1400b82c0]
mov edx, 0xf0006
mov rcx, rax
mov rax, qword [sym.imp.ntdll.dll_NtCreateSection]
call rax
test eax, eax
jns 0x14001b3fa
lea rax, str.do_on_process_attach
mov rcx, rax
call sym.__MCF_runtime_failure
mov rax, qword [rbp - 0x30]
test rax, rax
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
mov rax, qword [rbp - 0x30]
lea rcx, [rbp - 0x38]
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rcx
mov rdx, 0xffffffffffffffff
mov rcx, rax
mov rax, qword [sym.imp.ntdll.dll_NtMapViewOfSection]
call rax
test eax, eax
jns 0x14001b47b
lea rax, str.do_on_process_attach
mov rcx, rax
call sym.__MCF_runtime_failure
mov rax, qword [rbp - 0x38]
test rax, rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x1abf
mov rax, qword [rbp - 0x38]
mov qword [0x1400b8230], rax
mov rax, qword [0x1400b8230]
mov rax, qword [rax]
test rax, rax
je 0x14001b50f
mov rax, qword [0x1400b8230]
mov rax, qword [rax]
mov qword [0x1400b8230], rax
mov rax, qword [0x1400b8230]
mov eax, dword [rax + 8]
cmp eax, 0x1abf
ja 0x14001b4d7
lea rax, str.do_on_process_attach
mov rcx, rax
call sym.__MCF_runtime_failure
mov rax, qword [rbp - 0x38]
mov rdx, rax
mov rcx, 0xffffffffffffffff
mov rax, qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
call rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ntdll.dll_NtClose]
call rax
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x1c], 0
jmp 0x14001b573
mov rax, qword [0x1400b8230]
mov rdx, qword [0x1400b8230]
mov qword [rax], rdx
mov rax, qword [0x1400b8230]
mov dword [rax + 8], 0x1ac0
mov rbx, qword [0x1400b8230]
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov dword [rbx + 0xc], eax
mov rax, qword [0x1400b8230]
mov eax, dword [rax + 0xc]
cmp eax, 0xffffffff
jne 0x14001b55f
lea rax, str.do_on_process_attach
mov rcx, rax
call sym.__MCF_runtime_failure
mov rax, qword [0x1400b8230]
add rax, 0x10
mov rcx, rax
call sym.__MCF_thread_attach_foreign
nop
add rsp, 0x98
pop rbx
pop rbp
ret