joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d9ed0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6d9f0d
jmp 0x6d9fc0
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6d9fc0
cmp rbx, qword [rax]
jne 0x6d9f00
cmp qword [rax + 8], 0
je 0x6d9fc0
lfence
mov rdx, qword [rsi + 0x20]
lea rdi, [rsp + 0x20]
lea rax, [rdi + 0x10]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov r8, rdx
add r8, qword [rsi + 0x28]
call fcn.00576760
mov r12, qword [rsi]
mov rbp, qword [rsi + 0x10]
test r12b, 1
je 0x6d9f5c
mov rax, qword [rsi + 8]
mov rax, qword [rbp + rax]
mov r12, qword [rax + r12 - 1]
mov rdx, qword [rsp + 0x20]
lea rbx, [rsp + 0x40]
lea rax, [rbx + 0x10]
mov rcx, rbx
mov qword [rsp + 0x40], rax
mov r8, rdx
add r8, qword [rsp + 0x28]
call fcn.00576760
mov rcx, rbp
mov rdx, rbx
add rcx, qword [rsi + 8]
call r12
mov rcx, qword [rsp + 0x40]
add rbx, 0x10
cmp rcx, rbx
je 0x6d9f9f
call fcn.007da050
mov rcx, qword [rsp + 0x20]
add rdi, 0x10
cmp rcx, rdi
je 0x6d9fb2
call fcn.007da050
sfence
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, rsi
mov ecx, 0x78
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x48], rax
je 0x6da0a1
lea rdx, [0x006cea00]
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], rdx
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x30], 0
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rax + 0x50], rdx
lea rdx, [rax + 0x68]
mov qword [rsi + 0x10], 0
mov qword [rax + 0x58], rdx
mov rcx, qword [rsi + 0x20]
lea rdx, [rsi + 0x30]
cmp rcx, rdx
je 0x6da0c2
mov qword [rax + 0x58], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rax + 0x68], rcx
mov rcx, qword [rsi + 0x28]
mov qword [rax + 0x60], rcx
mov qword [rsi + 0x20], rdx
mov qword [rsi + 0x28], 0
mov byte [rsi + 0x30], 0
mov qword [rsp + 0x50], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, qword [rsi + 0x30]
mov r10, qword [rsi + 0x38]
mov qword [rax + 0x68], r9
mov qword [rax + 0x70], r10
jmp 0x6da089
Function at 0x6da130
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6da159
jmp 0x6da190
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6da190
cmp rbx, qword [rax]
jne 0x6da150
cmp qword [rax + 8], 0
je 0x6da190
lfence
mov rax, qword [rsi]
lea rdx, [rsi + 0x20]
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi + 8]
test al, 1
je 0x6da183
mov r8, qword [rcx]
mov rax, qword [r8 + rax - 1]
call rax
sfence
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rsi
mov ecx, 0x70
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6da280
lea rdx, [0x006ced60]
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], rdx
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x30], 0
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rax + 0x50], rdx
mov qword [rsi + 0x10], 0
mov qword [rax + 0x60], 0
mov qword [rax + 0x68], 0
mov qword [rax + 0x58], 0
mov rdx, qword [rsi + 0x20]
mov qword [rax + 0x58], rdx
mov rcx, qword [rsi + 0x28]
mov qword [rsi + 0x20], 0
mov rdx, qword [rax + 0x60]
mov qword [rax + 0x60], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rsi + 0x28], rdx
mov rdx, qword [rax + 0x68]
mov qword [rax + 0x68], rcx
mov qword [rsi + 0x30], rdx
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x6da2c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6da2e9
jmp 0x6da320
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6da320
cmp rbx, qword [rax]
jne 0x6da2e0
cmp qword [rax + 8], 0
je 0x6da320
lfence
mov rax, qword [rsi]
lea rdx, [rsi + 0x20]
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi + 8]
test al, 1
je 0x6da313
mov r8, qword [rcx]
mov rax, qword [r8 + rax - 1]
call rax
sfence
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rsi
mov ecx, 0x70
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6da410
lea rdx, [0x006cefd0]
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], rdx
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x30], 0
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rax + 0x50], rdx
mov qword [rsi + 0x10], 0
mov qword [rax + 0x60], 0
mov qword [rax + 0x68], 0
mov qword [rax + 0x58], 0
mov rdx, qword [rsi + 0x20]
mov qword [rax + 0x58], rdx
mov rcx, qword [rsi + 0x28]
mov qword [rsi + 0x20], 0
mov rdx, qword [rax + 0x60]
mov qword [rax + 0x60], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rsi + 0x28], rdx
mov rdx, qword [rax + 0x68]
mov qword [rax + 0x68], rcx
mov qword [rsi + 0x30], rdx
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x6daa50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6daa79
jmp 0x6daab3
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6daab3
cmp rbx, qword [rax]
jne 0x6daa70
cmp qword [rax + 8], 0
je 0x6daab3
lfence
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi + 8]
mov r8d, dword [rsi + 0x28]
test al, 1
mov rdx, qword [rsi + 0x20]
je 0x6daaa7
mov r9, qword [rcx]
mov rax, qword [r9 + rax - 1]
call rax
sfence
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rsi
mov ecx, 0x68
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6dab69
lea rdx, [0x006cfe00]
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], rdx
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x30], 0
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rax + 0x50], rdx
mov rdx, qword [rsi + 0x20]
mov qword [rsi + 0x10], 0
mov qword [rax + 0x58], rdx
mov edx, dword [rsi + 0x28]
mov dword [rax + 0x60], edx
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x6dabb0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6dabd9
jmp 0x6dac13
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6dac13
cmp rbx, qword [rax]
jne 0x6dabd0
cmp qword [rax + 8], 0
je 0x6dac13
lfence
mov rax, qword [rsi]
lea rdx, [rsi + 0x20]
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi + 8]
mov r8d, dword [rsi + 0x3c]
test al, 1
je 0x6dac07
mov r9, qword [rcx]
mov rax, qword [r9 + rax - 1]
call rax
sfence
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rsi
mov ecx, 0x78
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6dacdf
lea rdx, [0x006cffb0]
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], rdx
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x30], 0
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rax + 0x50], rdx
mov rdx, qword [rsi + 0x20]
mov qword [rsi + 0x10], 0
mov qword [rax + 0x58], rdx
mov rdx, qword [rsi + 0x28]
mov qword [rax + 0x60], rdx
mov rdx, qword [rsi + 0x30]
mov qword [rax + 0x68], rdx
mov edx, dword [rsi + 0x38]
mov dword [rax + 0x70], edx
mov edx, dword [rsi + 0x3c]
mov dword [rax + 0x74], edx
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x6dad20
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6dad49
jmp 0x6dad84
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6dad84
cmp rbx, qword [rax]
jne 0x6dad40
cmp qword [rax + 8], 0
je 0x6dad84
lfence
mov rax, qword [rsi]
lea rdx, [rsi + 0x20]
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi + 8]
mov r8, qword [rsi + 0x40]
test al, 1
je 0x6dad77
mov r9, qword [rcx]
mov rax, qword [r9 + rax - 1]
call rax
sfence
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov rdx, rsi
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov rdi, rax
mov qword [rsp + 0x28], rax
je 0x6dae7d
mov qword [rax + 0x20], 0
lea rax, [0x006d0180]
mov qword [rdi + 0x28], rax
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov dword [rdi + 0x10], 0
mov dword [rdi + 0x14], 0
mov qword [rdi + 0x18], 0
mov dword [rdi + 0x30], 0
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], rdx
mov rax, qword [rsi + 0x10]
lea rdx, [rsi + 0x20]
mov qword [rdi + 0x50], 0
mov qword [rdi + 0x48], rax
mov rax, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rdi + 0x50], rax
lea rax, [rdi + 0x58]
cmp rdx, rax
mov qword [rsi + 0x10], 0
mov qword [rdi + 0x58], 0
je 0x6dae75
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x6dae75
test al, 1
mov qword [rdi + 0x58], rax
je 0x6dae9b
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x60], rax
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x68], rax
mov rax, qword [rsi + 0x38]
mov qword [rdi + 0x70], rax
mov qword [rsi + 0x20], 0
mov rax, qword [rsi + 0x40]
mov qword [rdi + 0x78], rax
mov qword [rsp + 0x30], rdi
lock add dword [rbx + 0x30], 1
mov rdx, rdi
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
lea rdx, [rdi + 0x60]
and rax, 0xfffffffffffffffe
mov r8d, 1
lea rcx, [rsi + 0x28]
call qword [rax]
jmp 0x6dae6d
Function at 0x6daf10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6daf39
jmp 0x6daf73
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6daf73
cmp rbx, qword [rax]
jne 0x6daf30
cmp qword [rax + 8], 0
je 0x6daf73
lfence
mov rax, qword [rsi]
lea r8, [rsi + 0x40]
mov rcx, qword [rsi + 0x10]
lea rdx, [rsi + 0x20]
add rcx, qword [rsi + 8]
test al, 1
je 0x6daf67
mov r9, qword [rcx]
mov rax, qword [r9 + rax - 1]
call rax
sfence
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rsi
mov ecx, 0x98
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6db09a
lea rdx, [0x006d07a0]
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], rdx
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x30], 0
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rax + 0x50], rdx
lea rdx, [rax + 0x68]
mov qword [rsi + 0x10], 0
mov qword [rax + 0x58], rdx
mov rcx, qword [rsi + 0x20]
lea rdx, [rsi + 0x30]
cmp rcx, rdx
je 0x6db0b7
mov qword [rax + 0x58], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rax + 0x68], rcx
mov rcx, qword [rsi + 0x28]
mov qword [rax + 0x60], rcx
mov qword [rsi + 0x20], rdx
lea rdx, [rax + 0x88]
mov qword [rsi + 0x28], 0
mov byte [rsi + 0x30], 0
mov qword [rax + 0x78], rdx
mov rcx, qword [rsi + 0x40]
lea rdx, [rsi + 0x50]
cmp rcx, rdx
je 0x6db0cc
mov qword [rax + 0x78], rcx
mov rcx, qword [rsi + 0x50]
mov qword [rax + 0x88], rcx
mov rcx, qword [rsi + 0x48]
mov qword [rax + 0x80], rcx
mov qword [rsi + 0x40], rdx
mov qword [rsi + 0x48], 0
mov byte [rsi + 0x50], 0
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x48
pop rbx
pop rsi
ret
mov r9, qword [rsi + 0x30]
mov r10, qword [rsi + 0x38]
mov qword [rax + 0x68], r9
mov qword [rax + 0x70], r10
jmp 0x6db040
mov r9, qword [rsi + 0x50]
mov r10, qword [rsi + 0x58]
mov qword [rax + 0x88], r9
mov qword [rax + 0x90], r10
jmp 0x6db07f
Function at 0x6db110
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6db139
jmp 0x6db173
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6db173
cmp rbx, qword [rax]
jne 0x6db130
cmp qword [rax + 8], 0
je 0x6db173
lfence
mov rax, qword [rsi]
lea rdx, [rsi + 0x20]
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi + 8]
mov r8d, dword [rsi + 0x40]
test al, 1
je 0x6db167
mov r9, qword [rcx]
mov rax, qword [r9 + rax - 1]
call rax
sfence
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rsi
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6db25a
lea rdx, [0x006d0b20]
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], rdx
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x30], 0
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rax + 0x50], rdx
lea rdx, [rax + 0x68]
mov qword [rsi + 0x10], 0
mov qword [rax + 0x58], rdx
mov rcx, qword [rsi + 0x20]
lea rdx, [rsi + 0x30]
cmp rcx, rdx
je 0x6db277
mov qword [rax + 0x58], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rax + 0x68], rcx
mov rcx, qword [rsi + 0x28]
mov qword [rax + 0x60], rcx
mov qword [rsi + 0x20], rdx
mov edx, dword [rsi + 0x40]
mov qword [rsi + 0x28], 0
mov byte [rsi + 0x30], 0
mov dword [rax + 0x78], edx
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x48
pop rbx
pop rsi
ret
mov r9, qword [rsi + 0x30]
mov r10, qword [rsi + 0x38]
mov qword [rax + 0x68], r9
mov qword [rax + 0x70], r10
jmp 0x6db23c
Function at 0x6db4d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6db4f9
jmp 0x6db540
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6db540
cmp rbx, qword [rax]
jne 0x6db4f0
cmp qword [rax + 8], 0
je 0x6db540
lfence
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi + 8]
mov r9d, dword [rsi + 0x28]
test al, 1
mov r8d, dword [rsi + 0x24]
mov edx, dword [rsi + 0x20]
je 0x6db52a
mov r10, qword [rcx]
mov rax, qword [r10 + rax - 1]
call rax
sfence
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rsi
mov ecx, 0x68
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rsi
call fcn.004fc980
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6db5fa
lea rdx, [0x006d1590]
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], rdx
mov qword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], 0
mov dword [rax + 0x30], 0
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r10
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
mov qword [rax + 0x50], rdx
mov edx, dword [rsi + 0x20]
mov qword [rsi + 0x10], 0
mov dword [rax + 0x58], edx
mov edx, dword [rsi + 0x24]
mov dword [rax + 0x5c], edx
mov edx, dword [rsi + 0x28]
mov dword [rax + 0x60], edx
mov qword [rsp + 0x30], rax
lock add dword [rbx + 0x30], 1
mov rdx, rax
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x6dc5c0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6dc5f0
jmp 0x6dc6b0
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6dc6b0
cmp rbx, qword [rax]
jne 0x6dc5e3
cmp qword [rax + 8], 0
je 0x6dc6b0
lfence
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x30], 0
mov rdi, qword [rsi]
test rax, rax
je 0x6dc63c
test al, 1
mov qword [rsp + 0x30], rax
je 0x6dc690
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsi + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rsi + 0x40]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x30]
mov r9, qword [rsi + 0x20]
mov r8, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x20], rbx
call rdi
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x6dc681
test al, 1
jne 0x6dc681
and rax, 0xfffffffffffffffe
mov rax, qword [rax]
test rax, rax
je 0x6dc681
lea rcx, [rbx + 8]
mov r8d, 2
mov rdx, rcx
call rax
sfence
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rbx, [rsp + 0x30]
and rax, 0xfffffffffffffffe
xor r8d, r8d
lea rdx, [rbx + 8]
lea rcx, [rsi + 0x30]
call qword [rax]
jmp 0x6dc641
mov rdx, rsi
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], rsi
call fcn.004fc980
test rax, rax
mov rdi, rax
mov qword [rsp + 0x38], rax
je 0x6dc791
mov qword [rax + 0x20], 0
lea rax, [0x006d4a80]
mov qword [rdi + 0x28], rax
lea rdx, [rsi + 0x28]
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov dword [rdi + 0x10], 0
mov dword [rdi + 0x14], 0
mov qword [rdi + 0x18], 0
mov dword [rdi + 0x30], 0
mov rax, qword [rsi]
mov qword [rdi + 0x38], rax
mov rax, qword [rsi + 8]
mov qword [rdi + 0x40], rax
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x48], rax
mov rax, qword [rsi + 0x18]
mov qword [rdi + 0x50], rax
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x60], 0
mov qword [rdi + 0x58], rax
lea rax, [rdi + 0x60]
cmp rdx, rax
je 0x6dc791
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x6dc791
test al, 1
mov qword [rdi + 0x60], rax
je 0x6dc7af
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x68], rax
mov rax, qword [rsi + 0x38]
mov qword [rdi + 0x70], rax
mov rax, qword [rsi + 0x40]
mov qword [rdi + 0x78], rax
mov qword [rsi + 0x28], 0
mov qword [rsp + 0x40], rdi
lock add dword [rbx + 0x30], 1
mov rdx, rdi
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rdx, [rdi + 0x68]
and rax, 0xfffffffffffffffe
mov r8d, 1
lea rcx, [rsi + 0x30]
call qword [rax]
jmp 0x6dc789
Function at 0x6dc840
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x007f4530]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x6dc870
jmp 0x6dc930
mov rax, qword [rax + 0x10]
test rax, rax
je 0x6dc930
cmp rbx, qword [rax]
jne 0x6dc863
cmp qword [rax + 8], 0
je 0x6dc930
lfence
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x30], 0
mov rdi, qword [rsi]
test rax, rax
je 0x6dc8bc
test al, 1
mov qword [rsp + 0x30], rax
je 0x6dc910
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsi + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rsi + 0x40]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x30]
mov r9, qword [rsi + 0x20]
mov r8, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x20], rbx
call rdi
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x6dc901
test al, 1
jne 0x6dc901
and rax, 0xfffffffffffffffe
mov rax, qword [rax]
test rax, rax
je 0x6dc901
lea rcx, [rbx + 8]
mov r8d, 2
mov rdx, rcx
call rax
sfence
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rbx, [rsp + 0x30]
and rax, 0xfffffffffffffffe
xor r8d, r8d
lea rdx, [rbx + 8]
lea rcx, [rsi + 0x30]
call qword [rax]
jmp 0x6dc8c1
mov rdx, rsi
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], rsi
call fcn.004fc980
test rax, rax
mov rdi, rax
mov qword [rsp + 0x38], rax
je 0x6dca11
mov qword [rax + 0x20], 0
lea rax, [0x006d4f50]
mov qword [rdi + 0x28], rax
lea rdx, [rsi + 0x28]
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov dword [rdi + 0x10], 0
mov dword [rdi + 0x14], 0
mov qword [rdi + 0x18], 0
mov dword [rdi + 0x30], 0
mov rax, qword [rsi]
mov qword [rdi + 0x38], rax
mov rax, qword [rsi + 8]
mov qword [rdi + 0x40], rax
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x48], rax
mov rax, qword [rsi + 0x18]
mov qword [rdi + 0x50], rax
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x60], 0
mov qword [rdi + 0x58], rax
lea rax, [rdi + 0x60]
cmp rdx, rax
je 0x6dca11
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x6dca11
test al, 1
mov qword [rdi + 0x60], rax
je 0x6dca2f
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x68], rax
mov rax, qword [rsi + 0x38]
mov qword [rdi + 0x70], rax
mov rax, qword [rsi + 0x40]
mov qword [rdi + 0x78], rax
mov qword [rsi + 0x28], 0
mov qword [rsp + 0x40], rdi
lock add dword [rbx + 0x30], 1
mov rdx, rdi
mov rcx, rbx
call fcn.005018a0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rdx, [rdi + 0x68]
and rax, 0xfffffffffffffffe
mov r8d, 1
lea rcx, [rsi + 0x30]
call qword [rax]
jmp 0x6dca09