joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fe010
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x20
xor r12d, r12d
cmp dword [rcx + 0xc], 1
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
mov r15d, r12d
jne 0x1000fe036
call fcn.1000fe960
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r14
cmp ebp, 4
jne 0x1000fe0aa
mov rcx, qword [rsi + 0x48]
xor edx, edx
call fcn.1000ff090
mov ebp, eax
test eax, eax
jne 0x1000fe0a3
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rsi + 0x50], edx
je 0x1000fe06f
lea rcx, [rsi + 0x50]
call fcn.1000d2e10
mov rax, qword [rsi + 0x28]
lea rbx, [rsi + 0x28]
mov qword [rdi], rax
mov rax, qword [rbx]
mov qword [rax + 8], rdi
mov qword [rbx], rdi
mov qword [rdi + 8], rbx
mov dword [rsi + 0x50], r12d
cmp qword [rbx + 8], rbx
je 0x1000fe0a3
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbx + 8], rbx
jne 0x1000fe092
mov eax, ebp
jmp 0x1000fe1ee
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rsi + 0x50], edx
je 0x1000fe0c3
lea rcx, [rsi + 0x50]
call fcn.1000d2e10
mov rbx, qword [rsi + 0x40]
lea rax, [rsi + 0x38]
cmp rbx, rax
je 0x1000fe100
test rbx, rbx
je 0x1000fe100
add rbx, 0xffffffffffffff80
je 0x1000fe103
mov rax, qword [rbx + 0x80]
mov rcx, qword [rbx + 0x88]
mov qword [rax + 8], rcx
mov qword [rcx], rax
mov qword [rbx + 0x88], r12
mov qword [rbx + 0x80], r12
jmp 0x1000fe12f
mov rbx, r12
cmp dword [rsi + 0xc], r12d
je 0x1000fe116
cmp ebp, 2
je 0x1000fe116
mov r15d, 0x80000000
jmp 0x1000fe12f
mov rax, qword [rsi + 0x18]
lea rcx, [rsi + 0x18]
mov qword [rdi], rax
mov rax, qword [rcx]
mov qword [rax + 8], rdi
mov qword [rcx], rdi
mov qword [rdi + 8], rcx
mov dword [rsi + 0x50], r12d
test rbx, rbx
je 0x1000fe1eb
mov edx, dword [rdi + 0x7c]
mov rcx, rbx
call fcn.100089910
mov qword [rdi + 0x228], rbx
mov qword [rbx + 0xd8], rdi
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x1000fe182
mov rax, qword [rdi + 0x30]
test rax, rax
je 0x1000fe182
mov r8d, 0x10
mov rcx, rbx
cmp rax, r8
cmovl r8, rax
shl r8, 3
call sub.MSVCR100.dll_memcpy
jmp 0x1000fe192
xor edx, edx
mov r8d, 0x80
mov rcx, rbx
call sub.MSVCR100.dll_memset
mov eax, dword [rbx + 0xe0]
mov ecx, eax
xor ecx, 1
and ecx, eax
mov eax, ecx
xor eax, 2
and eax, ecx
mov dword [rbx + 0xe0], eax
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000fe1d7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rcx, qword [rbx + 0x110]
mov qword [rbx + 0xd0], rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, r15d
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000fea10
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov r15d, r8d
mov r14, rdx
mov rbx, rcx
xor r12d, r12d
test r8d, r8d
jne 0x1000feb78
mov dword [rax - 0x50], 0x40006f
mov qword [rax - 0x48], r12
mov qword [rax - 0x38], r12
mov qword [rax - 0x40], r12
mov qword [rax - 0x30], r12
lea edx, [r8 + 1]
lea rcx, [rax - 0x60]
call fcn.100057f20
nop
call fcn.100068a00
mov rbp, rax
mov rcx, qword gs:[0x30]
lea rsi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fea95
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rsi, rsi
je 0x1000feaa6
mov rsi, qword [rsi + 0xd8]
test rsi, rsi
jne 0x1000feade
call fcn.100063d30
call fcn.100068a00
mov rsi, rax
mov rcx, qword gs:[0x30]
lea rbp, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000fead7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
mov rsi, qword [rbp + 0xd8]
mov rcx, qword [rsi + 0x210]
test rcx, rcx
je 0x1000feb14
mov eax, dword [rcx + 0xb4]
test al, 4
je 0x1000feb14
mov rax, qword [rcx + 0x98]
test byte [rax + 0x220], 1
jne 0x1000feb14
mov eax, dword [rax + 0x2d8]
test al, al
js 0x1000feb14
bt eax, 8
jae 0x1000feb67
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0x28], edx
mov ecx, r12d
sete cl
test ecx, ecx
jne 0x1000feb35
lea rcx, [rbx + 0x28]
call fcn.100076600
cmp dword [rbx + 0x48], 0
jne 0x1000feb48
mov dword [rbx + 0x48], 2
mov dword [rbx + 0x28], r12d
jmp 0x1000feb63
lea r9, [rsp + 0x38]
or r8d, 0xffffffff
mov edx, 2
lea rcx, [rbx + 0x28]
call fcn.1001049c0
test eax, eax
jne 0x1000feb67
mov qword [rbx + 0x50], rsi
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
not eax
and dword [rcx + 0x220], eax
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0x10], edx
je 0x1000feb91
lea rcx, [rbx + 0x10]
call fcn.100057bf0
lea rcx, [r14 + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rax, qword [rbx]
mov qword [rax + 8], rcx
mov qword [rbx], rcx
mov qword [rcx + 8], rbx
inc dword [rbx + 0x14]
mov qword [r14 + 0x20], rbx
mov dword [rbx + 0x10], r12d
inc dword [rbx + 0x18]
mov rax, qword [r14 + 0x1038]
or qword [rbx + 0x20], rax
test r15d, r15d
jne 0x1000febd4
lea rcx, [rbx + 0x28]
lea edx, [r15 + 2]
call fcn.1001047d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1000ffcd0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rbp, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000ffd17
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000ffd26
cmp qword [rbx + 0xd8], 0
jne 0x1000ffd47
call fcn.100063d30
call fcn.100068a00
mov rcx, rax
mov rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000ffd47
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
call fcn.10006af50
call fcn.10006af60
mov qword [rbp + 0x128], rsi
mov qword [rbp + 0x120], r15
xor edi, edi
test byte [rsi + 0x590], 4
mov dword [rsp + 0x78], 1
je 0x1000ffdb5
test r14, r14
jne 0x1000ffd8c
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x80], 3
jmp 0x1000ffdda
movzx edx, word [rsi + 0x88]
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x30]
mov r8, r14
call fcn.1000f2bc0
mov dword [rsp + 0x80], 3
jmp 0x1000ffdda
mov dword [rsp + 0x70], 0x7fffffff
call fcn.10006b190
mov ebx, eax
call fcn.10006ae00
xor edx, edx
mov r11d, eax
mov eax, ebx
div r11d
mov dword [rsp + 0x80], eax
movsxd r8, dword [rsp + 0x78]
mov r9d, dword [rsp + 0x70]
lea rcx, [rbp + 0xc8]
mov rdx, rbp
call fcn.1000fdf70
call fcn.10006b940
mov r8d, dword [rsp + 0x80]
test eax, eax
mov rdx, r14
mov rcx, rbp
setne dil
mov dword [rsp + 0x20], 1
mov r9d, edi
call fcn.100100120
mov rcx, rbp
mov ebx, eax
call fcn.100100ab0
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x100100120
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f0
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov dword [rsp + 0x30], r9d
mov r12, rdx
mov r15, rcx
mov dword [rsp + 0x34], r8d
xor esi, esi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100100182
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov qword [rsp + 0x548], rbp
test rbx, rbx
je 0x10010019b
mov rbp, qword [rbx + 0xd8]
test rbp, rbp
jne 0x1001001d2
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1001001cb
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbp, qword [rbx + 0xd8]
xor r14d, r14d
call fcn.10006b940
test eax, eax
jne 0x1001001e5
mov r14, qword [rbp + 0x218]
mov r13d, dword [rsp + 0x550]
xor edi, edi
nop
mov rax, r12
test rdi, rdi
je 0x100100208
lea rax, [rdi - 1]
not rdi
not rax
and rax, rdi
and rax, r12
lea rdi, [rax - 1]
not rdi
and rdi, rax
je 0x100100355
call fcn.10006af60
mov ebx, eax
call fcn.10006af50
mov r9d, ebx
mov edx, eax
mov eax, dword [rsp + 0x34]
mov r8, rdi
mov rcx, r15
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call fcn.1000ffe50
mov rbx, rax
test rax, rax
je 0x100100345
lea rcx, [rax + 0x1030]
call fcn.1000f2c90
mov dword [rbx + 0xa98], eax
call fcn.10006b940
test eax, eax
jne 0x100100272
mov qword [rbp + 0x218], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
or esi, eax
test r14, r14
je 0x100100289
mov qword [rbp + 0x218], r14
cmp r13d, 1
jne 0x1001002d9
mov dword [rbx + 0x1014], 0
call fcn.100072450
test eax, eax
je 0x1001002d3
lea rcx, [rsp + 0x40]
call fcn.100072400
mov edx, dword [rbx + 0xabc]
lea rcx, [rsp + 0x40]
call fcn.100072470
lea rcx, [rsp + 0x40]
mov edx, r13d
call fcn.100072480
lea rcx, [rsp + 0x40]
call fcn.1000724a0
lea rcx, [r15 + 0x18]
jmp 0x10010032c
mov dword [rbx + 0x1014], 1
call fcn.100072450
test eax, eax
je 0x100100328
lea rcx, [rsp + 0x290]
call fcn.100072400
mov edx, dword [rbx + 0xabc]
lea rcx, [rsp + 0x290]
call fcn.100072470
lea rcx, [rsp + 0x290]
xor edx, edx
call fcn.100072480
lea rcx, [rsp + 0x290]
call fcn.1000724a0
lea rcx, [r15 + 0x70]
xor r8d, r8d
mov rdx, rbx
call fcn.1000fea10
cmp esi, 0x80000000
jne 0x1001001f0
jmp 0x10010034a
mov esi, 0x80000000
cmp dword [rsp + 0x30], 0
jne 0x1001001f0
mov eax, esi
mov rbp, qword [rsp + 0x548]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x4f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x100101210
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
lea rbx, [rcx - 0x10]
test rcx, rcx
jne 0x100101231
mov ebx, ebp
mov rsi, qword [rcx + 0x18]
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rsi + 0x10], edx
je 0x10010124e
lea rcx, [rsi + 0x10]
call fcn.100057bf0
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
mov qword [rax + 8], rdx
mov qword [rdx], rax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x10], rbp
dec dword [rsi + 0x14]
mov dword [rsi + 0x10], ebp
mov qword [rbx + 0x28], rbp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.100065c90

Function at 0x100101460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add rcx, 0x110
jmp fcn.1000fec00
Function at 0x100103730
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
add rcx, 8
xor r9d, r9d
jmp fcn.10005ae60

Function at 0x100103e00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15d, r9d
mov r12, r8
mov ebp, edx
mov r14, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100103e47
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100103e58
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x100103e8f
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100103e88
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
test ebp, ebp
je 0x100103ee0
mov rcx, qword [rbx + 0x210]
test rcx, rcx
je 0x100103ee0
mov eax, dword [rcx + 0xb4]
test al, 4
je 0x100103ee0
mov rax, qword [rcx + 0x98]
test byte [rax + 0x220], 1
jne 0x100103ee0
mov eax, dword [rax + 0x2d8]
test al, al
js 0x100103ee0
bt eax, 8
jb 0x100103ee0
mov eax, 2
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov qword [rsp + 0x50], rsi
xor edi, edi
lea rsi, [r14 + 8]
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rsi], edx
je 0x100103f02
mov rcx, rsi
call fcn.10005ad30
mov eax, dword [r14]
test eax, eax
jle 0x100103f12
dec eax
mov dword [r14], eax
mov dword [rsi], edi
jmp 0x100103f80
test ebp, ebp
jne 0x100103f1f
mov dword [rsi], edi
mov edi, 0x102
jmp 0x100103f80
lea rcx, [r14 + 0x10]
test r15d, r15d
je 0x100103f40
mov rax, qword [rcx + 8]
mov qword [rbx + 8], rax
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov qword [rcx + 8], rbx
mov qword [rbx], rcx
jmp 0x100103f54
mov rax, qword [rcx]
mov qword [rbx], rax
mov rax, qword [rcx]
mov qword [rax + 8], rbx
mov qword [rcx], rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x290], rcx
mov qword [rbx + 0x298], rsi
mov rcx, r12
mov dword [rsi], edi
call fcn.1000cfc60
mov edx, ebp
mov rcx, rbx
call fcn.1000d54f0
mov rcx, r12
mov edi, eax
call fcn.1000cfe30
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x100104580
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov r13d, r8d
mov rsi, rdx
mov rbx, rcx
or ebp, 0xffffffff
xor r8d, r8d
mov r12d, r8d
mov r15d, dword [rsp + 0x80]
nop
mov ecx, r8d
xor eax, eax
lock cmpxchg qword [rbx + 0x18], rsi
jne 0x1001045f4
mov rax, qword [rsi + 0x218]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], 1
mov rax, qword [rsi + 0x210]
mov qword [rbx + 0x20], rax
mov qword [rsi + 0xd0], r8
jmp 0x1001045f9
mov ecx, 0x80000000
test ecx, ecx
je 0x1001047a8
mov dword [rsp + 0x28], r8d
call fcn.100068a00
mov r14, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100104633
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100104644
mov rdi, qword [rdi + 0xd8]
test rdi, rdi
jne 0x10010467c
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea r14, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100104675
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov rdi, qword [r14 + 0xd8]
mov qword [rsp + 0x30], rdi
mov ecx, dword [rdi + 0x220]
mov eax, ecx
and eax, 1
xor eax, 1
mov dword [rsp + 0x28], eax
or ecx, 1
mov dword [rdi + 0x220], ecx
cmp r13d, 0xffffffff
je 0x1001046c5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test r12, r12
cmove r15d, eax
mov ecx, eax
sub ecx, r15d
cmp r13d, ecx
jbe 0x1001046c3
mov ebp, r15d
sub ebp, eax
add ebp, r13d
jmp 0x1001046c5
xor ebp, ebp
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx], edx
mov r8d, 0
mov ecx, r8d
sete cl
test ecx, ecx
jne 0x1001046ed
mov rcx, rbx
call fcn.10005ad30
xor r8d, r8d
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x10010470a
mov dword [rbx], r8d
mov eax, dword [rsp + 0x28]
not eax
and dword [rdi + 0x220], eax
jmp 0x1001045c0
lea rax, [rbx + 0x20]
mov qword [rsi + 0xd0], rax
test ebp, ebp
je 0x10010476e
lea rcx, [rbx + 8]
mov rax, qword [rcx]
mov qword [rsi], rax
mov rax, qword [rcx]
mov qword [rax + 8], rsi
mov qword [rcx], rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x290], rcx
mov qword [rsi + 0x298], rbx
mov dword [rbx], r8d
mov rcx, qword [rsp + 0x98]
call fcn.1000cfc60
mov edx, ebp
mov rcx, rsi
call fcn.1000d54f0
mov r14d, eax
mov rcx, qword [rsp + 0x98]
call fcn.1000cfe30
xor r8d, r8d
jmp 0x100104777
mov dword [rbx], r8d
mov r14d, 0x102
mov qword [rsi + 0xd0], r8
test r14d, r14d
jne 0x100104797
inc r12
mov eax, dword [rsp + 0x28]
not eax
and dword [rdi + 0x220], eax
jmp 0x1001045c0
mov eax, dword [rsp + 0x28]
not eax
and dword [rdi + 0x220], eax
mov eax, r14d
jmp 0x1001047aa
mov eax, ecx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1001049c0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r12, r9
mov r13d, r8d
mov r15d, edx
mov rbx, rcx
mov dword [rbp - 0x30], edx
xor r14d, r14d
mov qword [rbp - 0x2c], r14
lea rax, [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], rax
mov dword [rbp - 8], r14d
mov dword [rbp - 0x24], 1
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov dword [rbp - 0x58], r14d
call fcn.100068a00
mov rsi, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100104a57
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100104a68
mov rdi, qword [rdi + 0xd8]
test rdi, rdi
jne 0x100104aa0
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea rsi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100104a99
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rdi, qword [rsi + 0xd8]
mov qword [rbp - 0x50], rdi
cmp r15d, 2
jne 0x100104aad
inc dword [rbx + 0x1c]
lea rcx, [rbx + 8]
mov rax, qword [rcx]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x40]
mov qword [rax + 8], rdx
lea rax, [rbp - 0x40]
mov qword [rcx], rax
mov qword [rbp - 0x38], rcx
mov dword [rbx], r14d
xor r9d, r9d
mov r8, r12
mov edx, r13d
lea rcx, [rbp - 0x28]
call fcn.10005ae60
mov r14d, eax
test eax, eax
je 0x100104b95
nop dword [rax + rax]
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx], edx
mov ecx, 0
sete cl
test ecx, ecx
jne 0x100104b11
mov rcx, rbx
call fcn.100076600
cmp dword [rbp - 0x2c], 1
jne 0x100104b57
mov dword [rbx], 0
mov ecx, dword [rdi + 0x220]
mov eax, ecx
and eax, 1
xor eax, 1
mov esi, dword [rbp - 0x58]
or esi, eax
mov dword [rbp - 0x58], esi
or ecx, 1
mov dword [rdi + 0x220], ecx
xor r9d, r9d
mov r8, r12
mov edx, r13d
lea rcx, [rbp - 0x28]
call fcn.10005ae60
mov r14d, eax
test eax, eax
jne 0x100104af0
jmp 0x100104b98
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov qword [rax + 8], rcx
mov qword [rcx], rax
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
cmp r15d, 2
jne 0x100104b7f
dec dword [rbx + 0x1c]
mov dword [rbx], 0
mov eax, dword [rbp - 0x58]
not eax
and dword [rdi + 0x220], eax
mov eax, r14d
jmp 0x100104ba2
mov esi, dword [rbp - 0x58]
not esi
and dword [rdi + 0x220], esi
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x100104bd0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r13, r8
mov rbx, rcx
mov edx, 1
mov r12d, dword [rsp + 0xa0]
test r12d, r12d
je 0x100104c1b
mov ebp, 0x80008000
mov r14d, 0x10001
jmp 0x100104c23
mov r14d, edx
mov ebp, 0x8000
xor r10d, r10d
test r12d, r12d
je 0x100104c3d
mov rax, qword [rbx + 0x58]
test rax, rax
je 0x100104c3d
cmp r13, rax
lea r15, [rbx + 0x68]
jmp 0x100104c45
cmp r13, qword [rbx + 0x60]
lea r15, [rbx + 0x70]
mov ecx, 0x3e8
cmove ecx, edx
nop dword [rax]
mov r8d, dword [rbx + 0x50]
lea r9d, [r8 + r14]
test ebp, r8d
jne 0x100104c7c
lea edx, [r9 + rbp]
mov eax, r8d
lock cmpxchg dword [rbx + 0x50], edx
je 0x100104dbf
lea eax, [rcx + 1]
mov ecx, 2
cmp eax, ecx
cmovg ecx, eax
lea eax, [rcx - 1]
mov ecx, eax
test eax, eax
cmovs ecx, r10d
pause
test ecx, ecx
jg 0x100104c50
test r14d, r14d
je 0x100104ca0
mov eax, r8d
lock cmpxchg dword [rbx + 0x50], r9d
cmp r8d, eax
jne 0x100104c50
mov r14d, r10d
mov dword [rsp + 0x28], r10d
call fcn.100068a00
mov rsi, rax
mov rcx, qword gs:[0x30]
lea rdi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100104cd4
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100104ce5
mov rdi, qword [rdi + 0xd8]
test rdi, rdi
jne 0x100104d1d
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea rsi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100104d16
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rdi, qword [rsi + 0xd8]
mov qword [rsp + 0x30], rdi
mov ecx, dword [rdi + 0x220]
mov eax, ecx
and eax, 1
xor eax, 1
mov dword [rsp + 0x28], eax
or ecx, 1
mov dword [rdi + 0x220], ecx
mov rsi, qword [rsp + 0x88]
mov qword [rsi + 0xd0], r15
xor r9d, r9d
mov r8, qword [rsp + 0x98]
or edx, 0xffffffff
test r12d, r12d
mov rcx, rbx
jne 0x100104d66
lea rcx, [rbx + 0x28]
call fcn.10005ae60
xor r10d, r10d
mov qword [rsi + 0xd0], r10
mov r8d, r10d
mov eax, dword [rbx + 0x50]
lea ecx, [rax + rbp]
mov edx, ebp
not edx
test eax, edx
jne 0x100104da5
lock cmpxchg dword [rbx + 0x50], ecx
je 0x100104d9b
pause
mov eax, dword [rbx + 0x50]
lea ecx, [rax + rbp]
test eax, edx
je 0x100104d86
jmp 0x100104da5
mov edx, 1
mov r8d, edx
jmp 0x100104daa
mov edx, 1
mov eax, dword [rsp + 0x28]
not eax
and dword [rdi + 0x220], eax
test r8d, r8d
je 0x100104c26
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100104de0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx], 0
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100104e23
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100104e34
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x100104e6b
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100104e64
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 8], rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100105410
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, qword [rcx + 0x10]
mov r14, rdx
mov ebx, 0x64
test rsi, rsi
je 0x100105534
mov qword [rsp + 0x30], rbp
movabs rbp, 0x7fffffffffffffff
mov qword [rsp + 0x38], rdi
nop dword [rax]
mov rax, qword [r14]
mov rdx, rsi
mov rsi, qword [rsi + 0x10]
movzx r9d, byte [rdx + 6]
mov r8d, 1
mov rcx, r14
call qword [rax + reloc.WS2_32.dll_htonl]
dec rbx
jne 0x100105521
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10010549f
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1001054b0
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x1001054e7
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1001054e0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
rdtsc
mov r8, qword [rcx + 0x2f8]
shl rdx, 0x20
or rax, rdx
cmp rax, r8
ja 0x100105517
mov rdx, r8
sub rdx, rax
mov rax, qword [rcx + 0x218]
cmp rdx, qword [rax + 0xab0]
jbe 0x10010551c
cmp r8, rbp
je 0x10010551c
call fcn.1000655c0
mov ebx, 0x64
test rsi, rsi
jne 0x100105450
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret