Function at 0x100010c98
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
xor ecx, ecx
mov r15d, r9d
mov rbp, r8
mov ebx, edx
mov rsi, rcx
mov r12, rcx
mov qword [rax - 0x48], rcx
mov qword [rax - 0x50], rcx
mov r14d, ecx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x48], rcx
mov dword [rax + 8], ecx
mov r13d, ecx
mov dword [rsp + 0x34], ecx
cmp rdi, rcx
je 0x100017e5b
cmp dword [rdi], 0x6060
jne 0x100017e5b
cmp r8, rcx
jne 0x100010d09
cmp r9d, ecx
jne 0x100017978
movabs rdx, 0x8000000000000001
cmp dword [0x1000814c4], ecx
je 0x100010d36
mov al, byte [0x1000814c8]
cmp al, 4
jb 0x100017982
test qword [0x1000814b0], rdx
jne 0x10001798f
mov eax, ebx
mov ebx, 0xfffffffc
sub eax, 2
jne 0x100011240
cmp qword [rdi + 0x48], rcx
je 0x100010d9b
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
jne 0x100010d9b
mov rcx, qword [rdi + 0x48]
lea rdx, str._DrvConvert
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x100010d9b
mov ecx, dword [0x1000801b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 2
je 0x100010d9b
mov rdx, qword [rdi + 0x48]
lea r8, [rsp + 0x40]
xor ecx, ecx
call sym.spoolsv.exe_PrvbGetDevModePerUser
mov r11, qword [rsp + 0x40]
test r11, r11
jne 0x100017be6
mov rbx, qword [rsp + 0xb0]
mov edx, dword [rsp + 0x98]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov eax, r15d
mov r8, rbp
sub eax, dword [rsp + 0x90]
cmp r15d, dword [rsp + 0x90]
mov r15d, 0xfffffff8
cmovae r9d, eax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rbx
and r9d, r15d
call qword [rax + 0x58]
mov ecx, dword [rbx]
add ecx, 7
mov r14d, eax
mov dword [rsp + 0x30], eax
and ecx, r15d
add ecx, r13d
add ecx, dword [rsp + 0x90]
mov dword [rbx], ecx
mov ebx, dword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
cmp eax, 0x7a
jne 0x100013187
mov edx, dword [rsp + 0x90]
test edx, edx
jne 0x100017ca6
test r12, r12
jne 0x100017dfb
mov ebx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rsp + 0x48]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rsp + 0x38]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x100010e64
cmp r15d, 0x7a
jne 0x100017d8c
mov esi, dword [rsp + 0x98]
cmp dword [0x1000814c4], 0
je 0x100010e99
mov al, byte [0x1000814c8]
cmp al, 4
jb 0x100017e13
movabs rdx, 0x8000000000000001
test qword [0x1000814b0], rdx
jne 0x100017e20
mov eax, ebx
jmp 0x100010e9d
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub eax, 6
je 0x100017b08
sub eax, 1
jne 0x100010d9b
jmp 0x1000179cc
cmp dword [rsp + 0x98], 9
jne 0x100010e13
jmp 0x100017c86
mov ecx, 0x6f8
jmp 0x100017e60
cmp al, cl
je 0x100010d29
jmp 0x100010d36
mov rcx, qword [0x1000814b8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000179c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100081a88]
lea rdx, [0x100077768]
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.100038828
xor ecx, ecx
jmp 0x100010d36
cmp qword [rdi + 0x48], rcx
jne 0x100017a56
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x1000814c4], esi
je 0x100017e66
mov al, byte [0x1000814c8]
cmp al, 4
jae 0x1000179fd
test al, al
jne 0x100017e66
movabs rdx, 0x8000000000000001
test qword [0x1000814b0], rdx
je 0x100017e66
mov rcx, qword [0x1000814b8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100017e66
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 9
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100081a88]
lea rdx, [0x100077778]
mov dword [rsp + 0x20], eax
call fcn.100038828
jmp 0x100017e66
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
je 0x100017a69
mov ecx, 0x32
jmp 0x1000179d9
mov r13, qword [rsp + 0xb0]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov dword [r13], 8
mov rdx, qword [rdi + 0x48]
call fcn.100041684
test eax, eax
je 0x100017aa7
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x100017aa7
movzx ebx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
add ebx, eax
add dword [r13], ebx
jmp 0x100017aae
mov ebx, dword [rsp + 0x90]
cmp r15d, dword [r13]
jae 0x100017ac4
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100010e01
mov r14d, 1
mov dword [rsp + 0x30], r14d
test rsi, rsi
je 0x100017aff
lea r12, [rbp + 8]
mov rcx, rdi
mov qword [rbp], r12
call fcn.10003b344
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x100010e01
xor r14d, r14d
mov dword [rsp + 0x30], r14d
jmp 0x100010e01
and qword [rbp], r12
jmp 0x100010e01
cmp qword [rdi + 0x48], rcx
jne 0x100017b75
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x1000814c4], esi
je 0x100017e66
mov al, byte [0x1000814c8]
cmp al, 4
jae 0x100017b37
test al, al
jne 0x100017e66
movabs rdx, 0x8000000000000001
test qword [0x1000814b0], rdx
je 0x100017e66
mov rcx, qword [0x1000814b8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100017e66
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 8
jmp 0x100017a36
mov r13, qword [rsp + 0xb0]
mov rcx, rdi
mov dword [r13], 8
call fcn.10003b344
mov qword [rsp + 0x48], rax
test rax, rax
je 0x100010dfa
mov rsi, qword [rax + 0x38]
test rsi, rsi
je 0x100017bb4
movzx ebx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
add ebx, eax
add dword [r13], ebx
jmp 0x100017bbb
mov ebx, dword [rsp + 0x90]
cmp r15d, dword [r13]
jb 0x100017ab4
mov r14d, 1
mov dword [rsp + 0x30], r14d
test rsi, rsi
je 0x100017aff
lea r12, [rbp + 8]
mov qword [rbp], r12
jmp 0x100010e01
mov rcx, qword [rdi + 8]
lea rdx, str.win32spl.dll
mov rsi, r11
mov rcx, qword [rcx + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x100017c54
mov dword [rsp + 0x34], 1
test rbp, rbp
je 0x100017c54
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x30]
mov r9d, r15d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rdi + 0x10]
mov r8, rbp
mov edx, 4
call qword [rax + 0x58]
test eax, eax
je 0x100017c54
test byte [rbp + 0x10], 0x40
je 0x100017c3f
test byte [rbp + 0x10], 0x10
jne 0x100017c54
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.1000413b4
cmp qword [rsp + 0x38], r12
jne 0x100017c70
movzx ecx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
lea edx, [rcx + rax + 3]
and edx, ebx
mov dword [rsp + 0x90], edx
and r15d, ebx
mov r13d, 3
mov dword [rsp + 0xa8], r15d
jmp 0x100010d9b
test rsi, rsi
jne 0x100010e13
test rbp, rbp
je 0x100010e13
cmp qword [rbp], rsi
cmovne rsi, qword [rbp]
jmp 0x100010e13
test rbp, rbp
je 0x100010e22
test r14d, r14d
je 0x100010e22
mov r13, qword [rsp + 0x38]
mov r14d, edx
test r13, r13
jne 0x100017cef
mov r13, qword [rbp + 0x38]
test r13, r13
je 0x100017ce3
movzx ecx, word [r13 + 0x46]
movzx eax, word [r13 + 0x44]
lea r14d, [rcx + rax + 3]
and r14d, 0xfffffffc
jmp 0x100017ce6
xor r14d, r14d
test r13, r13
je 0x100017de0
mov r8, rsi
mov rdx, r13
mov rcx, rdi
call fcn.100041030
test eax, eax
jne 0x100017dd9
xor r12d, r12d
cmp dword [rsp + 0x34], r12d
jne 0x100017d28
mov rax, qword [0x1000802b0]
cmp qword [rdi + 8], rax
jne 0x100017d78
test byte [rbp + 0x68], 0x10
je 0x100017d28
test byte [rbp + 0x68], 0x40
jne 0x100017d78
mov r9d, r14d
mov r8, r13
mov rdx, rsi
mov rcx, rdi
call fcn.10004107c
test eax, eax
je 0x100017d78
cmp r13, qword [rsp + 0x38]
jne 0x100017d65
mov ebx, dword [rsp + 0x90]
mov r12d, dword [rsp + 0xa8]
mov rsi, qword [rsp + 0x38]
sub r12, rbx
mov rax, rbx
add r12, rbp
mov qword [rbp + 0x38], r12
mov rdx, qword [rdi + 0x48]
mov r8, r13
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x100010e22
mov rdx, qword [rdi + 0x48]
xor r8d, r8d
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
nop
jmp 0x100010e2b
mov rcx, qword [0x100080210]
lea rax, [0x100080210]
cmp rcx, rax
je 0x100010e64
test byte [rcx + 0x1c], 1
mov esi, dword [rsp + 0x98]
je 0x100010e6b
mov r9, qword [rdi + 0x48]
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xe]
lea r8, [0x100079bf0]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], esi
call fcn.10003aed0
jmp 0x100010e6b
mov edx, dword [rsp + 0x90]
mov r12d, dword [rsp + 0xa8]
mov eax, edx
mov ebx, edx
sub r12, rax
add r12, rbp
mov qword [rbp + 0x38], r12
jmp 0x100010e22
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov ebx, 1
jmp 0x100010e2f
test al, al
je 0x100010e82
jmp 0x100010e99
mov rcx, qword [0x1000814b8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100010e99
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100081a88]
lea rdx, [0x100077778]
mov r9d, esi
mov dword [rsp + 0x20], r15d
call fcn.100038828
nop
jmp 0x100010e99
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100010e9d