joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100061720
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov qword [rcx + 8], rdx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100061761
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100061772
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x1000617a9
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000617a2
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov eax, dword [rbx + 0x2d8]
mov rsi, qword [rbx + 0x210]
shr eax, 7
and eax, 1
mov dword [rdi], eax
or dword [rbx + 0x2d8], 0x80
call qword [sym.imp.MSVCP100.dll_bool___cdecl_std::uncaught_exception_void_]
test al, al
jne 0x1000617fd
test rsi, rsi
je 0x1000617e9
mov eax, dword [rsi + 0xb4]
test al, 4
je 0x1000617e9
mov rcx, rbx
call fcn.100062190
mov eax, dword [rbx + 0x2d8]
mov ecx, eax
btc ecx, 8
and ecx, eax
mov dword [rbx + 0x2d8], ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x100061820
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10006185d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10006186e
mov rdx, qword [rbx + 0xd8]
test rdx, rdx
jne 0x1000618a5
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10006189e
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rdx, qword [rbx + 0xd8]
cmp dword [rsi], 0
jne 0x1000618be
mov eax, dword [rdx + 0x2d8]
mov ecx, eax
btc ecx, 7
and ecx, eax
mov dword [rdx + 0x2d8], ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1000618f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10006192d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10006193e
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x100061975
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10006196e
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov edi, dword [rbx + 0x204]
mov esi, edi
and edi, 0xfffffffd
shr esi, 1
and esi, 1
test dil, 1
je 0x1000619de
call fcn.1000cb090
test eax, eax
je 0x1000619db
call fcn.1000622b0
test eax, eax
jne 0x1000619de
test esi, esi
jne 0x1000619de
mov dword [rsp + 0x20], 0xb5a
mov dword [rsp + 0x24], 0x19
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x2c], 4
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x50], esi
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x40], xmm0
call fcn.100061d50
jmp 0x1000619de
and edi, 0xfffffffe
mov dword [rbx + 0x204], edi
test esi, esi
je 0x100061a26
mov ecx, 0x10000
call fcn.1000c9550
test eax, eax
je 0x100061a00
mov dword [rbx + 0x204], 1
movups xmm0, xmmword [rbx + 0x400]
mov eax, dword [rbx + 0x410]
lea rcx, [rsp + 0x60]
mov edx, 2
mov dword [rsp + 0x70], eax
movaps xmmword [rsp + 0x60], xmm0
call fcn.100062970
int3
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x100061a50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, qword gs:[8]
mov rdi, rcx
call fcn.10006bd80
lea rdx, [rsp + 0x60]
sub rdx, rbx
add rax, rdx
cmp rax, 0x20000
jb 0x100061a9d
movups xmm0, xmmword [rdi]
mov eax, dword [rdi + 0x10]
lea rcx, [rsp + 0x20]
mov edx, 1
mov dword [rsp + 0x30], eax
movaps xmmword [rsp + 0x20], xmm0
call fcn.100062970
int3
mov qword [rsp + 0x50], rsi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100061acd
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100061ade
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x100061b15
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100061b0e
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
test byte [rbx + 0x204], 1
mov esi, 2
jne 0x100061b37
mov ecx, 0x10000
call fcn.1000c9550
mov ecx, 3
test eax, eax
cmovne esi, ecx
or dword [rbx + 0x204], esi
mov r8d, dword [rdi]
mov ecx, dword [rbx + 0x204]
mov rsi, qword [rsp + 0x50]
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 0x1d
jne 0x100061b77
lea eax, [r8 - 0xb54]
cmp eax, 6
jne 0x100061b77
or ecx, 1
mov dword [rbx + 0x204], ecx
mov eax, dword [rdi]
lea rdx, [0x10022abe8]
lea rcx, [rsp + 0x58]
mov dword [rbx + 0x400], eax
mov eax, dword [rdi + 4]
mov dword [rbx + 0x404], eax
mov eax, dword [rdi + 8]
mov dword [rbx + 0x408], eax
mov eax, dword [rdi + 0xc]
mov dword [rbx + 0x40c], eax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x410], eax
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x100061c20
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x60
mov r15, qword [rsp + 0x88]
lea rbx, [rsp + 0xb0]
mov esi, r8d
mov ebp, edx
mov r14d, ecx
mov qword [rsp + 0x40], rbx
call fcn.100068a80
test eax, eax
je 0x100061d16
mov qword [rsp + 0x58], rdi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100061c8a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100061c9b
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x100061cd2
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100061ccb
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rbx, qword [rbx + 0x3b8]
call fcn.1001267c0
mov qword [rsp + 0x38], r15
mov rdx, rax
mov eax, dword [rsp + 0xa8]
lea rcx, [0x100005b38]
mov dword [rsp + 0x30], eax
mov r9d, r14d
mov r8, rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.MSVCR100.dll__printf_l]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
mov r9d, dword [rsp + 0xa8]
mov r8d, esi
mov edx, ebp
mov ecx, r14d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
call fcn.1000611b0
mov eax, 1
add rsp, 0x60
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x100061d50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push r12
push r15
sub rsp, 0x70
mov r12, qword [rsp + 0x88]
lea rbx, [rsp + 0x98]
mov r15, rcx
mov qword [rsp + 0x40], rbx
call fcn.100068a80
test eax, eax
je 0x100061e88
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100061dcc
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100061ddd
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x100061e14
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100061e0d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov r14d, dword [r15]
mov esi, dword [r15 + 0xc]
mov ebp, dword [r15 + 4]
mov rbx, qword [rbx + 0x3b8]
mov eax, 0x51eb851f
imul r14d
mov edi, edx
sar edi, 5
mov eax, edi
shr eax, 0x1f
add edi, eax
mov eax, edi
imul eax, eax, 0x64
sub r14d, eax
call fcn.1001267c0
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], esi
lea rcx, [0x100005b38]
mov r9d, edi
mov rdx, rax
mov r8, rbx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.MSVCR100.dll__printf_l]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov r10d, dword [r15]
mov r9d, dword [r15 + 0xc]
mov eax, 0x51eb851f
mov r8d, 0x19
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
imul r10d
mov ecx, edx
sar ecx, 5
mov eax, ecx
shr eax, 0x1f
add ecx, eax
mov eax, ecx
imul eax, eax, 0x64
sub r10d, eax
mov edx, r10d
call fcn.1000611b0
mov eax, 1
add rsp, 0x70
pop r15
pop r12
pop rbx
ret
Function at 0x100062040
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebp, r9d
mov esi, r8d
mov edi, edx
mov ebx, ecx
cmp ecx, 0x1d
je 0x100062150
cmp ecx, 0x24
jne 0x10006207f
cmp edx, 0x18
je 0x100062150
call fcn.10006b720
lea rcx, [0x100005b80]
mov r9d, ebp
mov r8d, edi
mov edx, ebx
mov dword [rsp + 0x20], esi
call rax
call fcn.1001267c0
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ebp
lea r8, [0x100005c70]
lea rcx, [rsp + 0x40]
mov r9, rax
mov edx, 0x100
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.100060cc0
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000620f2
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100062103
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x10006213a
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100062133
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
call fcn.10006b7c0
xor r9d, r9d
lea rdx, [rsp + 0x40]
lea r8d, [r9 + 0x3f]
mov rcx, rbx
call rax
mov eax, 3
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x258
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1000622b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000622e5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000622f6
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10006232d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100062326
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov ecx, dword [rax + 0x2d8]
test cl, cl
js 0x10006234a
bt ecx, 8
jb 0x10006234a
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000632d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
test rcx, rcx
je 0x1000632ed
lea rbx, [rcx - 0x90]
jmp 0x1000632ef
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
mov rdx, rbx
add rcx, 0x40
call fcn.100063130
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x10006332a
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rcx, qword [rbx + 0x110]
mov qword [rbx + 0xd0], rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetEvent]
Function at 0x1000644b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000644ed
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rdi + 0x110]
mov qword [rdi + 0xd0], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetEvent]

Function at 0x100064b20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100064b55
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0x100]
xor edi, edi
mov qword [rbx + 0x110], rdi
test rcx, rcx
je 0x100064b77
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x100], rdi
mov qword [rbx + 0xe8], rdi
call fcn.100068a00
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100064c03
mov r8, qword [0x100278b50]
test r8, r8
je 0x100064bf3
movabs r10, 0xdd67c8a60dd67c8b
lea rax, [r8 + 0x10]
cmp rbx, rax
jb 0x100064beb
lea rax, [r8 + 0x48e8]
cmp rbx, rax
ja 0x100064beb
mov rcx, rbx
mov rax, r10
mov r9d, 1
sub rcx, r8
sub rcx, 0x10
mul rcx
shr rdx, 8
mov eax, edx
and edx, 0x1f
movzx ecx, dl
shr eax, 5
shl r9d, cl
not r9d
lock and dword [r8 + rax*4 + 8], r9d
mov r8, qword [r8]
test r8, r8
jne 0x100064ba5
call fcn.100068a00
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000669d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100066a05
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100066a16
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100066a4d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100066a46
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x218]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100067250
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov rdi, rcx
xor r14d, r14d
mov esi, r14d
call fcn.10006b940
test eax, eax
je 0x100067288
mov eax, 0x80000000
jmp 0x100067393
lea rax, [rdi + 0x28]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], r14d
mov edx, dword gs:[0x48]
mov rcx, qword [rsp + 0x28]
xor eax, eax
lock cmpxchg dword [rcx], edx
mov eax, r14d
sete al
test eax, eax
jne 0x1000672bd
mov rcx, qword [rsp + 0x28]
call fcn.100062f60
mov dword [rsp + 0x30], 1
call fcn.100068a00
mov rbx, rax
mov rcx, qword gs:[0x30]
lea rbp, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000672f1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
add rdi, 0x30
mov rbx, qword [rdi + 8]
cmp rbx, rdi
cmove rbx, r14
test rbx, rbx
je 0x100067384
cmp qword [rbx + 0x11f8], 0
je 0x100067371
mov rcx, qword [rbx + 0x238]
test rcx, rcx
je 0x100067371
cmp qword [rcx + 0xe8], rcx
jne 0x100067371
test byte [rcx + 0xe0], 0x10
jne 0x100067371
mov rax, qword [rcx + 0xd8]
cmp rcx, rbp
je 0x100067371
test rax, rax
je 0x100067371
test dword [rax + 0x2d8], 0x400
je 0x100067371
test dword [rax + 0x220], 0x200
je 0x100067371
cmp qword [rax + 0x218], 0
jne 0x100067371
cmp qword [rax + 0x390], 0
jne 0x100067371
call fcn.100064640
or esi, eax
mov rax, qword [rbx + 8]
mov rbx, rax
cmp rax, rdi
cmove rbx, r14
test rbx, rbx
jne 0x100067305
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x100067391
mov dword [rcx], r14d
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1000675e0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd8
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r8
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor r14d, r14d
mov dword [rcx], r14d
lea r15, [rcx + 4]
mov dword [r15], r14d
add rcx, 0x10
call fcn.100065900
nop
call fcn.10006b640
mov dword [rsp + 0x70], r14d
lea rcx, [0x100067990]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], r14
add rax, 0x230
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], 0xffffffffffffffff
mov qword [rsp + 0x90], r14
call fcn.100068a00
mov rsi, rax
mov rax, qword gs:[0x30]
lea rbx, [rax + rsi]
mov rcx, rsi
call fcn.10006c530
test eax, eax
jne 0x1000676a7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000676d8
cmp qword [rbx + 0xe8], rbx
jne 0x1000676d8
call fcn.1001672c0
test eax, eax
je 0x1000676d8
call qword [0x1002aaa48]
test eax, eax
je 0x1000676d8
lea rcx, [rsp + 0xa0]
call qword [0x1002aab88]
jmp 0x1000676f4
movups xmm0, xmmword [0x100005d18]
movaps xmmword [rsp + 0xa0], xmm0
mov eax, dword [0x100005d28]
mov dword [rsp + 0xb0], eax
lea rsi, [rdi + 0xe30]
mov qword [rsp + 0x58], rsi
lea rcx, [rsi + 8]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
call fcn.100067420
nop
lea rax, [0x100002a88]
mov qword [rsi], rax
call fcn.100068a00
mov rbp, rax
mov rax, qword gs:[0x30]
lea rbx, [rax + rbp]
mov rcx, rbp
call fcn.10006c530
test eax, eax
jne 0x10006774b
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100067786
cmp qword [rbx + 0xe8], rbx
jne 0x100067786
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x100067786
cmp qword [rax + 0x388], 0
je 0x10006777b
cmp qword [rax + 0x218], 0
je 0x10006777b
jmp 0x1000677fa
mov rcx, rbx
call fcn.100064640
nop
jmp 0x1000677fa
cmp dword [rsp + 0x140], 0
je 0x100067795
call fcn.1000caab0
test rsi, rsi
je 0x10006779e
lea r14, [rsi + 8]
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
lea r9, [rdi + 0x10]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.100063620
call fcn.100068a00
mov rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000677f4
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [rdi], 1
mov rax, rdi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10005f420
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100067830
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rbx, rcx
cmp dword [rcx], 0
je 0x100067911
call fcn.100068a00
mov rsi, rax
mov rdx, qword gs:[0x30]
lea rdi, [rdx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100067885
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100067896
mov rdi, qword [rdi + 0xd8]
test rdi, rdi
jne 0x1000678ce
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea rsi, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000678c7
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rdi, qword [rsi + 0xd8]
lea rax, [rbx + 0x10]
cmp rdi, rax
jne 0x10006790b
mov rcx, qword [rdi + 0x390]
test rcx, rcx
je 0x1000678e9
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rbx + 0xe30]
test rax, rax
je 0x1000678fb
lea rdx, [rax + 8]
jmp 0x1000678fd
xor edx, edx
mov r8d, dword [rbx + 4]
mov rcx, rdi
call fcn.100063a00
jmp 0x100067911
call fcn.1000640e0
nop
lea rcx, [rbx + 0xe30]
mov qword [rsp + 0x48], rcx
lea rax, [0x100002a88]
mov qword [rcx], rax
add rcx, 8
call fcn.100058db0
nop
add rbx, 0x10
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x300]
call fcn.100065340
nop
lea rcx, [rbx + 0x2a8]
lea r9, [0x100065890]
mov edx, 0x10
lea r8d, [rdx - 0xd]
call fcn.10005f958
nop
lea rcx, [rbx + 0x30]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp fcn.1000630a0
Function at 0x1000679d0
Capabilities:
Access peb ldr_data
Get thread local storage value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor ebp, ebp
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
add rcx, 0x10
call fcn.100065900
nop
call fcn.10006b640
mov dword [rsp + 0x40], ebp
lea rcx, [0x100067cc0]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rbp
add rax, 0x230
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0xffffffffffffffff
mov qword [rsp + 0x60], rbp
call fcn.100068a00
mov rsi, rax
mov rax, qword gs:[0x30]
lea rbx, [rax + rsi]
mov rcx, rsi
call fcn.10006c530
test eax, eax
jne 0x100067a7b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100067aa9
cmp qword [rbx + 0xe8], rbx
jne 0x100067aa9
call fcn.1001672c0
test eax, eax
je 0x100067aa9
call qword [0x1002aaa48]
test eax, eax
je 0x100067aa9
lea rcx, [rsp + 0x70]
call qword [0x1002aab88]
jmp 0x100067ac2
movups xmm0, xmmword [0x100005d18]
movaps xmmword [rsp + 0x70], xmm0
mov eax, dword [0x100005d28]
mov dword [rsp + 0x80], eax
lea rbx, [rdi + 0xe30]
mov qword [rsp + 0x28], rbx
lea rcx, [rbx + 8]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.100067420
nop
lea rax, [0x100002a88]
mov qword [rbx], rax
mov qword [rdi + 0x11f0], rbp
mov qword [rdi + 0x11f8], rbp
mov dword [rdi + 0x1200], ebp
mov dword [rdi + 0x2b0], 1
mov rax, rdi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.10005f420
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret