Function at 0x140056fc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
mov r13d, r9d
xor ecx, ecx
mov r14, r8
mov qword [rbp - 0x18], rcx
mov r15d, ecx
mov qword [rbp - 0x20], rcx
mov esi, ecx
mov dword [rbp + 0x40], ecx
mov r12d, ecx
mov qword [rbp - 0x10], rcx
mov dword [rbp - 0x30], ecx
mov dword [rbp - 0x28], ecx
mov dword [rbp - 0x2c], ecx
test rdi, rdi
je 0x14005758f
cmp dword [rdi], 0x6060
jne 0x14005758f
test r8, r8
jne 0x14005702f
test r9d, r9d
je 0x14005702f
mov ecx, 0x6f8
jmp 0x140057594
test byte [0x1400c9100], 2
je 0x140057061
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, dword [rbp + 0x48]
lea rdx, [0x1400b5798]
mov r8, qword [rdi + 0x48]
mov dword [rsp + 0x20], eax
call fcn.1400575c4
mov edx, dword [rbp + 0x48]
xor ecx, ecx
mov eax, edx
sub eax, 2
je 0x140057321
sub eax, 6
je 0x140057270
cmp eax, 1
jne 0x140057434
cmp qword [rdi + 0x48], rcx
jne 0x1400570b7
lea ecx, [rax + 5]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test byte [0x1400c9100], 2
je 0x1400575a0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 9
jmp 0x1400572a6
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
je 0x1400570c7
mov ecx, 0x32
jmp 0x140057087
mov rbx, qword [rbp + 0x60]
lea r8, [rbp - 0x18]
mov dword [rbx], 8
mov rdx, qword [rdi + 0x48]
call fcn.140079cb8
test eax, eax
je 0x1400570fb
mov r15, qword [rbp - 0x18]
test r15, r15
je 0x1400570fb
movzx r12d, word [r15 + 0x46]
movzx eax, word [r15 + 0x44]
add r12d, eax
add dword [rbx], r12d
cmp r13d, dword [rbx]
jae 0x140057239
mov ecx, 0x7a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov ebx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x28], eax
cmp eax, 0x7a
je 0x140057142
cmp dword [rbp + 0x48], 9
jne 0x140057142
test r15, r15
jne 0x140057142
test r14, r14
je 0x140057142
cmp qword [r14], r15
cmovne r15, qword [r14]
mov r10d, dword [rbp - 0x30]
test r10d, r10d
je 0x1400574ab
test r14, r14
je 0x1400574ab
test ebx, ebx
je 0x1400574ab
mov rbx, qword [rbp - 0x20]
lea r9, [r14 + 0x38]
mov r11d, r10d
test rbx, rbx
jne 0x14005719e
mov rbx, qword [r9]
test rbx, rbx
je 0x14005749c
mov rax, qword [rbp - 0x10]
movzx r10d, word [rbx + 0x44]
movzx ecx, word [rbx + 0x46]
add r10d, 3
add r10d, ecx
mov qword [rbp - 0x10], rax
mov eax, dword [rbp - 0x2c]
and r10d, 0xfffffffc
mov dword [rbp - 0x2c], eax
mov r8, r15
mov rdx, rbx
call fcn.140079b0c
test eax, eax
jne 0x14005749c
xor esi, esi
mov eax, 0x34534947
cmp dword [r15 + 0xcc], eax
jne 0x1400571cd
cmp dword [rbx + 0xcc], eax
jne 0x14005748c
cmp dword [rbp - 0x2c], esi
jne 0x1400571f2
mov rax, qword [0x1400c9068]
cmp qword [rdi + 8], rax
jne 0x14005748c
mov eax, dword [r14 + 0x68]
and eax, 0x50
cmp al, 0x50
je 0x14005748c
mov r9d, r10d
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140078f88
test eax, eax
je 0x14005748c
cmp rbx, qword [rbp - 0x20]
jne 0x140057226
mov r12d, dword [rbp - 0x30]
mov r15, qword [rbp - 0x20]
mov esi, r13d
sub rsi, r12
add rsi, r14
mov qword [r14 + 0x38], rsi
mov rdx, qword [rdi + 0x48]
mov r8, rbx
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x1400574ab
mov ebx, 1
mov dword [rbp + 0x40], ebx
test r15, r15
je 0x140057319
lea rsi, [r14 + 8]
mov rcx, rdi
mov qword [r14], rsi
call fcn.140056558
mov qword [rbp - 0x10], rax
test rax, rax
jne 0x140057117
xor ebx, ebx
mov dword [rbp + 0x40], ebx
jmp 0x140057117
cmp qword [rdi + 0x48], rcx
jne 0x1400572bf
mov ecx, 2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test byte [0x1400c9100], 2
je 0x1400575a0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 8
mov r8, qword [rdi + 0x48]
lea rdx, [0x1400b5648]
mov dword [rsp + 0x20], eax
call fcn.1400575c4
jmp 0x1400575a0
mov rbx, qword [rbp + 0x60]
mov rcx, rdi
mov dword [rbx], 8
call fcn.140056558
mov qword [rbp - 0x10], rax
test rax, rax
je 0x140057115
mov r15, qword [rax + 0x38]
test r15, r15
je 0x1400572f7
movzx r12d, word [r15 + 0x46]
movzx eax, word [r15 + 0x44]
add r12d, eax
add dword [rbx], r12d
cmp r13d, dword [rbx]
jb 0x140057104
mov ebx, 1
mov dword [rbp + 0x40], ebx
test r15, r15
je 0x140057319
lea rsi, [r14 + 8]
mov qword [r14], rsi
jmp 0x140057117
and qword [r14], rsi
jmp 0x140057117
cmp qword [rdi + 0x48], rcx
je 0x140057434
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
jne 0x140057431
mov rcx, qword [rdi + 0x48]
lea rdx, str._DrvConvert
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140057431
mov ecx, dword [0x1400c7ba0]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
cmp rax, 2
je 0x140057431
mov rdx, qword [rdi + 0x48]
lea r8, [rbp - 0x18]
xor ecx, ecx
call sym.spoolsv.exe_PrvbGetDevModePerUser
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x140057431
mov rcx, qword [rdi + 8]
lea rdx, str.win32spl.dll
mov r15, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14005740d
mov dword [rbp - 0x2c], 1
test r14, r14
je 0x14005740d
mov rax, qword [rdi + 8]
movabs r10, 0x869c8e0814507b70
mov rax, qword [rax + 0x58]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
mov rcx, qword [rdi + 0x10]
mov r8, r14
mov edx, 4
call qword [0x1400a8400]
test eax, eax
je 0x14005740d
mov eax, dword [r14 + 0x10]
and eax, 0x50
cmp al, 0x50
je 0x14005740d
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp - 0x20]
call fcn.1400790b0
cmp qword [rbp - 0x20], rsi
jne 0x140057426
movzx edx, word [rbx + 0x44]
movzx ecx, word [rbx + 0x46]
add edx, 3
add edx, ecx
and edx, 0xfffffffc
mov dword [rbp - 0x30], edx
mov dword [rbp - 0x28], 3
and r13d, 0xfffffffc
mov edx, dword [rbp + 0x48]
cmp r13d, dword [rbp - 0x30]
jb 0x140057443
mov r9d, r13d
sub r9d, dword [rbp - 0x30]
jmp 0x140057446
xor r9d, r9d
mov rax, qword [rdi + 8]
and r9d, 0xfffffff8
movabs r10, 0x869c8e0814507b70
mov rbx, qword [rbp + 0x60]
mov r8, r14
mov rcx, qword [rdi + 0x10]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x20], rbx
call qword [0x1400a8400]
mov ecx, dword [rbx]
add ecx, 7
mov dword [rbp + 0x40], eax
and ecx, 0xfffffff8
add ecx, dword [rbp - 0x28]
add ecx, dword [rbp - 0x30]
mov dword [rbx], ecx
mov ebx, eax
jmp 0x140057117
mov rdx, qword [rdi + 0x48]
xor r8d, r8d
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x1400574c5
mov esi, r13d
mov r12d, r11d
sub rsi, r11
add rsi, r14
mov qword [r9], rsi
test rsi, rsi
je 0x1400574c5
mov r8d, r12d
mov rdx, r15
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x40], 1
mov r8, qword [rbp - 0x18]
xor edx, edx
mov rcx, qword [0x1400c9078]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov r8, qword [rbp - 0x10]
xor edx, edx
mov rcx, qword [0x1400c9078]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov r8, qword [rbp - 0x20]
xor edx, edx
mov rcx, qword [0x1400c9078]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov ebx, dword [rbp - 0x28]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov r12d, dword [rbp + 0x40]
test r12d, r12d
jne 0x140057567
cmp ebx, 0x7a
je 0x140057567
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140057567
test byte [rcx + 0x44], 0x20
mov esi, dword [rbp + 0x48]
je 0x14005756a
mov r9, qword [rdi + 0x48]
lea edx, [r12 + 0x15]
mov rcx, qword [rcx + 0x38]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
call fcn.140057d20
jmp 0x14005756a
mov esi, dword [rbp + 0x48]
test byte [0x1400c9100], 2
je 0x14005758a
mov r8, qword [rdi + 0x48]
lea rdx, [0x1400b5648]
mov r9d, esi
mov dword [rsp + 0x20], ebx
call fcn.1400575c4
mov eax, r12d
jmp 0x1400575a2
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret