Function at 0x140057640
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
mov r13d, r9d
xor ecx, ecx
mov r14, r8
mov qword [rbp - 0x18], rcx
mov r15d, ecx
mov qword [rbp - 0x20], rcx
mov esi, ecx
mov dword [rbp + 0x40], ecx
mov r12d, ecx
mov qword [rbp - 0x10], rcx
mov dword [rbp - 0x30], ecx
mov dword [rbp - 0x28], ecx
mov dword [rbp - 0x2c], ecx
test rdi, rdi
je 0x140057c0f
cmp dword [rdi], 0x6060
jne 0x140057c0f
test r8, r8
jne 0x1400576af
test r9d, r9d
je 0x1400576af
mov ecx, 0x6f8
jmp 0x140057c14
test byte [0x1400c9180], 2
je 0x1400576e1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, dword [rbp + 0x48]
lea rdx, [0x1400b5908]
mov r8, qword [rdi + 0x48]
mov dword [rsp + 0x20], eax
call fcn.140057c44
mov edx, dword [rbp + 0x48]
xor ecx, ecx
mov eax, edx
sub eax, 2
je 0x1400579a1
sub eax, 6
je 0x1400578f0
cmp eax, 1
jne 0x140057ab4
cmp qword [rdi + 0x48], rcx
jne 0x140057737
lea ecx, [rax + 5]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test byte [0x1400c9180], 2
je 0x140057c20
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 9
jmp 0x140057926
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
je 0x140057747
mov ecx, 0x32
jmp 0x140057707
mov rbx, qword [rbp + 0x60]
lea r8, [rbp - 0x18]
mov dword [rbx], 8
mov rdx, qword [rdi + 0x48]
call fcn.14007a2d4
test eax, eax
je 0x14005777b
mov r15, qword [rbp - 0x18]
test r15, r15
je 0x14005777b
movzx r12d, word [r15 + 0x46]
movzx eax, word [r15 + 0x44]
add r12d, eax
add dword [rbx], r12d
cmp r13d, dword [rbx]
jae 0x1400578b9
mov ecx, 0x7a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov ebx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x28], eax
cmp eax, 0x7a
je 0x1400577c2
cmp dword [rbp + 0x48], 9
jne 0x1400577c2
test r15, r15
jne 0x1400577c2
test r14, r14
je 0x1400577c2
cmp qword [r14], r15
cmovne r15, qword [r14]
mov r10d, dword [rbp - 0x30]
test r10d, r10d
je 0x140057b2b
test r14, r14
je 0x140057b2b
test ebx, ebx
je 0x140057b2b
mov rbx, qword [rbp - 0x20]
lea r9, [r14 + 0x38]
mov r11d, r10d
test rbx, rbx
jne 0x14005781e
mov rbx, qword [r9]
test rbx, rbx
je 0x140057b1c
mov rax, qword [rbp - 0x10]
movzx r10d, word [rbx + 0x44]
movzx ecx, word [rbx + 0x46]
add r10d, 3
add r10d, ecx
mov qword [rbp - 0x10], rax
mov eax, dword [rbp - 0x2c]
and r10d, 0xfffffffc
mov dword [rbp - 0x2c], eax
mov r8, r15
mov rdx, rbx
call fcn.14007a128
test eax, eax
jne 0x140057b1c
xor esi, esi
mov eax, 0x34534947
cmp dword [r15 + 0xcc], eax
jne 0x14005784d
cmp dword [rbx + 0xcc], eax
jne 0x140057b0c
cmp dword [rbp - 0x2c], esi
jne 0x140057872
mov rax, qword [0x1400c9120]
cmp qword [rdi + 8], rax
jne 0x140057b0c
mov eax, dword [r14 + 0x68]
and eax, 0x50
cmp al, 0x50
je 0x140057b0c
mov r9d, r10d
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140079678
test eax, eax
je 0x140057b0c
cmp rbx, qword [rbp - 0x20]
jne 0x1400578a6
mov r12d, dword [rbp - 0x30]
mov r15, qword [rbp - 0x20]
mov esi, r13d
sub rsi, r12
add rsi, r14
mov qword [r14 + 0x38], rsi
mov rdx, qword [rdi + 0x48]
mov r8, rbx
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x140057b2b
mov ebx, 1
mov dword [rbp + 0x40], ebx
test r15, r15
je 0x140057999
lea rsi, [r14 + 8]
mov rcx, rdi
mov qword [r14], rsi
call fcn.140056bd8
mov qword [rbp - 0x10], rax
test rax, rax
jne 0x140057797
xor ebx, ebx
mov dword [rbp + 0x40], ebx
jmp 0x140057797
cmp qword [rdi + 0x48], rcx
jne 0x14005793f
mov ecx, 2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test byte [0x1400c9180], 2
je 0x140057c20
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 8
mov r8, qword [rdi + 0x48]
lea rdx, [0x1400b57b8]
mov dword [rsp + 0x20], eax
call fcn.140057c44
jmp 0x140057c20
mov rbx, qword [rbp + 0x60]
mov rcx, rdi
mov dword [rbx], 8
call fcn.140056bd8
mov qword [rbp - 0x10], rax
test rax, rax
je 0x140057795
mov r15, qword [rax + 0x38]
test r15, r15
je 0x140057977
movzx r12d, word [r15 + 0x46]
movzx eax, word [r15 + 0x44]
add r12d, eax
add dword [rbx], r12d
cmp r13d, dword [rbx]
jb 0x140057784
mov ebx, 1
mov dword [rbp + 0x40], ebx
test r15, r15
je 0x140057999
lea rsi, [r14 + 8]
mov qword [r14], rsi
jmp 0x140057797
and qword [r14], rsi
jmp 0x140057797
cmp qword [rdi + 0x48], rcx
je 0x140057ab4
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
jne 0x140057ab1
mov rcx, qword [rdi + 0x48]
lea rdx, str._DrvConvert
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140057ab1
mov ecx, dword [0x1400c7bb0]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
cmp rax, 2
je 0x140057ab1
mov rdx, qword [rdi + 0x48]
lea r8, [rbp - 0x18]
xor ecx, ecx
call sym.spoolsv.exe_PrvbGetDevModePerUser
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x140057ab1
mov rcx, qword [rdi + 8]
lea rdx, str.win32spl.dll
mov r15, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140057a8d
mov dword [rbp - 0x2c], 1
test r14, r14
je 0x140057a8d
mov rax, qword [rdi + 8]
movabs r10, 0x869c8e0814507b70
mov rax, qword [rax + 0x58]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
mov rcx, qword [rdi + 0x10]
mov r8, r14
mov edx, 4
call qword [0x1400a83f0]
test eax, eax
je 0x140057a8d
mov eax, dword [r14 + 0x10]
and eax, 0x50
cmp al, 0x50
je 0x140057a8d
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp - 0x20]
call fcn.1400797a0
cmp qword [rbp - 0x20], rsi
jne 0x140057aa6
movzx edx, word [rbx + 0x44]
movzx ecx, word [rbx + 0x46]
add edx, 3
add edx, ecx
and edx, 0xfffffffc
mov dword [rbp - 0x30], edx
mov dword [rbp - 0x28], 3
and r13d, 0xfffffffc
mov edx, dword [rbp + 0x48]
cmp r13d, dword [rbp - 0x30]
jb 0x140057ac3
mov r9d, r13d
sub r9d, dword [rbp - 0x30]
jmp 0x140057ac6
xor r9d, r9d
mov rax, qword [rdi + 8]
and r9d, 0xfffffff8
movabs r10, 0x869c8e0814507b70
mov rbx, qword [rbp + 0x60]
mov r8, r14
mov rcx, qword [rdi + 0x10]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x20], rbx
call qword [0x1400a83f0]
mov ecx, dword [rbx]
add ecx, 7
mov dword [rbp + 0x40], eax
and ecx, 0xfffffff8
add ecx, dword [rbp - 0x28]
add ecx, dword [rbp - 0x30]
mov dword [rbx], ecx
mov ebx, eax
jmp 0x140057797
mov rdx, qword [rdi + 0x48]
xor r8d, r8d
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x140057b45
mov esi, r13d
mov r12d, r11d
sub rsi, r11
add rsi, r14
mov qword [r9], rsi
test rsi, rsi
je 0x140057b45
mov r8d, r12d
mov rdx, r15
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x40], 1
mov r8, qword [rbp - 0x18]
xor edx, edx
mov rcx, qword [0x1400c9130]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov r8, qword [rbp - 0x10]
xor edx, edx
mov rcx, qword [0x1400c9130]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov r8, qword [rbp - 0x20]
xor edx, edx
mov rcx, qword [0x1400c9130]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov ebx, dword [rbp - 0x28]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov r12d, dword [rbp + 0x40]
test r12d, r12d
jne 0x140057be7
cmp ebx, 0x7a
je 0x140057be7
mov rcx, qword [0x1400c72a8]
lea rax, [0x1400c72a8]
cmp rcx, rax
je 0x140057be7
test byte [rcx + 0x44], 0x20
mov esi, dword [rbp + 0x48]
je 0x140057bea
mov r9, qword [rdi + 0x48]
lea edx, [r12 + 0x15]
mov rcx, qword [rcx + 0x38]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
call fcn.1400583a0
jmp 0x140057bea
mov esi, dword [rbp + 0x48]
test byte [0x1400c9180], 2
je 0x140057c0a
mov r8, qword [rdi + 0x48]
lea rdx, [0x1400b57b8]
mov r9d, esi
mov dword [rsp + 0x20], ebx
call fcn.140057c44
mov eax, r12d
jmp 0x140057c22
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret