Function at 0x488200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x18], esi
push edi
test ebx, ebx
je 0x488976
test esi, esi
je 0x488976
xor edi, edi
cmp dword [ebx + 0x1b4], edi
jbe 0x4882a4
mov eax, dword [ebx + 0x98]
xor esi, esi
mov dword [esp + 0x18], eax
lea ebx, [ebx]
mov edx, dword [ebx + 0x1ac]
add edx, esi
cmp eax, 1
jne 0x488269
movzx eax, byte [edx + 0x13]
movzx ecx, byte [edx + 0x12]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 0x11]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 0x10]
jmp 0x488283
movzx eax, byte [edx + 0x10]
movzx ecx, byte [edx + 0x11]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 0x12]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 0x13]
shl eax, 8
add eax, ecx
cmp eax, dword [esp + 0x1c]
je 0x4882fd
mov eax, dword [ebx + 0x98]
inc edi
add esi, 0x28
cmp edi, dword [ebx + 0x1b4]
jb 0x488240
mov esi, dword [esp + 0x1c]
call fcn.00476ab0
mov ebx, dword [0x56161c]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x4882e0
push 0xc08
call fcn.004bb5d5
push 0xc08
mov edi, eax
push 0
push edi
call fcn.004c13c0
add esp, 0x10
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push str.ntfs_get_sds:_SII_entry_not_found___u_
mov dword [edi], 0x800000f
call fcn.004768f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x1ac]
lea ecx, [edi + edi*4]
lea esi, [eax + ecx*8]
test esi, esi
je 0x4882a0
mov edx, dword [ebx + 0x98]
cmp edx, 1
jne 0x488334
movzx ecx, byte [esi + 0x13]
movzx eax, byte [esi + 0x12]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x11]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x10]
jmp 0x48834e
movzx ecx, byte [esi + 0x10]
movzx eax, byte [esi + 0x11]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x12]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x13]
shl ecx, 8
add ecx, eax
cmp edx, 1
jne 0x488374
movzx edi, byte [esi + 0x17]
movzx eax, byte [esi + 0x16]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x15]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x14]
jmp 0x48838e
movzx edi, byte [esi + 0x14]
movzx eax, byte [esi + 0x15]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x16]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x17]
shl edi, 8
add edi, eax
cmp edx, 1
jne 0x48848d
movzx eax, byte [esi + 0x23]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x22]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x21]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x20]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1f]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1e]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1d]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1c]
jmp 0x488579
movzx eax, byte [esi + 0x1c]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1d]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1e]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1f]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x20]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x21]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x22]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x23]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
adc dword [esp + 0x10], edx
cmp dword [ebx + 0x98], 1
jne 0x4885ab
movzx edx, byte [esi + 0x27]
movzx eax, byte [esi + 0x26]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x25]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x24]
jmp 0x4885c5
movzx edx, byte [esi + 0x24]
movzx eax, byte [esi + 0x25]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x26]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x27]
mov esi, dword [esp + 0xc]
shl edx, 8
add edx, eax
cmp esi, dword [ebx + 0x1bc]
jbe 0x488634
call fcn.00476ab0
mov ebx, dword [0x56161c]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x488612
push 0xc08
call fcn.004bb5d5
push 0xc08
mov edi, eax
push 0
push edi
call fcn.004c13c0
add esp, 0x10
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [esp + 0x10]
push edx
push esi
push str.ntfs_get_sds:_SII_offset_too_large___llu_
mov dword [edi], 0x800000f
call fcn.004768f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jne 0x488692
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x488674
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push str.ntfs_get_sds:_SII_entry_size_is_invalid___u_
mov dword [esi], 0x800000f
call fcn.004768f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x1b8]
mov ebx, dword [esp + 0x18]
add edx, esi
mov dword [esp + 0x1c], edx
cmp ebx, 1
jne 0x4886c3
movzx esi, byte [edx + 7]
movzx eax, byte [edx + 6]
shl esi, 8
add esi, eax
movzx eax, byte [edx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [edx + 4]
jmp 0x4886dd
movzx esi, byte [edx + 4]
movzx eax, byte [edx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [edx + 6]
shl esi, 8
add esi, eax
movzx eax, byte [edx + 7]
shl esi, 8
add esi, eax
cmp ebx, 1
jne 0x488702
movzx ebx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ebx, 8
add ebx, eax
movzx eax, byte [edx + 1]
shl ebx, 8
add ebx, eax
movzx eax, byte [edx]
jmp 0x48871b
movzx ebx, byte [edx]
movzx eax, byte [edx + 1]
shl ebx, 8
add ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
add ebx, eax
movzx eax, byte [edx + 3]
shl ebx, 8
add ebx, eax
cmp dword [esp + 0x18], 1
jne 0x488818
movzx eax, byte [edx + 0xf]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
movzx eax, byte [eax + 0xe]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xd]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xc]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xb]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xa]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 9]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 8]
jmp 0x488900
movzx eax, byte [edx + 8]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
movzx eax, byte [eax + 9]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xa]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xb]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xc]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xd]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xe]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xf]
cdq
add dword [esp + 0x14], eax
adc dword [esp + 0x18], edx
cmp esi, ecx
jne 0x488930
cmp ebx, edi
jne 0x488930
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0xc]
jne 0x488930
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x18], edx
jne 0x488930
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x561618], 0
je 0x488951
push ecx
push esi
push str.ntfs_get_sds:_entry_found_was_for_wrong_Security_ID___u_vs__u__n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.00479b20
add esp, 0x10
call fcn.00476ab0
mov ecx, 0x800000f
call fcn.00476850
push str.ntfs_get_sds:_Got_to_end_w_out_data
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4889b2
push 0xc08
call fcn.004bb5d5
push 0xc08
mov esi, eax
push 0
push esi
call fcn.004c13c0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Invalid_argument
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret