Function at 0x481160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, edx
mov dword [ebp - 0xc], 0
push edi
mov edi, ecx
test esi, esi
jne 0x4811d6
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4811b7
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.mft_lookup:_null_mft_buffer
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp ecx, dword [edi + 0x24]
ja 0x48124a
jb 0x4811e8
cmp ebx, dword [edi + 0x20]
jae 0x48124a
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x481227
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [ebp + 0xc]
mov dword [esi], 0x8000006
push ebx
push str.mft_lookup:_inode_number_is_too_small___llu_
call fcn.004768f0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x28]
mov eax, dword [edi + 0x2c]
add edx, 0xffffffff
adc eax, 0xffffffff
cmp ecx, eax
jb 0x48128c
ja 0x481260
cmp ebx, edx
jbe 0x48128c
call fcn.00476ab0
mov ecx, 0x8000006
call fcn.00476850
push dword [ebp + 0xc]
push ebx
push str.mft_lookup:_inode_number_is_too_large___llu_
call fcn.004768f0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x561618], 0
je 0x4812b0
push ecx
push ebx
push str.ntfs_dinode_lookup:_Processing_MFT__llu_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.00479b20
mov ecx, dword [ebp + 0xc]
add esp, 0x10
mov eax, dword [edi + 0x124]
test eax, eax
jne 0x48136b
test ecx, ecx
jne 0x48133f
cmp ebx, 0x10
ja 0x48133f
push ecx
push ebx
push ecx
push dword [edi + 0x130]
call fcn.004c2160
mov ebx, eax
mov ecx, edx
add ebx, dword [edi + 0x138]
adc ecx, dword [edi + 0x13c]
mov dword [ebp - 8], ecx
push dword [edi + 0x130]
mov edx, esi
push ecx
push ebx
mov ecx, edi
call fcn.00491170
mov ecx, eax
add esp, 0xc
mov eax, dword [edi + 0x130]
mov dword [ebp - 0x18], eax
cmp ecx, eax
je 0x481606
test ecx, ecx
js 0x481322
call fcn.00476ab0
mov ecx, 0x8000004
call fcn.00476850
push dword [ebp - 8]
push ebx
push str.ntfs_dinode_lookup:_Error_reading_MFT_Entry_at__llu
call fcn.00476950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00476ab0
mov ecx, 0x8000006
call fcn.00476850
push dword [ebp + 0xc]
push ebx
push str.Error_trying_to_load_a_high_MFT_entry_when_the_MFT_itself_has_not_been_loaded___llu_
call fcn.004768f0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push ebx
push 0
push dword [edi + 0x130]
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
call fcn.004c2160
mov ebx, dword [edi + 0x124]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov ebx, dword [ebx + 0x28]
test ebx, ebx
je 0x4813d3
push 0
push dword [edi + 0x128]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call fcn.004c2160
mov ecx, eax
mov eax, edx
mov edx, dword [ebp - 8]
cmp edx, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
jl 0x481437
jg 0x4813c2
cmp eax, ecx
jb 0x481437
mov ebx, dword [ebx]
sub eax, ecx
mov dword [ebp - 4], eax
sbb edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
test ebx, ebx
jne 0x481395
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x481412
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [ebp + 0xc]
mov dword [esi], 0x8000008
push dword [ebp + 8]
push str.mft_lookup:_Error_finding_MFT_entry__llu_in__MFT
call fcn.004768f0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x561618], 0
je 0x481467
push edx
push eax
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push str.ntfs_dinode_lookup:_Found_in_offset:__llu__size:__llu_at_offset:__llu_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.00479b20
mov edx, dword [ebp - 8]
add esp, 0x20
mov ecx, dword [edi + 0x130]
xor eax, eax
add ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x18]
adc eax, edx
cmp dword [ebp - 0x14], eax
jg 0x4814f7
jl 0x481486
cmp ecx, dword [ebp - 0x10]
jae 0x4814f7
cmp dword [0x561618], 0
je 0x4814a5
push str.ntfs_dinode_lookup:_Entry_crosses_run_border_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.00479b20
add esp, 8
mov eax, dword [ebx]
test eax, eax
jne 0x4814d3
call fcn.00476ab0
mov ecx, 0x8000009
call fcn.00476850
push str.mft_lookup:_MFT_entry_crosses_a_cluster_and_there_are_no_more_clusters_
call fcn.004768f0
add esp, 4
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [edi + 0x128]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004c2160
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
jmp 0x481503
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
push 0
push dword [edi + 0x128]
push dword [ebx + 0x14]
push dword [ebx + 0x10]
call fcn.004c2160
mov ebx, eax
mov ecx, edx
add ebx, dword [ebp - 4]
adc ecx, dword [ebp - 8]
cmp dword [0x561618], 0
mov dword [ebp - 8], ecx
je 0x481547
push ecx
push ebx
push str.ntfs_dinode_lookup:_Entry_address_at:__llu_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.00479b20
mov ecx, dword [ebp - 8]
add esp, 0x10
mov eax, ebx
or eax, ecx
je 0x4813d3
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x10]
je 0x4812e8
push dword [ebp - 0xc]
mov edx, esi
push ecx
push ebx
mov ecx, edi
call fcn.00491170
mov ecx, dword [ebp - 0xc]
add esp, 0xc
cmp eax, ecx
je 0x4815a5
test eax, eax
js 0x481588
call fcn.00476ab0
mov ecx, 0x8000004
call fcn.00476850
push dword [ebp - 8]
push ebx
push str.ntfs_dinode_lookup:_Error_reading_MFT_Entry__part_1__at__llu
call fcn.00476950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x130]
lea edx, [ecx + esi]
mov ebx, dword [ebp - 0x14]
sub eax, ecx
push eax
push dword [ebp - 0x10]
mov ecx, edi
push ebx
call fcn.00491170
mov edx, eax
add esp, 0xc
mov eax, dword [edi + 0x130]
mov ecx, eax
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
cmp edx, ecx
je 0x481606
test edx, edx
js 0x4815e9
call fcn.00476ab0
mov ecx, 0x8000004
call fcn.00476850
push dword [ebp - 0x10]
push ebx
push str.ntfs_dinode_lookup:_Error_reading_MFT_Entry__part_2__at__llu
call fcn.00476950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [edi + 0x98]
movzx ecx, byte [esi + 7]
movzx edx, byte [esi + 6]
cmp ebx, 1
jne 0x481622
mov eax, ecx
shl eax, 8
add eax, edx
jmp 0x481629
mov eax, edx
shl eax, 8
add eax, ecx
test ax, ax
je 0x481678
cmp ebx, 1
jne 0x48163b
shl ecx, 8
lea eax, [ecx + edx]
jmp 0x481641
shl edx, 8
lea eax, [edx + ecx]
movzx eax, ax
dec eax
shl eax, 9
cmp eax, dword [edi + 0x130]
jbe 0x481678
call fcn.00476ab0
mov ecx, 0x8000009
call fcn.00476850
push str.dinode_lookup:_More_Update_Sequence_Entries_than_MFT_size
call fcn.004768f0
add esp, 4
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [esi + 5]
movzx edx, byte [esi + 4]
cmp ebx, 1
jne 0x48168e
mov eax, ecx
shl eax, 8
add eax, edx
jmp 0x481695
mov eax, edx
shl eax, 8
add eax, ecx
movzx eax, ax
cmp eax, dword [ebp - 0x18]
jbe 0x4816c5
call fcn.00476ab0
mov ecx, 0x8000009
call fcn.00476850
push str.dinode_lookup:_Update_sequence_offset_larger_than_MFT_size
call fcn.004768f0
add esp, 4
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 1
jne 0x4816cf
shl ecx, 8
jmp 0x4816d2
shl edx, 8
add ecx, edx
movzx eax, cx
add eax, esi
mov dword [ebp - 0x14], eax
cmp ebx, 1
jne 0x4816f8
lea ecx, [eax + 1]
mov edx, 0x100
movzx eax, byte [eax]
mov dword [ebp - 0x18], ecx
movzx ecx, byte [ecx]
imul cx, dx
jmp 0x48170d
movzx ecx, byte [eax]
lea edx, [eax + 1]
mov eax, 0x100
mov dword [ebp - 0x18], edx
imul cx, ax
movzx eax, byte [edx]
add cx, ax
mov ebx, 1
movzx eax, cx
mov edx, 0x1fe
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp dword [edi + 0x98], 1
jne 0x481736
movzx ecx, byte [esi + 7]
movzx eax, byte [esi + 6]
jmp 0x48173e
movzx ecx, byte [esi + 6]
movzx eax, byte [esi + 7]
shl ecx, 8
add eax, ecx
movzx eax, ax
cmp ebx, eax
jge 0x481816
lea ebx, [esi + 1]
mov eax, 0x100
add ebx, edx
cmp dword [edi + 0x98], 1
jne 0x48176e
movzx ecx, byte [ebx]
imul cx, ax
movzx eax, byte [edx + esi]
jmp 0x481779
movzx ecx, byte [edx + esi]
imul cx, ax
movzx eax, byte [ebx]
add cx, ax
movzx eax, cx
mov dword [ebp - 0xc], eax
cmp ax, word [ebp - 0x10]
jne 0x4817af
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + ecx*2]
mov byte [edx + esi], al
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + ecx*2]
inc ecx
mov byte [ebx], al
add edx, 0x200
mov dword [ebp - 4], ecx
mov ebx, ecx
jmp 0x481723
cmp dword [edi + 0x98], 1
mov esi, 0x100
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
movzx ecx, byte [edx + eax*2 + 1]
movzx eax, byte [edx + eax*2]
jne 0x4817d2
imul cx, si
jmp 0x4817d6
imul ax, si
add cx, ax
movzx esi, cx
call fcn.00476ab0
mov ecx, 0x800000f
call fcn.00476850
movzx eax, si
push eax
mov eax, dword [ebp - 0xc]
movzx eax, ax
push eax
mov eax, dword [ebp - 0x10]
movzx eax, ax
push eax
push str.Incorrect_update_sequence_value_in_MFT_entry_nSignature_Value:_0x_hx_Actual_Value:_0x_hx_Replacement_Value:_0x_hx_nThis_is_typically_because_of_a_corrupted_entry
call fcn.004768f0
add esp, 0x10
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret