Function at 0x100010c00
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
xor ecx, ecx
mov r15d, r9d
mov rbp, r8
mov ebx, edx
mov rsi, rcx
mov r12, rcx
mov qword [rax - 0x48], rcx
mov qword [rax - 0x50], rcx
mov r14d, ecx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x48], rcx
mov dword [rax + 8], ecx
mov r13d, ecx
mov dword [rsp + 0x34], ecx
cmp rdi, rcx
je 0x1000181e7
cmp dword [rdi], 0x6060
jne 0x1000181e7
cmp r8, rcx
jne 0x100010c71
cmp r9d, ecx
jne 0x100017d04
movabs rdx, 0x8000000000000001
cmp dword [0x1000844c4], ecx
je 0x100010c9e
mov al, byte [0x1000844c8]
cmp al, 4
jb 0x100017d0e
test qword [0x1000844b0], rdx
jne 0x100017d1b
mov eax, ebx
mov ebx, 0xfffffffc
sub eax, 2
jne 0x1000111c0
cmp qword [rdi + 0x48], rcx
je 0x100010d03
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
jne 0x100010d03
mov rcx, qword [rdi + 0x48]
lea rdx, str._DrvConvert
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x100010d03
mov ecx, dword [0x1000831b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 2
je 0x100010d03
mov rdx, qword [rdi + 0x48]
lea r8, [rsp + 0x40]
xor ecx, ecx
call sym.spoolsv.exe_PrvbGetDevModePerUser
mov r11, qword [rsp + 0x40]
test r11, r11
jne 0x100017f72
mov rbx, qword [rsp + 0xb0]
mov edx, dword [rsp + 0x98]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov eax, r15d
mov r8, rbp
sub eax, dword [rsp + 0x90]
cmp r15d, dword [rsp + 0x90]
mov r15d, 0xfffffff8
cmovae r9d, eax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rbx
and r9d, r15d
call qword [rax + 0x58]
mov ecx, dword [rbx]
add ecx, 7
mov r14d, eax
mov dword [rsp + 0x30], eax
and ecx, r15d
add ecx, r13d
add ecx, dword [rsp + 0x90]
mov dword [rbx], ecx
mov ebx, dword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
cmp eax, 0x7a
jne 0x1000130f3
mov edx, dword [rsp + 0x90]
test edx, edx
jne 0x100018032
test r12, r12
jne 0x100018187
mov ebx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rsp + 0x48]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rsp + 0x38]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x100010dcc
cmp r15d, 0x7a
jne 0x100018118
mov esi, dword [rsp + 0x98]
cmp dword [0x1000844c4], 0
je 0x100010e01
mov al, byte [0x1000844c8]
cmp al, 4
jb 0x10001819f
movabs rdx, 0x8000000000000001
test qword [0x1000844b0], rdx
jne 0x1000181ac
mov eax, ebx
jmp 0x100010e05
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub eax, 6
je 0x100017e94
sub eax, 1
jne 0x100010d03
jmp 0x100017d58
cmp dword [rsp + 0x98], 9
jne 0x100010d7b
jmp 0x100018012
mov ecx, 0x6f8
jmp 0x1000181ec
cmp al, cl
je 0x100010c91
jmp 0x100010c9e
mov rcx, qword [0x1000844b8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100017d51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100084a88]
lea rdx, [0x10007a8b8]
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.10003b128
xor ecx, ecx
jmp 0x100010c9e
cmp qword [rdi + 0x48], rcx
jne 0x100017de2
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x1000844c4], esi
je 0x1000181f2
mov al, byte [0x1000844c8]
cmp al, 4
jae 0x100017d89
test al, al
jne 0x1000181f2
movabs rdx, 0x8000000000000001
test qword [0x1000844b0], rdx
je 0x1000181f2
mov rcx, qword [0x1000844b8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000181f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 9
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100084a88]
lea rdx, [0x10007a8c8]
mov dword [rsp + 0x20], eax
call fcn.10003b128
jmp 0x1000181f2
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
je 0x100017df5
mov ecx, 0x32
jmp 0x100017d65
mov r13, qword [rsp + 0xb0]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov dword [r13], 8
mov rdx, qword [rdi + 0x48]
call fcn.100043fa0
test eax, eax
je 0x100017e33
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x100017e33
movzx ebx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
add ebx, eax
add dword [r13], ebx
jmp 0x100017e3a
mov ebx, dword [rsp + 0x90]
cmp r15d, dword [r13]
jae 0x100017e50
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100010d69
mov r14d, 1
mov dword [rsp + 0x30], r14d
test rsi, rsi
je 0x100017e8b
lea r12, [rbp + 8]
mov rcx, rdi
mov qword [rbp], r12
call fcn.10003dc20
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x100010d69
xor r14d, r14d
mov dword [rsp + 0x30], r14d
jmp 0x100010d69
and qword [rbp], r12
jmp 0x100010d69
cmp qword [rdi + 0x48], rcx
jne 0x100017f01
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x1000844c4], esi
je 0x1000181f2
mov al, byte [0x1000844c8]
cmp al, 4
jae 0x100017ec3
test al, al
jne 0x1000181f2
movabs rdx, 0x8000000000000001
test qword [0x1000844b0], rdx
je 0x1000181f2
mov rcx, qword [0x1000844b8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000181f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 8
jmp 0x100017dc2
mov r13, qword [rsp + 0xb0]
mov rcx, rdi
mov dword [r13], 8
call fcn.10003dc20
mov qword [rsp + 0x48], rax
test rax, rax
je 0x100010d62
mov rsi, qword [rax + 0x38]
test rsi, rsi
je 0x100017f40
movzx ebx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
add ebx, eax
add dword [r13], ebx
jmp 0x100017f47
mov ebx, dword [rsp + 0x90]
cmp r15d, dword [r13]
jb 0x100017e40
mov r14d, 1
mov dword [rsp + 0x30], r14d
test rsi, rsi
je 0x100017e8b
lea r12, [rbp + 8]
mov qword [rbp], r12
jmp 0x100010d69
mov rcx, qword [rdi + 8]
lea rdx, str.win32spl.dll
mov rsi, r11
mov rcx, qword [rcx + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x100017fe0
mov dword [rsp + 0x34], 1
test rbp, rbp
je 0x100017fe0
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x30]
mov r9d, r15d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rdi + 0x10]
mov r8, rbp
mov edx, 4
call qword [rax + 0x58]
test eax, eax
je 0x100017fe0
test byte [rbp + 0x10], 0x40
je 0x100017fcb
test byte [rbp + 0x10], 0x10
jne 0x100017fe0
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.100043cc8
cmp qword [rsp + 0x38], r12
jne 0x100017ffc
movzx ecx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
lea edx, [rcx + rax + 3]
and edx, ebx
mov dword [rsp + 0x90], edx
and r15d, ebx
mov r13d, 3
mov dword [rsp + 0xa8], r15d
jmp 0x100010d03
test rsi, rsi
jne 0x100010d7b
test rbp, rbp
je 0x100010d7b
cmp qword [rbp], rsi
cmovne rsi, qword [rbp]
jmp 0x100010d7b
test rbp, rbp
je 0x100010d8a
test r14d, r14d
je 0x100010d8a
mov r13, qword [rsp + 0x38]
mov r14d, edx
test r13, r13
jne 0x10001807b
mov r13, qword [rbp + 0x38]
test r13, r13
je 0x10001806f
movzx ecx, word [r13 + 0x46]
movzx eax, word [r13 + 0x44]
lea r14d, [rcx + rax + 3]
and r14d, 0xfffffffc
jmp 0x100018072
xor r14d, r14d
test r13, r13
je 0x10001816c
mov r8, rsi
mov rdx, r13
mov rcx, rdi
call fcn.100043944
test eax, eax
jne 0x100018165
xor r12d, r12d
cmp dword [rsp + 0x34], r12d
jne 0x1000180b4
mov rax, qword [0x1000832b0]
cmp qword [rdi + 8], rax
jne 0x100018104
test byte [rbp + 0x68], 0x10
je 0x1000180b4
test byte [rbp + 0x68], 0x40
jne 0x100018104
mov r9d, r14d
mov r8, r13
mov rdx, rsi
mov rcx, rdi
call fcn.100043990
test eax, eax
je 0x100018104
cmp r13, qword [rsp + 0x38]
jne 0x1000180f1
mov ebx, dword [rsp + 0x90]
mov r12d, dword [rsp + 0xa8]
mov rsi, qword [rsp + 0x38]
sub r12, rbx
mov rax, rbx
add r12, rbp
mov qword [rbp + 0x38], r12
mov rdx, qword [rdi + 0x48]
mov r8, r13
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x100010d8a
mov rdx, qword [rdi + 0x48]
xor r8d, r8d
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
nop
jmp 0x100010d93
mov rcx, qword [0x100083210]
lea rax, [0x100083210]
cmp rcx, rax
je 0x100010dcc
test byte [rcx + 0x1c], 1
mov esi, dword [rsp + 0x98]
je 0x100010dd3
mov r9, qword [rdi + 0x48]
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x12]
lea r8, [0x10007d0d0]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], esi
call fcn.10003d7bc
jmp 0x100010dd3
mov edx, dword [rsp + 0x90]
mov r12d, dword [rsp + 0xa8]
mov eax, edx
mov ebx, edx
sub r12, rax
add r12, rbp
mov qword [rbp + 0x38], r12
jmp 0x100010d8a
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov ebx, 1
jmp 0x100010d97
test al, al
je 0x100010dea
jmp 0x100010e01
mov rcx, qword [0x1000844b8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100010e01
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100084a88]
lea rdx, [0x10007a8c8]
mov r9d, esi
mov dword [rsp + 0x20], r15d
call fcn.10003b128
nop
jmp 0x100010e01
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100010e05