joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007cf20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
movzx ecx, byte [rcx + 0xcc]
mov r12d, edx
shl r12d, cl
mov qword [rsp + 0x60], rsi
mov r15d, edx
add r12, qword [r13 + 0xc0]
xor ebp, ebp
mov qword [rsp + 0x68], rdi
lea r14d, [rbp + 1]
nop dword [rax]
mov rbx, qword [r12 + 8]
test rbx, rbx
je 0x10007cfcf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor r8d, r8d
test rax, rax
cmovne r8, rax
test r8, r8
jne 0x10007cfc2
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x10007cfc6
nop dword [rax + rax]
cmp rcx, rbx
jae 0x10007cfc6
lea rdx, [rcx + 0x90]
mov rax, rcx
lock cmpxchg qword [rbx + 0x18], rdx
je 0x10007cfb2
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x10007cf90
jmp 0x10007cfc6
cmp rdx, rbx
jne 0x10007cfbf
mov qword [rbx + 0x18], 0
mov r8, rcx
lock dec dword [rbx + 0x28]
test r8, r8
jne 0x10007d11b
movzx ecx, byte [r13 + 0xcc]
mov esi, r15d
shl esi, cl
add rsi, qword [r13 + 0xc0]
movzx edi, word [rsi]
cmp di, 0x40
jne 0x10007d008
call fcn.10006b940
test eax, eax
je 0x10007d006
mov ecx, r15d
call fcn.10006be50
movzx edi, word [rax + 2]
mov word [rsi], di
jmp 0x10007d008
xor edi, edi
movzx r9d, di
mov r8d, r15d
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x20], ebp
call fcn.10007d8f0
test eax, eax
jne 0x10007d047
movzx r9d, di
mov r8d, r15d
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x20], ebp
call fcn.10007db20
test eax, eax
jne 0x10007d047
test ebp, ebp
jne 0x10007d120
lea ebp, [rax + 1]
test r14d, 0x1fff
jne 0x10007d113
call fcn.100089d00
test eax, eax
jne 0x10007d120
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10007d08c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10007d09d
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10007d0d4
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10007d0cd
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
rdtsc
mov r8, qword [rcx + 0x2f8]
shl rdx, 0x20
or rax, rdx
cmp rax, r8
ja 0x10007d10e
mov rdx, r8
sub rdx, rax
mov rax, qword [rcx + 0x218]
cmp rdx, qword [rax + 0xab0]
jbe 0x10007d113
movabs rax, 0x7fffffffffffffff
cmp r8, rax
je 0x10007d113
call fcn.1000655c0
inc r14d
jmp 0x10007cf60
mov rax, r8
jmp 0x10007d122
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x10007d620
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r14, rcx
mov eax, 1
xchg dword [0x100256308], eax
mov qword [rcx], rdx
mov rdx, qword [0x100256310]
add rcx, 0xc0
call fcn.1000f39d0
xor r12d, r12d
mov edi, r12d
cmp dword [r14 + 0xc8], r12d
jbe 0x10007d7e0
lea r13d, [r12 + 0x40]
call fcn.10006aec0
mov esi, r12d
cmp edi, eax
setb sil
mov dword [rsp + 0x64], esi
test esi, esi
je 0x10007d726
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10007d6c8
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10007d6d9
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10007d711
call fcn.100063d30
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10007d70a
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov dword [rcx + 0x7c], edi
mov edx, edi
mov rcx, qword [rcx + 0x228]
call fcn.100089910
mov dword [rsp + 0x60], eax
movzx ecx, byte [r14 + 0xcc]
mov eax, edi
shl eax, cl
mov ecx, eax
add rcx, qword [r14 + 0xc0]
mov qword [rcx + 8], r12
mov word [rcx], r13w
test esi, esi
je 0x10007d7d1
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10007d776
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10007d787
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10007d7be
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10007d7b7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov edx, dword [rsp + 0x60]
mov dword [rcx + 0x7c], edx
mov rcx, qword [rcx + 0x228]
call fcn.100089910
inc edi
cmp edi, dword [r14 + 0xc8]
jb 0x10007d682
call fcn.10006bea0
mov word [r14 + 8], ax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10007deb0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x10023c9a0]
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
mov qword [rcx + 0x28], rax
lea rax, [0x100255a00]
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov dword [0x100255a14], 0
mov dword [0x100255a20], 0
call fcn.100085880
mov r9d, 0x20
lea rdx, [rbx + 0x70]
shl rax, 0xd
lea r8d, [r9 + 0x20]
lea rcx, [rbx + 0x10]
mov qword [0x100255a18], rax
call fcn.1000f3ae0
mov rcx, qword [rbx + 0x20]
cmp dword [rcx + 0x10], 1
jne 0x10007df89
call fcn.10007a0b0
test rax, rax
je 0x10007df59
mov rdx, rax
mov rcx, rbx
call fcn.10007f370
mov rcx, qword [rbx + 0x20]
call fcn.10007a0b0
test rax, rax
jne 0x10007df40
mov rax, qword [rbx + 0x20]
cmp dword [rax + 0x14], 0
jne 0x10007df89
call fcn.10006b720
lea rcx, [0x10001ad30]
call rax
mov eax, 0xc0000000
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x70
pop rbx
ret
Function at 0x10007e580
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
movzx ecx, byte [rcx + 0xcc]
mov r12d, edx
shl r12d, cl
mov qword [rsp + 0x60], rsi
mov r15d, edx
add r12, qword [r13 + 0xc0]
xor ebp, ebp
mov qword [rsp + 0x68], rdi
lea r14d, [rbp + 1]
nop dword [rax]
mov rbx, qword [r12 + 8]
test rbx, rbx
je 0x10007e62c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor r8d, r8d
test rax, rax
cmovne r8, rax
test r8, r8
jne 0x10007e61f
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x10007e623
nop dword [rax + rax]
cmp rcx, rbx
jae 0x10007e623
lea rdx, [rcx + 0x40]
mov rax, rcx
lock cmpxchg qword [rbx + 0x18], rdx
je 0x10007e60f
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x10007e5f0
jmp 0x10007e623
cmp rdx, rbx
jne 0x10007e61c
mov qword [rbx + 0x18], 0
mov r8, rcx
lock dec dword [rbx + 0x28]
test r8, r8
jne 0x10007e778
movzx ecx, byte [r13 + 0xcc]
mov esi, r15d
shl esi, cl
add rsi, qword [r13 + 0xc0]
movzx edi, word [rsi]
cmp di, 0x40
jne 0x10007e665
call fcn.10006b940
test eax, eax
je 0x10007e663
mov ecx, r15d
call fcn.10006be50
movzx edi, word [rax + 2]
mov word [rsi], di
jmp 0x10007e665
xor edi, edi
movzx r9d, di
mov r8d, r15d
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x20], ebp
call fcn.10007eeb0
test eax, eax
jne 0x10007e6a4
movzx r9d, di
mov r8d, r15d
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x20], ebp
call fcn.10007f070
test eax, eax
jne 0x10007e6a4
test ebp, ebp
jne 0x10007e77d
lea ebp, [rax + 1]
test r14d, 0x1fff
jne 0x10007e770
call fcn.100089d00
test eax, eax
jne 0x10007e77d
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10007e6e9
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10007e6fa
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10007e731
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10007e72a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
rdtsc
mov r8, qword [rcx + 0x2f8]
shl rdx, 0x20
or rax, rdx
cmp rax, r8
ja 0x10007e76b
mov rdx, r8
sub rdx, rax
mov rax, qword [rcx + 0x218]
cmp rdx, qword [rax + 0xab0]
jbe 0x10007e770
movabs rax, 0x7fffffffffffffff
cmp r8, rax
je 0x10007e770
call fcn.1000655c0
inc r14d
jmp 0x10007e5c0
mov rax, r8
jmp 0x10007e77f
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x10007ebf0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r14, rcx
mov eax, 1
xchg dword [0x100256318], eax
mov qword [rcx], rdx
mov rdx, qword [0x100256320]
add rcx, 0xc0
call fcn.1000f39d0
xor r12d, r12d
mov edi, r12d
cmp dword [r14 + 0xc8], r12d
jbe 0x10007edb0
lea r13d, [r12 + 0x40]
call fcn.10006aec0
mov esi, r12d
cmp edi, eax
setb sil
mov dword [rsp + 0x64], esi
test esi, esi
je 0x10007ecf6
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10007ec98
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10007eca9
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10007ece1
call fcn.100063d30
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10007ecda
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov dword [rcx + 0x7c], edi
mov edx, edi
mov rcx, qword [rcx + 0x228]
call fcn.100089910
mov dword [rsp + 0x60], eax
movzx ecx, byte [r14 + 0xcc]
mov eax, edi
shl eax, cl
mov ecx, eax
add rcx, qword [r14 + 0xc0]
mov qword [rcx + 8], r12
mov word [rcx], r13w
test esi, esi
je 0x10007eda1
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10007ed46
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10007ed57
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10007ed8e
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10007ed87
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov edx, dword [rsp + 0x60]
mov dword [rcx + 0x7c], edx
mov rcx, qword [rcx + 0x228]
call fcn.100089910
inc edi
cmp edi, dword [r14 + 0xc8]
jb 0x10007ec52
call fcn.10006bea0
mov word [r14 + 8], ax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000816f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov r15, r8
mov r14, rdx
mov esi, r12d
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100081738
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100081749
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100081780
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100081779
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov ebx, dword [rax + 0x7c]
mov qword [rsp + 0x70], rbp
call fcn.10006b940
test eax, eax
jne 0x100081797
movzx ebp, r12w
jmp 0x1000817a2
mov ecx, ebx
call fcn.10006be50
movzx ebp, word [rax + 2]
lea rcx, [0x100251800]
mov edx, ebx
call fcn.10007cf20
mov rbx, rax
test rax, rax
je 0x100081928
lea r9, [rsp + 0x88]
lea rcx, [0x100255a30]
movzx r8d, bp
mov edx, 1
call fcn.10007dfb0
mov rsi, rax
test rax, rax
je 0x100081928
mov rdi, qword [rsp + 0x88]
mov rdx, r14
mov rcx, rax
mov r8, rdi
call fcn.100080fe0
test eax, eax
je 0x1000818de
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov r14, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x10008182f
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100081840
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x100081878
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov r14, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100081871
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
mov ecx, dword [rax + 0x7c]
mov rax, qword [rsp + 0x88]
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x38], rax
mov dword [rbx + 0x50], ecx
mov qword [rbx + 0x40], r12
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x30], r12
mov qword [rbx + 0x28], rsi
mov word [rbx + 0x54], bp
mov dword [rbx + 0x58], r12d
mov qword [rbx + 0x48], r12
mov eax, 0xffff
mov rcx, rbx
mov word [rbx + 0x56], ax
mov qword [rbx + 0x60], 1
mov rax, qword [0x10023c9a0]
mov qword [rbx + 0x40], rax
call fcn.100080850
mov qword [r15], rbx
jmp 0x100081937
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movzx r9d, bp
mov r8, rdi
mov rdx, r14
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov word [rsp + 0x20], bp
call fcn.100081370
lea rcx, [0x100255a30]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
lea rcx, [0x100251800]
mov rdx, rbx
call fcn.10007d150
mov rax, r12
jmp 0x10008193a
lea rcx, [0x100251800]
mov rdx, rbx
call fcn.10007d150
mov rax, rsi
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x100083b80
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rsi, rcx
mov qword [rsp + 0x38], rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100083bd0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100083bdf
cmp qword [rbx + 0xd8], 0
jne 0x100083c00
call fcn.100063d30
call fcn.100068a00
mov rcx, rax
mov rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100083c00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec qword [rsi + 0x30]
jne 0x100083dbd
mov qword [rsp + 0x188], rbp
mov qword [rsp + 0x198], r13
mov qword [rsp + 0x150], r15
xor r15d, r15d
lea rcx, [rsp + 0x40]
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x28], r15
mov qword [rsi + 0x18], r15
call fcn.1000f2e20
lea rcx, [rsp + 0xc0]
call fcn.1000f2e20
lea r11, [rsp + 0x20]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rax
call fcn.10006ae00
mov r13d, eax
lea ebp, [r15 + 0x64]
add r13d, r13d
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rsi], edx
je 0x100083c82
mov rcx, rsi
call fcn.10005ad30
mov rbx, qword [rsi + 0x10]
lea rax, [rsi + 8]
cmp rbx, rax
cmove rbx, r15
test rbx, rbx
je 0x100083d63
mov qword [rsp + 0x190], r12
mov rsi, rax
mov qword [rsp + 0x158], r14
nop dword [rax]
dec ebp
je 0x100083d4e
mov rdi, rbx
lea r14, [rbx + 8]
lea rax, [rsp + 0x40]
mov rbx, qword [r14]
lea r12, [rsp + 0xc0]
cmp rbx, rsi
cmove rbx, r15
mov r15, qword [rdi + 0x218]
test byte [rdi + 0x2d8], 4
cmove r12, rax
lea rdx, [r15 + 0x1030]
mov rcx, r12
call fcn.1000f2ff0
test rax, rax
jne 0x100083d3a
mov rax, qword [rdi]
mov r8, qword [r14]
lea rdx, [r15 + 0x1030]
mov qword [rax + 8], r8
mov qword [r8], rax
mov rax, qword [rsp + 0x28]
mov qword [r14], rax
mov rax, qword [rsp + 0x28]
mov rcx, r12
mov qword [rax], rdi
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rdi
mov qword [rdi], rax
call fcn.1000f2f80
dec r13d
je 0x100083d4b
mov r15d, 0
test rbx, rbx
jne 0x100083cb0
jmp 0x100083d4e
xor r15d, r15d
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x158]
mov r12, qword [rsp + 0x190]
mov r13, qword [rsp + 0x198]
mov rbp, qword [rsp + 0x188]
mov dword [rsi], r15d
nop word [rax + rax]
mov rcx, qword [rsp + 0x28]
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x100083db5
test rcx, rcx
je 0x100083db5
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rax + 8], rdx
mov qword [rdx], rax
xor edx, edx
mov qword [rcx + 8], r15
mov qword [rcx], r15
call fcn.1000d5520
jmp 0x100083d80
mov r15, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x160
pop rdi
pop rsi
pop rbx
ret
Function at 0x100083de0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov r13d, r8d
mov rsi, rdx
mov rbx, rcx
xor r15d, r15d
mov r12d, r15d
mov r14d, dword [rsp + 0x80]
nop dword [rax]
mov ecx, r15d
xor eax, eax
lock cmpxchg qword [rbx + 0x18], rsi
jne 0x100083e54
mov rax, qword [rsi + 0x218]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], 1
mov rax, qword [rsi + 0x210]
mov qword [rbx + 0x20], rax
mov qword [rsi + 0xd0], r15
jmp 0x100083e59
mov ecx, 0x80000000
test ecx, ecx
je 0x100083ff4
or ebp, 0xffffffff
cmp r13d, ebp
je 0x100083e92
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r12, r12
cmove r14d, eax
mov ecx, eax
sub ecx, r14d
cmp r13d, ecx
jbe 0x100083fe9
mov ebp, r14d
sub ebp, eax
add ebp, r13d
je 0x100083fe9
mov dword [rsp + 0x28], r15d
call fcn.100068a00
mov r15, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100083ec4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100083ed5
mov rdi, qword [rdi + 0xd8]
test rdi, rdi
jne 0x100083f0d
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea r15, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100083f06
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r15, rax
mov rdi, qword [r15 + 0xd8]
mov qword [rsp + 0x30], rdi
mov ecx, dword [rdi + 0x220]
mov eax, ecx
and eax, 1
xor eax, 1
mov dword [rsp + 0x28], eax
or ecx, 1
mov dword [rdi + 0x220], ecx
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx], edx
mov r15d, 0
mov ecx, r15d
sete cl
test ecx, ecx
jne 0x100083f52
mov rcx, rbx
call fcn.10005ad30
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x100083f6f
mov dword [rbx], r15d
mov eax, dword [rsp + 0x28]
not eax
and dword [rdi + 0x220], eax
jmp 0x100083e20
lea rax, [rbx + 0x20]
mov qword [rsi + 0xd0], rax
lea rcx, [rbx + 8]
mov rax, qword [rcx]
mov qword [rsi], rax
mov rax, qword [rcx]
mov qword [rax + 8], rsi
mov qword [rcx], rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x290], rcx
mov qword [rsi + 0x298], rbx
mov dword [rbx], r15d
mov r15, qword [rsp + 0x98]
mov rcx, r15
call fcn.1000cfc60
mov edx, ebp
mov rcx, rsi
call fcn.1000d54f0
mov ebp, eax
mov rcx, r15
call fcn.1000cfe30
xor r15d, r15d
mov qword [rsi + 0xd0], r15
mov ecx, dword [rsp + 0x28]
not ecx
and dword [rdi + 0x220], ecx
test ebp, ebp
jne 0x100083ff0
inc r12
jmp 0x100083e20
mov eax, 0x102
jmp 0x100083ff6
mov eax, ebp
jmp 0x100083ff6
mov eax, ecx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000843b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push r13
push r14
sub rsp, 0x78
xor r13d, r13d
cmp dword [0x100255a10], 1
mov r14, rdx
je 0x10008460b
mov qword [rsp + 0x58], r12
mov r12, qword [rsp + 0xb0]
test r12, r12
je 0x1000843f3
mov qword [r12], r13
mov r13, r9
test rdx, rdx
je 0x100084606
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x68], rsi
lea rax, [rcx + 0xd0]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rbp, rax
test rax, rax
je 0x1000845ea
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x40], 0
mov r15, qword [rsi + 0x20]
mov rdi, qword [r15 + 0x30]
movzx ebx, word [r15 + 0x54]
call fcn.10006add0
mov rcx, rax
movzx edx, bx
call fcn.100082130
or rcx, 0xffffffffffffffff
lock xadd qword [rax + 0x70], rcx
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x90]
lock xadd qword [rcx + 0x68], rax
mov rax, qword [rdi + 0x38]
movzx r9d, word [rcx + 0x80]
mov r8, qword [r15 + 0x38]
test rax, rax
je 0x1000844ad
nop word [rax + rax]
mov rax, qword [rax + 0x38]
mov r8, qword [r8 + 0x38]
test rax, rax
jne 0x1000844a0
mov ebx, dword [rsp + 0xa0]
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x10]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov word [rsp + 0x20], r9w
movzx r9d, word [r15 + 0x54]
call fcn.100081370
test ebx, ebx
je 0x1000844fc
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
add qword [r12], rax
mov rax, qword [r12]
lea r13, [rcx + rax*8]
dec r14
lock dec qword [rsi + 0x28]
jne 0x10008451c
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
mov qword [rsi + 0x38], 0
call fcn.100078830
movzx eax, r14b
and al, 0x7f
cmp al, 0x7f
jne 0x1000845dc
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100084555
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100084566
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10008459d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100084596
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
rdtsc
mov r8, qword [rcx + 0x2f8]
shl rdx, 0x20
or rax, rdx
cmp rax, r8
ja 0x1000845d7
mov rdx, r8
sub rdx, rax
mov rax, qword [rcx + 0x218]
cmp rdx, qword [rax + 0xab0]
jbe 0x1000845dc
movabs rax, 0x7fffffffffffffff
cmp r8, rax
je 0x1000845dc
call fcn.1000655c0
mov rax, qword [rsp + 0x48]
test r14, r14
jne 0x100084424
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
mov r12, qword [rsp + 0x58]
add rsp, 0x78
pop r14
pop r13
ret