Function at 0x100010cdc
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
xor ecx, ecx
mov r15d, r9d
mov rbp, r8
mov ebx, edx
mov rsi, rcx
mov r12, rcx
mov qword [rax - 0x48], rcx
mov qword [rax - 0x50], rcx
mov r14d, ecx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x48], rcx
mov dword [rax + 8], ecx
mov r13d, ecx
mov dword [rsp + 0x34], ecx
cmp rdi, rcx
je 0x1000179d2
cmp dword [rdi], 0x6060
jne 0x1000179d2
cmp r8, rcx
jne 0x100010d4d
cmp r9d, ecx
jne 0x1000174ef
movabs rdx, 0x8000000000000001
cmp dword [0x10008051c], ecx
je 0x100010d7a
mov al, byte [0x100080520]
cmp al, 4
jb 0x1000174f9
test qword [0x100080508], rdx
jne 0x100017506
mov eax, ebx
mov ebx, 0xfffffffc
sub eax, 2
jne 0x100011288
cmp qword [rdi + 0x48], rcx
je 0x100010ddf
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
jne 0x100010ddf
mov rcx, qword [rdi + 0x48]
lea rdx, str._DrvConvert
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x100010ddf
mov ecx, dword [0x10007f1f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 2
je 0x100010ddf
mov rdx, qword [rdi + 0x48]
lea r8, [rsp + 0x40]
xor ecx, ecx
call sym.spoolsv.exe_PrvbGetDevModePerUser
mov r11, qword [rsp + 0x40]
test r11, r11
jne 0x10001775d
mov rbx, qword [rsp + 0xb0]
mov edx, dword [rsp + 0x98]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov eax, r15d
mov r8, rbp
sub eax, dword [rsp + 0x90]
cmp r15d, dword [rsp + 0x90]
mov r15d, 0xfffffff8
cmovae r9d, eax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rbx
and r9d, r15d
call qword [rax + 0x58]
mov ecx, dword [rbx]
add ecx, 7
mov r14d, eax
mov dword [rsp + 0x30], eax
and ecx, r15d
add ecx, r13d
add ecx, dword [rsp + 0x90]
mov dword [rbx], ecx
mov ebx, dword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
cmp eax, 0x7a
jne 0x1000117de
mov edx, dword [rsp + 0x90]
test edx, edx
jne 0x10001781d
test r12, r12
jne 0x100017972
mov ebx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rsp + 0x48]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov rcx, qword [rsp + 0x38]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x100010ea8
cmp r15d, 0x7a
jne 0x100017903
mov esi, dword [rsp + 0x98]
cmp dword [0x10008051c], 0
je 0x100010edd
mov al, byte [0x100080520]
cmp al, 4
jb 0x10001798a
movabs rdx, 0x8000000000000001
test qword [0x100080508], rdx
jne 0x100017997
mov eax, ebx
jmp 0x100010ee1
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub eax, 6
je 0x10001767f
sub eax, 1
jne 0x100010ddf
jmp 0x100017543
cmp dword [rsp + 0x98], 9
jne 0x100010e57
jmp 0x1000177fd
mov ecx, 0x6f8
jmp 0x1000179d7
cmp al, cl
je 0x100010d6d
jmp 0x100010d7a
mov rcx, qword [0x100080510]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x10001753c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100080860]
lea rdx, [0x1000766f8]
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.1000380ec
xor ecx, ecx
jmp 0x100010d7a
cmp qword [rdi + 0x48], rcx
jne 0x1000175cd
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x10008051c], esi
je 0x1000179dd
mov al, byte [0x100080520]
cmp al, 4
jae 0x100017574
test al, al
jne 0x1000179dd
movabs rdx, 0x8000000000000001
test qword [0x100080508], rdx
je 0x1000179dd
mov rcx, qword [0x100080510]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000179dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 9
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100080860]
lea rdx, [0x100076708]
mov dword [rsp + 0x20], eax
call fcn.1000380ec
jmp 0x1000179dd
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
je 0x1000175e0
mov ecx, 0x32
jmp 0x100017550
mov r13, qword [rsp + 0xb0]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov dword [r13], 8
mov rdx, qword [rdi + 0x48]
call fcn.100040b50
test eax, eax
je 0x10001761e
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x10001761e
movzx ebx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
add ebx, eax
add dword [r13], ebx
jmp 0x100017625
mov ebx, dword [rsp + 0x90]
cmp r15d, dword [r13]
jae 0x10001763b
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100010e45
mov r14d, 1
mov dword [rsp + 0x30], r14d
test rsi, rsi
je 0x100017676
lea r12, [rbp + 8]
mov rcx, rdi
mov qword [rbp], r12
call fcn.10003ac04
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x100010e45
xor r14d, r14d
mov dword [rsp + 0x30], r14d
jmp 0x100010e45
and qword [rbp], r12
jmp 0x100010e45
cmp qword [rdi + 0x48], rcx
jne 0x1000176ec
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x10008051c], esi
je 0x1000179dd
mov al, byte [0x100080520]
cmp al, 4
jae 0x1000176ae
test al, al
jne 0x1000179dd
movabs rdx, 0x8000000000000001
test qword [0x100080508], rdx
je 0x1000179dd
mov rcx, qword [0x100080510]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x1000179dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 8
jmp 0x1000175ad
mov r13, qword [rsp + 0xb0]
mov rcx, rdi
mov dword [r13], 8
call fcn.10003ac04
mov qword [rsp + 0x48], rax
test rax, rax
je 0x100010e3e
mov rsi, qword [rax + 0x38]
test rsi, rsi
je 0x10001772b
movzx ebx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
add ebx, eax
add dword [r13], ebx
jmp 0x100017732
mov ebx, dword [rsp + 0x90]
cmp r15d, dword [r13]
jb 0x10001762b
mov r14d, 1
mov dword [rsp + 0x30], r14d
test rsi, rsi
je 0x100017676
lea r12, [rbp + 8]
mov qword [rbp], r12
jmp 0x100010e45
mov rcx, qword [rdi + 8]
lea rdx, str.win32spl.dll
mov rsi, r11
mov rcx, qword [rcx + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1000177cb
mov dword [rsp + 0x34], 1
test rbp, rbp
je 0x1000177cb
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x30]
mov r9d, r15d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rdi + 0x10]
mov r8, rbp
mov edx, 4
call qword [rax + 0x58]
test eax, eax
je 0x1000177cb
test byte [rbp + 0x10], 0x40
je 0x1000177b6
test byte [rbp + 0x10], 0x10
jne 0x1000177cb
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.100040878
cmp qword [rsp + 0x38], r12
jne 0x1000177e7
movzx ecx, word [rsi + 0x46]
movzx eax, word [rsi + 0x44]
lea edx, [rcx + rax + 3]
and edx, ebx
mov dword [rsp + 0x90], edx
and r15d, ebx
mov r13d, 3
mov dword [rsp + 0xa8], r15d
jmp 0x100010ddf
test rsi, rsi
jne 0x100010e57
test rbp, rbp
je 0x100010e57
cmp qword [rbp], rsi
cmovne rsi, qword [rbp]
jmp 0x100010e57
test rbp, rbp
je 0x100010e66
test r14d, r14d
je 0x100010e66
mov r13, qword [rsp + 0x38]
mov r14d, edx
test r13, r13
jne 0x100017866
mov r13, qword [rbp + 0x38]
test r13, r13
je 0x10001785a
movzx ecx, word [r13 + 0x46]
movzx eax, word [r13 + 0x44]
lea r14d, [rcx + rax + 3]
and r14d, 0xfffffffc
jmp 0x10001785d
xor r14d, r14d
test r13, r13
je 0x100017957
mov r8, rsi
mov rdx, r13
mov rcx, rdi
call fcn.1000404f8
test eax, eax
jne 0x100017950
xor r12d, r12d
cmp dword [rsp + 0x34], r12d
jne 0x10001789f
mov rax, qword [0x10007f2f0]
cmp qword [rdi + 8], rax
jne 0x1000178ef
test byte [rbp + 0x68], 0x10
je 0x10001789f
test byte [rbp + 0x68], 0x40
jne 0x1000178ef
mov r9d, r14d
mov r8, r13
mov rdx, rsi
mov rcx, rdi
call fcn.100040544
test eax, eax
je 0x1000178ef
cmp r13, qword [rsp + 0x38]
jne 0x1000178dc
mov ebx, dword [rsp + 0x90]
mov r12d, dword [rsp + 0xa8]
mov rsi, qword [rsp + 0x38]
sub r12, rbx
mov rax, rbx
add r12, rbp
mov qword [rbp + 0x38], r12
mov rdx, qword [rdi + 0x48]
mov r8, r13
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x100010e66
mov rdx, qword [rdi + 0x48]
xor r8d, r8d
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
nop
jmp 0x100010e6f
mov rcx, qword [0x10007f250]
lea rax, [0x10007f250]
cmp rcx, rax
je 0x100010ea8
test byte [rcx + 0x1c], 1
mov esi, dword [rsp + 0x98]
je 0x100010eaf
mov r9, qword [rdi + 0x48]
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xe]
lea r8, [0x100078b80]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], esi
call fcn.10003a790
jmp 0x100010eaf
mov edx, dword [rsp + 0x90]
mov r12d, dword [rsp + 0xa8]
mov eax, edx
mov ebx, edx
sub r12, rax
add r12, rbp
mov qword [rbp + 0x38], r12
jmp 0x100010e66
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov ebx, 1
jmp 0x100010e73
test al, al
je 0x100010ec6
jmp 0x100010edd
mov rcx, qword [0x100080510]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100010edd
mov r8, qword [rdi + 0x48]
mov rcx, qword [0x100080860]
lea rdx, [0x100076708]
mov r9d, esi
mov dword [rsp + 0x20], r15d
call fcn.1000380ec
nop
jmp 0x100010edd
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100010ee1