Function at 0x140058200
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
mov r13d, r9d
xor ecx, ecx
mov r14, r8
mov qword [rbp - 0x18], rcx
mov r15d, ecx
mov qword [rbp - 0x20], rcx
mov esi, ecx
mov dword [rbp + 0x40], ecx
mov r12d, ecx
mov qword [rbp - 0x10], rcx
mov dword [rbp - 0x30], ecx
mov dword [rbp - 0x28], ecx
mov dword [rbp - 0x2c], ecx
test rdi, rdi
je 0x1400587cf
cmp dword [rdi], 0x6060
jne 0x1400587cf
test r8, r8
jne 0x14005826f
test r9d, r9d
je 0x14005826f
mov ecx, 0x6f8
jmp 0x1400587d4
test byte [0x1400ca180], 2
je 0x1400582a1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, dword [rbp + 0x48]
lea rdx, [0x1400b6908]
mov r8, qword [rdi + 0x48]
mov dword [rsp + 0x20], eax
call fcn.140058804
mov edx, dword [rbp + 0x48]
xor ecx, ecx
mov eax, edx
sub eax, 2
je 0x140058561
sub eax, 6
je 0x1400584b0
cmp eax, 1
jne 0x140058674
cmp qword [rdi + 0x48], rcx
jne 0x1400582f7
lea ecx, [rax + 5]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test byte [0x1400ca180], 2
je 0x1400587e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 9
jmp 0x1400584e6
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
je 0x140058307
mov ecx, 0x32
jmp 0x1400582c7
mov rbx, qword [rbp + 0x60]
lea r8, [rbp - 0x18]
mov dword [rbx], 8
mov rdx, qword [rdi + 0x48]
call fcn.14007af18
test eax, eax
je 0x14005833b
mov r15, qword [rbp - 0x18]
test r15, r15
je 0x14005833b
movzx r12d, word [r15 + 0x46]
movzx eax, word [r15 + 0x44]
add r12d, eax
add dword [rbx], r12d
cmp r13d, dword [rbx]
jae 0x140058479
mov ecx, 0x7a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov ebx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x28], eax
cmp eax, 0x7a
je 0x140058382
cmp dword [rbp + 0x48], 9
jne 0x140058382
test r15, r15
jne 0x140058382
test r14, r14
je 0x140058382
cmp qword [r14], r15
cmovne r15, qword [r14]
mov r10d, dword [rbp - 0x30]
test r10d, r10d
je 0x1400586eb
test r14, r14
je 0x1400586eb
test ebx, ebx
je 0x1400586eb
mov rbx, qword [rbp - 0x20]
lea r9, [r14 + 0x38]
mov r11d, r10d
test rbx, rbx
jne 0x1400583de
mov rbx, qword [r9]
test rbx, rbx
je 0x1400586dc
mov rax, qword [rbp - 0x10]
movzx r10d, word [rbx + 0x44]
movzx ecx, word [rbx + 0x46]
add r10d, 3
add r10d, ecx
mov qword [rbp - 0x10], rax
mov eax, dword [rbp - 0x2c]
and r10d, 0xfffffffc
mov dword [rbp - 0x2c], eax
mov r8, r15
mov rdx, rbx
call fcn.14007ad6c
test eax, eax
jne 0x1400586dc
xor esi, esi
mov eax, 0x34534947
cmp dword [r15 + 0xcc], eax
jne 0x14005840d
cmp dword [rbx + 0xcc], eax
jne 0x1400586cc
cmp dword [rbp - 0x2c], esi
jne 0x140058432
mov rax, qword [0x1400ca100]
cmp qword [rdi + 8], rax
jne 0x1400586cc
mov eax, dword [r14 + 0x68]
and eax, 0x50
cmp al, 0x50
je 0x1400586cc
mov r9d, r10d
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14007a1e8
test eax, eax
je 0x1400586cc
cmp rbx, qword [rbp - 0x20]
jne 0x140058466
mov r12d, dword [rbp - 0x30]
mov r15, qword [rbp - 0x20]
mov esi, r13d
sub rsi, r12
add rsi, r14
mov qword [r14 + 0x38], rsi
mov rdx, qword [rdi + 0x48]
mov r8, rbx
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x1400586eb
mov ebx, 1
mov dword [rbp + 0x40], ebx
test r15, r15
je 0x140058559
lea rsi, [r14 + 8]
mov rcx, rdi
mov qword [r14], rsi
call fcn.140057798
mov qword [rbp - 0x10], rax
test rax, rax
jne 0x140058357
xor ebx, ebx
mov dword [rbp + 0x40], ebx
jmp 0x140058357
cmp qword [rdi + 0x48], rcx
jne 0x1400584ff
mov ecx, 2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test byte [0x1400ca180], 2
je 0x1400587e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 8
mov r8, qword [rdi + 0x48]
lea rdx, [0x1400b67b8]
mov dword [rsp + 0x20], eax
call fcn.140058804
jmp 0x1400587e0
mov rbx, qword [rbp + 0x60]
mov rcx, rdi
mov dword [rbx], 8
call fcn.140057798
mov qword [rbp - 0x10], rax
test rax, rax
je 0x140058355
mov r15, qword [rax + 0x38]
test r15, r15
je 0x140058537
movzx r12d, word [r15 + 0x46]
movzx eax, word [r15 + 0x44]
add r12d, eax
add dword [rbx], r12d
cmp r13d, dword [rbx]
jb 0x140058344
mov ebx, 1
mov dword [rbp + 0x40], ebx
test r15, r15
je 0x140058559
lea rsi, [r14 + 8]
mov qword [r14], rsi
jmp 0x140058357
and qword [r14], rsi
jmp 0x140058357
cmp qword [rdi + 0x48], rcx
je 0x140058674
call sym.spoolsv.exe_PrvCheckLocalCall
test eax, eax
jne 0x140058671
mov rcx, qword [rdi + 0x48]
lea rdx, str._DrvConvert
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140058671
mov ecx, dword [0x1400c8ba0]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
cmp rax, 2
je 0x140058671
mov rdx, qword [rdi + 0x48]
lea r8, [rbp - 0x18]
xor ecx, ecx
call sym.spoolsv.exe_PrvbGetDevModePerUser
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x140058671
mov rcx, qword [rdi + 8]
lea rdx, str.win32spl.dll
mov r15, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14005864d
mov dword [rbp - 0x2c], 1
test r14, r14
je 0x14005864d
mov rax, qword [rdi + 8]
movabs r10, 0x869c8e0814507b70
mov rax, qword [rax + 0x58]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, r13d
mov rcx, qword [rdi + 0x10]
mov r8, r14
mov edx, 4
call qword [0x1400a9400]
test eax, eax
je 0x14005864d
mov eax, dword [r14 + 0x10]
and eax, 0x50
cmp al, 0x50
je 0x14005864d
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp - 0x20]
call fcn.14007a310
cmp qword [rbp - 0x20], rsi
jne 0x140058666
movzx edx, word [rbx + 0x44]
movzx ecx, word [rbx + 0x46]
add edx, 3
add edx, ecx
and edx, 0xfffffffc
mov dword [rbp - 0x30], edx
mov dword [rbp - 0x28], 3
and r13d, 0xfffffffc
mov edx, dword [rbp + 0x48]
cmp r13d, dword [rbp - 0x30]
jb 0x140058683
mov r9d, r13d
sub r9d, dword [rbp - 0x30]
jmp 0x140058686
xor r9d, r9d
mov rax, qword [rdi + 8]
and r9d, 0xfffffff8
movabs r10, 0x869c8e0814507b70
mov rbx, qword [rbp + 0x60]
mov r8, r14
mov rcx, qword [rdi + 0x10]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x20], rbx
call qword [0x1400a9400]
mov ecx, dword [rbx]
add ecx, 7
mov dword [rbp + 0x40], eax
and ecx, 0xfffffff8
add ecx, dword [rbp - 0x28]
add ecx, dword [rbp - 0x30]
mov dword [rbx], ecx
mov ebx, eax
jmp 0x140058357
mov rdx, qword [rdi + 0x48]
xor r8d, r8d
xor ecx, ecx
call sym.spoolsv.exe_PrvbSetDevModePerUser
jmp 0x140058705
mov esi, r13d
mov r12d, r11d
sub rsi, r11
add rsi, r14
mov qword [r9], rsi
test rsi, rsi
je 0x140058705
mov r8d, r12d
mov rdx, r15
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x40], 1
mov r8, qword [rbp - 0x18]
xor edx, edx
mov rcx, qword [0x1400ca110]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov r8, qword [rbp - 0x10]
xor edx, edx
mov rcx, qword [0x1400ca110]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov r8, qword [rbp - 0x20]
xor edx, edx
mov rcx, qword [0x1400ca110]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov ebx, dword [rbp - 0x28]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov r12d, dword [rbp + 0x40]
test r12d, r12d
jne 0x1400587a7
cmp ebx, 0x7a
je 0x1400587a7
mov rcx, qword [0x1400c82a8]
lea rax, [0x1400c82a8]
cmp rcx, rax
je 0x1400587a7
test byte [rcx + 0x44], 0x20
mov esi, dword [rbp + 0x48]
je 0x1400587aa
mov r9, qword [rdi + 0x48]
lea edx, [r12 + 0x15]
mov rcx, qword [rcx + 0x38]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
call fcn.140058f60
jmp 0x1400587aa
mov esi, dword [rbp + 0x48]
test byte [0x1400ca180], 2
je 0x1400587ca
mov r8, qword [rdi + 0x48]
lea rdx, [0x1400b67b8]
mov r9d, esi
mov dword [rsp + 0x20], ebx
call fcn.140058804
mov eax, r12d
jmp 0x1400587e2
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret