Function at 0x140002460
Capabilities:
Get thread local storage value
Set thread local storage value
Unload minifilter driver

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x80
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
call fcn.140002090
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rbp, [0x140024670]
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x1400024bc
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x1400024bc
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400024c7
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, rbp
xor esi, esi
mov qword [rsp + 0x48], rsi
lea r12, str.DlFsFlt
mov qword [rsp + 0x40], r12
lea rax, [0x14001bb20]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 5
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x40
mov r9d, 0x81
lea r8, str.......CommonFilterHelpers.cpp
lea rdx, str.FilterDetachAndUnload
mov rcx, rdi
call fcn.140007080
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x140002542
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x140002542
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000254d
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], 0xff
mov ecx, dword [0x14002346c]
cmp ecx, 0xffffffff
je 0x1400025bd
cmp dword [0x140023470], 0xffffffff
je 0x1400025bd
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x140023470]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x60], rax
lea rdx, str.FilterDetachAndUnload
mov ecx, dword [0x14002346c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x58]
mov ecx, dword [0x140023470]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x1400025cb
mov rcx, rdi
call fcn.140005d90
nop
mov rcx, r12
call qword [sym.imp.FLTLIB.DLL_FilterUnload]
mov edi, eax
mov dword [rsp + 0x70], 0xff
mov rcx, qword [rsp + 0x68]
cmp eax, 0x801f0013
jne 0x14000267b
test rcx, rcx
jne 0x14000262c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x140002621
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x140002621
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
jmp 0x14000262c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
lea rax, str.Filter_wasnt_loaded
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x53
mov r9d, 0x85
lea r8, str.......CommonFilterHelpers.cpp
lea rdx, str.FilterDetachAndUnload
call fcn.140006dd0
nop
lea rcx, [rsp + 0x58]
call fcn.1400044b0
mov al, 1
jmp 0x14000289c
cmp eax, 0x801f0010
jne 0x1400026ff
test rcx, rcx
jne 0x1400026c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x1400026b5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x1400026b5
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
jmp 0x1400026c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
lea rax, str.Do_not_detach_the_filter_from_the_volume_at_this_time.
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x53
mov r9d, MsiSetPropertyW
lea r8, str.......CommonFilterHelpers.cpp
lea rdx, str.FilterDetachAndUnload
call fcn.140006dd0
nop
jmp 0x140002890
cmp eax, 0x80070522
jne 0x140002783
test rcx, rcx
jne 0x140002744
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x140002739
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x140002739
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
jmp 0x140002744
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
lea rax, str.A_required_privilege_is_not_held_by_the_client.
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x53
mov r9d, 0x8f
lea r8, str.......CommonFilterHelpers.cpp
lea rdx, str.FilterDetachAndUnload
call fcn.140006dd0
nop
jmp 0x140002890
test eax, eax
js 0x140002818
test rcx, rcx
jne 0x1400027c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x1400027be
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
je 0x1400027be
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
jmp 0x1400027c9
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
lea rax, [0x14001b9c8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x53
mov r9d, 0x94
lea r8, str.......CommonFilterHelpers.cpp
lea rdx, str.FilterDetachAndUnload
call fcn.140006c50
nop
lea rcx, [rsp + 0x58]
call fcn.1400044b0
mov al, 1
jmp 0x14000289c
test rcx, rcx
jne 0x140002856
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140023468]
cmp ecx, 0xffffffff
je 0x14000284b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14000284b
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
jmp 0x140002856
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
lea rax, str.Failed_to_Unload_Filter
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x51
mov r9d, 0x98
lea r8, str.......CommonFilterHelpers.cpp
lea rdx, str.FilterDetachAndUnload
call fcn.140006dd0
nop
lea rcx, [rsp + 0x58]
call fcn.1400044b0
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret