Function at 0x100010e90
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
xor ecx, ecx
mov r15d, r9d
mov rbp, r8
mov ebx, edx
mov rsi, rcx
mov r12, rcx
mov qword [rax - 0x48], rcx
mov qword [rax - 0x50], rcx
mov r14d, ecx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x48], rcx
mov dword [rax + 8], ecx
mov r13d, ecx
mov dword [rsp + 0x34], ecx
cmp rdi, rcx
je 0x100017fa1
cmp dword [rdi], 0x6060
jne 0x100017fa1
cmp r8, rcx
jne 0x100010f01
cmp r9d, ecx
jne 0x100017abe
movabs rdx, 0x8000000000000001
cmp dword [0x100081514], ecx
je 0x100010f2e
mov al, byte [0x100081518]
cmp al, 4
jb 0x100017ac8
test qword [0x100081500], rdx
jne 0x100017ad5
mov eax, ebx
mov ebx, 0xfffffffc
sub eax, 2
jne 0x100011438
cmp qword [rdi + 0x48], rcx
je 0x100010f93
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
jne 0x100010f93
mov rcx, qword [rdi + 0x48]
lea rdx, str._DrvConvert
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x100010f93
mov ecx, dword [0x1000801f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 2
je 0x100010f93
mov rdx, qword [rdi + 0x48]
lea r8, [rsp + 0x40]
xor ecx, ecx
call sym.spoolsv.exe_PrvbGetDevModePerUser
mov r11, qword [rsp + 0x40]
test r11, r11
jne 0x100017d2c
mov rbx, qword [rsp + 0xb0]
mov edx, dword [rsp + 0x98]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov eax, r15d
mov r8, rbp
sub eax, dword [rsp + 0x90]
cmp r15d, dword [rsp + 0x90]
mov r15d, 0xfffffff8
cmovae r9d, eax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rbx
and r9d, r15d
call qword [rax + 0x58]
mov ecx, dword [rbx]
add ecx, 7
mov r14d, eax
mov dword [rsp + 0x30], eax
and ecx, r15d
add ecx, r13d
add ecx, dword [rsp + 0x90]
mov dword [rbx], ecx
mov ebx, dword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
cmp eax, 0x7a
jne 0x100013367
mov edx, dword [rsp + 0x90]
test edx, edx
jne 0x100017dec
test r12, r12
jne 0x100017f41
mov ebx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rsp + 0x48]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rsp + 0x38]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x10001105c
cmp r15d, 0x7a
jne 0x100017ed2
mov esi, dword [rsp + 0x98]
cmp dword [0x100081514], 0
je 0x100011091
mov al, byte [0x100081518]
cmp al, 4
jb 0x100017f59
movabs rdx, 0x8000000000000001
test qword [0x100081500], rdx
jne 0x100017f66
mov eax, ebx
jmp 0x100011095
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub eax, 6
je 0x100017c4e
sub eax, 1
jne 0x100010f93
jmp 0x100017b12
cmp dword [rsp + 0x98], 9
jne 0x10001100b
jmp 0x100017dcc
mov ecx, 0x6f8
jmp 0x100017fa6
cmp al, cl
je 0x100010f21
jmp 0x100010f2e
mov rcx, qword [0x100081508]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100017b0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100081ad8]
lea rdx, [0x1000776d8]
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.100038888
xor ecx, ecx
jmp 0x100010f2e
cmp qword [rdi + 0x48], rcx
jne 0x100017b9c
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x100081514], esi
je 0x100017fac
mov al, byte [0x100081518]
cmp al, 4
jae 0x100017b43
test al, al
jne 0x100017fac
movabs rdx, 0x8000000000000001
test qword [0x100081500], rdx
je 0x100017fac
mov rcx, qword [0x100081508]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100017fac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 9
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100081ad8]
lea rdx, [0x1000776e8]
mov dword [rsp + 0x20], eax
call fcn.100038888
jmp 0x100017fac
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
je 0x100017baf
mov ecx, 0x32
jmp 0x100017b1f
mov r13, qword [rsp + 0xb0]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov dword [r13], 8
mov rdx, qword [rdi + 0x48]
call fcn.100041614
test eax, eax
je 0x100017bed
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x100017bed
movzx ebx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
add ebx, eax
add dword [r13], ebx
jmp 0x100017bf4
mov ebx, dword [rsp + 0x90]
cmp r15d, dword [r13]
jae 0x100017c0a
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100010ff9
mov r14d, 1
mov dword [rsp + 0x30], r14d
test rsi, rsi
je 0x100017c45
lea r12, [rbp + 8]
mov rcx, rdi
mov qword [rbp], r12
call fcn.10003b394
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x100010ff9
xor r14d, r14d
mov dword [rsp + 0x30], r14d
jmp 0x100010ff9
and qword [rbp], r12
jmp 0x100010ff9
cmp qword [rdi + 0x48], rcx
jne 0x100017cbb
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x100081514], esi
je 0x100017fac
mov al, byte [0x100081518]
cmp al, 4
jae 0x100017c7d
test al, al
jne 0x100017fac
movabs rdx, 0x8000000000000001
test qword [0x100081500], rdx
je 0x100017fac
mov rcx, qword [0x100081508]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100017fac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 8
jmp 0x100017b7c
mov r13, qword [rsp + 0xb0]
mov rcx, rdi
mov dword [r13], 8
call fcn.10003b394
mov qword [rsp + 0x48], rax
test rax, rax
je 0x100010ff2
mov rsi, qword [rax + 0x38]
test rsi, rsi
je 0x100017cfa
movzx ebx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
add ebx, eax
add dword [r13], ebx
jmp 0x100017d01
mov ebx, dword [rsp + 0x90]
cmp r15d, dword [r13]
jb 0x100017bfa
mov r14d, 1
mov dword [rsp + 0x30], r14d
test rsi, rsi
je 0x100017c45
lea r12, [rbp + 8]
mov qword [rbp], r12
jmp 0x100010ff9
mov rcx, qword [rdi + 8]
lea rdx, str.win32spl.dll
mov rsi, r11
mov rcx, qword [rcx + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x100017d9a
mov dword [rsp + 0x34], 1
test rbp, rbp
je 0x100017d9a
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x30]
mov r9d, r15d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rdi + 0x10]
mov r8, rbp
mov edx, 4
call qword [rax + 0x58]
test eax, eax
je 0x100017d9a
test byte [rbp + 0x10], 0x40
je 0x100017d85
test byte [rbp + 0x10], 0x10
jne 0x100017d9a
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.100041344
cmp qword [rsp + 0x38], r12
jne 0x100017db6
movzx ecx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
lea edx, [rcx + rax + 3]
and edx, ebx
mov dword [rsp + 0x90], edx
and r15d, ebx
mov r13d, 3
mov dword [rsp + 0xa8], r15d
jmp 0x100010f93
test rsi, rsi
jne 0x10001100b
test rbp, rbp
je 0x10001100b
cmp qword [rbp], rsi
cmovne rsi, qword [rbp]
jmp 0x10001100b
test rbp, rbp
je 0x10001101a
test r14d, r14d
je 0x10001101a
mov r13, qword [rsp + 0x38]
mov r14d, edx
test r13, r13
jne 0x100017e35
mov r13, qword [rbp + 0x38]
test r13, r13
je 0x100017e29
movzx ecx, word [r13 + 0x46]
movzx eax, word [r13 + 0x44]
lea r14d, [rcx + rax + 3]
and r14d, 0xfffffffc
jmp 0x100017e2c
xor r14d, r14d
test r13, r13
je 0x100017f26
mov r8, rsi
mov rdx, r13
mov rcx, rdi
call fcn.100040fc8
test eax, eax
jne 0x100017f1f
xor r12d, r12d
cmp dword [rsp + 0x34], r12d
jne 0x100017e6e
mov rax, qword [0x1000802f0]
cmp qword [rdi + 8], rax
jne 0x100017ebe
test byte [rbp + 0x68], 0x10
je 0x100017e6e
test byte [rbp + 0x68], 0x40
jne 0x100017ebe
mov r9d, r14d
mov r8, r13
mov rdx, rsi
mov rcx, rdi
call fcn.100041014
test eax, eax
je 0x100017ebe
cmp r13, qword [rsp + 0x38]
jne 0x100017eab
mov ebx, dword [rsp + 0x90]
mov r12d, dword [rsp + 0xa8]
mov rsi, qword [rsp + 0x38]
sub r12, rbx
mov rax, rbx
add r12, rbp
mov qword [rbp + 0x38], r12
mov rdx, qword [rdi + 0x48]
mov r8, r13
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x10001101a
mov rdx, qword [rdi + 0x48]
xor r8d, r8d
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
nop
jmp 0x100011023
mov rcx, qword [0x100080250]
lea rax, [0x100080250]
cmp rcx, rax
je 0x10001105c
test byte [rcx + 0x1c], 1
mov esi, dword [rsp + 0x98]
je 0x100011063
mov r9, qword [rdi + 0x48]
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xe]
lea r8, [0x100079b60]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], esi
call fcn.10003af20
jmp 0x100011063
mov edx, dword [rsp + 0x90]
mov r12d, dword [rsp + 0xa8]
mov eax, edx
mov ebx, edx
sub r12, rax
add r12, rbp
mov qword [rbp + 0x38], r12
jmp 0x10001101a
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov ebx, 1
jmp 0x100011027
test al, al
je 0x10001107a
jmp 0x100011091
mov rcx, qword [0x100081508]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100011091
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100081ad8]
lea rdx, [0x1000776e8]
mov r9d, esi
mov dword [rsp + 0x20], r15d
call fcn.100038888
nop
jmp 0x100011091
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100011095