Function at 0x114120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x18], esi
push edi
test ebx, ebx
je 0x1148a1
test esi, esi
je 0x1148a1
xor edi, edi
cmp dword [ebx + 0x1b4], edi
jbe 0x1141c4
mov eax, dword [ebx + 0x98]
xor esi, esi
mov dword [esp + 0x18], eax
nop word [eax + eax]
mov edx, dword [ebx + 0x1ac]
add edx, esi
cmp eax, 1
jne 0x114189
movzx eax, byte [edx + 0x13]
movzx ecx, byte [edx + 0x12]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 0x11]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 0x10]
jmp 0x1141a3
movzx eax, byte [edx + 0x10]
movzx ecx, byte [edx + 0x11]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 0x12]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 0x13]
shl eax, 8
add eax, ecx
cmp eax, dword [esp + 0x1c]
je 0x114220
mov eax, dword [ebx + 0x98]
inc edi
add esi, 0x28
cmp edi, dword [ebx + 0x1b4]
jb 0x114160
mov esi, dword [esp + 0x1c]
call fcn.000ee7f0
mov ebx, dword [0x1aa224]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x114203
push 0xc08
call fcn.0015c8ae
add esp, 4
mov edi, eax
push 0xc08
push 0
push edi
call fcn.00153d90
add esp, 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push str.ntfs_get_sds:_SII_entry_not_found___u_
mov dword [edi], 0x800000f
call fcn.000ee5f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x1ac]
lea ecx, [edi + edi*4]
lea esi, [eax + ecx*8]
test esi, esi
je 0x1141c0
mov edx, dword [ebx + 0x98]
cmp edx, 1
jne 0x114257
movzx ecx, byte [esi + 0x13]
movzx eax, byte [esi + 0x12]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x11]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x10]
jmp 0x114271
movzx ecx, byte [esi + 0x10]
movzx eax, byte [esi + 0x11]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x12]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 0x13]
shl ecx, 8
add ecx, eax
cmp edx, 1
jne 0x114297
movzx edi, byte [esi + 0x17]
movzx eax, byte [esi + 0x16]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x15]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x14]
jmp 0x1142b1
movzx edi, byte [esi + 0x14]
movzx eax, byte [esi + 0x15]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x16]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x17]
shl edi, 8
add edi, eax
cmp edx, 1
jne 0x1143b0
movzx eax, byte [esi + 0x23]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x22]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x21]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x20]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1f]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1e]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1d]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1c]
jmp 0x11449c
movzx eax, byte [esi + 0x1c]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1d]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1e]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x1f]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x20]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x21]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x22]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
adc dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0xc], eax
movzx eax, byte [esi + 0x23]
mov dword [esp + 0x10], edx
cdq
add dword [esp + 0xc], eax
adc dword [esp + 0x10], edx
cmp dword [ebx + 0x98], 1
jne 0x1144ce
movzx edx, byte [esi + 0x27]
movzx eax, byte [esi + 0x26]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x25]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x24]
jmp 0x1144e8
movzx edx, byte [esi + 0x24]
movzx eax, byte [esi + 0x25]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x26]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 0x27]
mov esi, dword [esp + 0xc]
shl edx, 8
add edx, eax
cmp esi, dword [ebx + 0x1bc]
jbe 0x11455a
call fcn.000ee7f0
mov ebx, dword [0x1aa224]
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x114538
push 0xc08
call fcn.0015c8ae
add esp, 4
mov edi, eax
push 0xc08
push 0
push edi
call fcn.00153d90
add esp, 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [esp + 0x10]
push edx
push esi
push str.ntfs_get_sds:_SII_offset_too_large___llu_
mov dword [edi], 0x800000f
call fcn.000ee5f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jne 0x1145bb
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x11459d
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push str.ntfs_get_sds:_SII_entry_size_is_invalid___u_
mov dword [esi], 0x800000f
call fcn.000ee5f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x1b8]
mov ebx, dword [esp + 0x18]
add edx, esi
mov dword [esp + 0x1c], edx
cmp ebx, 1
jne 0x1145ec
movzx esi, byte [edx + 7]
movzx eax, byte [edx + 6]
shl esi, 8
add esi, eax
movzx eax, byte [edx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [edx + 4]
jmp 0x114606
movzx esi, byte [edx + 4]
movzx eax, byte [edx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [edx + 6]
shl esi, 8
add esi, eax
movzx eax, byte [edx + 7]
shl esi, 8
add esi, eax
cmp ebx, 1
jne 0x11462b
movzx ebx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ebx, 8
add ebx, eax
movzx eax, byte [edx + 1]
shl ebx, 8
add ebx, eax
movzx eax, byte [edx]
jmp 0x114644
movzx ebx, byte [edx]
movzx eax, byte [edx + 1]
shl ebx, 8
add ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
add ebx, eax
movzx eax, byte [edx + 3]
shl ebx, 8
add ebx, eax
cmp dword [esp + 0x18], 1
jne 0x114741
movzx eax, byte [edx + 0xf]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
movzx eax, byte [eax + 0xe]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xd]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xc]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xb]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xa]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 9]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 8]
jmp 0x114829
movzx eax, byte [edx + 8]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
movzx eax, byte [eax + 9]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xa]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xb]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xc]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xd]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xe]
cdq
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
adc dword [esp + 0x18], edx
shld dword [esp + 0x18], eax, 8
shl eax, 8
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0xf]
cdq
add dword [esp + 0x14], eax
adc dword [esp + 0x18], edx
cmp esi, ecx
jne 0x114859
cmp ebx, edi
jne 0x114859
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0xc]
jne 0x114859
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x18], edx
jne 0x114859
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x1aa220], 0
je 0x11487c
push ecx
push esi
push str.ntfs_get_sds:_entry_found_was_for_wrong_Security_ID___u_vs__u__n
push 2
call fcn.00158e14
add esp, 4
push eax
call fcn.000f0dc0
add esp, 0x10
call fcn.000ee7f0
mov ecx, 0x800000f
call fcn.000ee550
push str.ntfs_get_sds:_Got_to_end_w_out_data
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.000ee7f0
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1148e0
push 0xc08
call fcn.0015c8ae
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.00153d90
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Invalid_argument
mov dword [esi], 0x8000006
call fcn.000ee5f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret