Function at 0x140027e50
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x78], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x80], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x88], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x90], rcx
mov rdx, rcx
and rdx, 1
shl rdx, 1
movabs r8, 0x92752fc7b164ebd4
movabs rax, 0x92752fc7b164ebd5
xor r8, rax
mov rax, rcx
xor rax, r8
add rax, rdx
xor rcx, 0xffffffffffffffff
and rax, rcx
movabs rcx, 0xa2511dfe337e5273
movabs rdx, 0xa2511dfe337e5273
xor rcx, rdx
cmp rax, rcx
jge 0x140027ede
call fcn.14000ee80
jmp 0x1400282f4
mov ecx, dword [0x1402a90c8]
mov eax, dword [0x1402a90cc]
mov r11d, ecx
xor r11d, 0xffffffff
xor ecx, 0xffffffff
or r11d, ecx
and eax, eax
xor eax, 0xffffffff
and r11d, eax
xor r11d, 0xffffffff
mov eax, 0x9b7fc15a
xor eax, 0xd43db62f
imul r11d, eax
mov eax, r11d
add eax, 1
xor r11d, 0xffffffff
mov ecx, 0x24cacec7
xor ecx, 0x7a39dbeb
or r11d, ecx
add r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0x22bde30d
xor r8d, 0x2425612a
mov eax, 0xcb077ec0
xor eax, 0x34f8813f
xor r8d, eax
mov edx, 0xffffffff
xor edx, 0x82ea6300
mov eax, ecx
and eax, 0x82ea6300
and r11d, edx
mov r9d, r8d
and r9d, 0x82ea6300
mov r10d, edx
and r10d, 0x6988227
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x82ea6300
and ecx, edx
or eax, ecx
cmp eax, 0x9eddf020
je 0x1400282fc
mov r8, qword [rsp + 0x90]
mov eax, dword [0x1402a90d0]
mov ecx, dword [0x1402a90d4]
xor ecx, 0x980a67ab
sub eax, ecx
mov ecx, 0x55ffc77e
xor ecx, 0x40cd1aac
xor eax, ecx
mov ecx, 0xb978d131
xor ecx, 0x444af726
add eax, ecx
mov ecx, eax
and ecx, 0x42315dfe
shl ecx, 1
xor eax, 0x42315dfe
add eax, ecx
movabs rdx, 0xe2fba1884f17ccee
movabs rcx, 0x925ed1b135d83b2
xor rdx, rcx
mov rcx, r8
sub rcx, rdx
add rcx, 9
movabs rdx, 0xebde4c935c4a4f5c
add rcx, rdx
mov qword [rsp + 0x68], rcx
movabs rdx, 0x1df37505f09d1f99
movabs r9, 0xe20c8afa0f62e067
xor rdx, r9
sub rdx, r8
and rcx, rdx
movabs rdx, 0xb18a6c179c92fd5c
movabs r8, 0xb18a6c179c92fd5c
xor rdx, r8
cmp rcx, rdx
setl cl
mov byte [rsp + 0x77], cl
cmp eax, 0x9d62ccc3
je 0x1400282fc
mov al, byte [rsp + 0x77]
test al, 1
jne 0x14002806e
jmp 0x140028078
call fcn.14000ee80
jmp 0x1400282f4
mov rax, qword [rsp + 0x68]
cmp rax, 0
jge 0x140028097
mov rcx, r8
mov rdx, r8
call fcn.140018506
jmp 0x1400282f4
mov eax, dword [0x1402a90d8]
add eax, dword [0x1402a90dc]
mov ecx, eax
and ecx, 0xe7e0852a
shl ecx, 1
xor eax, 0xe7e0852a
add eax, ecx
or eax, 0xfe966994
add eax, 0x1aed75fb
cmp eax, 0x5cfed4d8
jae 0x140028305
mov r11d, dword [0x1402a90e0]
mov eax, dword [0x1402a90e4]
sub r11d, 0x40ecfb05
sub r11d, eax
add r11d, 0x40ecfb05
mov eax, 0x94f9bc61
xor eax, 0x519e0b2e
sub r11d, eax
mov eax, r11d
xor eax, 0xffffffff
mov r8d, 0x97073d1e
xor r8d, 0xbcec3d6b
mov ecx, 0x2ad84baf
xor ecx, 0xd527b450
xor r8d, ecx
mov edx, 0xffffffff
xor edx, 0x4251220b
mov ecx, eax
and ecx, 0x4251220b
and r11d, edx
mov r9d, r8d
and r9d, 0x4251220b
mov r10d, edx
and r10d, 0x2beb0075
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
xor eax, 0xffffffff
or edx, 0x4251220b
and eax, edx
or ecx, eax
mov edx, 0xffffffff
xor edx, 0xfd32d59d
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [rsp + 0x44], eax
mov eax, 0xcadf5be2
xor eax, 0xa2f092f9
mov dword [rsp + 0x40], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
add rcx, 0x68
call fcn.140013e80
mov r9, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov ecx, dword [rsp + 0x40]
mov r8, rax
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x48], r8
mov qword [r9], r8
mov r9, qword [rdx]
mov qword [r8], r9
mov r9, qword [rdx]
mov qword [rsp + 0x50], r9
xor edx, edx
sub rdx, 1
mov r8, r9
sub r8, rdx
mov qword [rsp + 0x58], r8
movabs rdx, 0x83a360486976044f
movabs r10, 0x7c5c9fb79689fbb0
xor rdx, r10
xor r9, rdx
movabs rdx, 0x27e4560a229d3dc9
movabs r10, 0xd81ba9f5dd62c236
xor rdx, r10
xor r9, rdx
mov rdx, r8
xor rdx, r9
and rdx, r8
movabs r8, 0xabfa48f533e3259d
movabs r9, 0xabfa48f533e3259d
xor r8, r9
cmp rdx, r8
setl dl
mov byte [rsp + 0x67], dl
cmp eax, ecx
jb 0x140028305
mov al, byte [rsp + 0x67]
test al, 1
jne 0x14002824f
jmp 0x140028259
call fcn.14000ee80
jmp 0x1400282f4
mov rax, qword [rsp + 0x58]
cmp rax, 0
jge 0x140028278
mov rcx, r8
mov rdx, r8
call fcn.140018506
jmp 0x1400282f4
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x48]
add rdx, 8
mov qword [rsp + 0x28], rdx
add rax, 8
mov qword [rsp + 0x30], rax
xor eax, eax
cmp rcx, 0
mov qword [rsp + 0x38], rax
je 0x1400282f4
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r8b, byte [r8 + rcx]
mov byte [rax + rcx], r8b
movabs r8, 0xd371ec6dc89d5a25
movabs rax, 0xd371ec6dc89d5a24
xor r8, rax
mov rax, rcx
add rax, r8
cmp rcx, rdx
mov qword [rsp + 0x38], rax
jne 0x1400282ad
add rsp, 0x98
ret
shl byte [rdx], 1
or eax, 0xfc94e906
invalid
pop rsi
and al, 0x28
invalid