Function at 0x14001d600
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x138
mov qword [rsp + 0x108], rdx
mov qword [rsp + 0x110], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x118], rax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [rsp + 0x118]
add rcx, 0x60
mov qword [rsp + 0x120], rcx
mov rcx, rax
add rcx, 0x20
mov qword [rsp + 0x128], rcx
mov r8, qword [rax + 0x20]
mov rcx, r8
and rcx, 0xffffffffffffffff
shl rcx, 1
mov rax, r8
xor rax, 0xffffffffffffffff
add rax, rcx
mov qword [rsp + 0x130], rax
mov rcx, rax
and rcx, r8
movabs rdx, 0xae9f99fbff4a08b5
movabs r9, 0xae9f99fbff4a08b7
xor rdx, r9
imul rdx, rcx
mov rcx, rax
add rcx, r8
sub rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
or al, al
mov cl, 1
xor cl, 0
xor al, cl
mov cl, dl
xor cl, 0xff
xor dl, 0xff
and cl, dl
or al, cl
mov cl, 1
xor cl, 0
xor al, cl
test al, 1
jne 0x14001d7cc
mov ecx, dword [0x140272e88]
mov edx, dword [0x140272e8c]
mov eax, ecx
and eax, edx
shl eax, 1
xor ecx, edx
add ecx, eax
add ecx, 0x43db2125
mov eax, 0x250ac6bd
xor eax, 0x7551cae5
and ecx, eax
mov edx, 0xffffffff
xor edx, 0xcbcfcc93
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0x7e8a4182
ja 0x14001e2d3
mov rcx, qword [rsp + 0x118]
mov eax, dword [0x140272e90]
mov edx, dword [0x140272e94]
mov r8d, 0xa1898134
xor r8d, 0x42a929ec
sub eax, r8d
add eax, edx
add eax, 0xe320a8d8
mov r8d, 0x8212d0b
xor r8d, 0x15a49085
mov edx, eax
and edx, r8d
mov r8d, 0x7e624f48
xor r8d, 0x7e624f4a
imul edx, r8d
mov r8d, 0x5936dfb2
xor r8d, 0x44b3623c
xor eax, r8d
add eax, edx
mov edx, 0x7d592773
xor edx, 0x8a621f27
sub eax, edx
mov edx, eax
and edx, 0x5e0f30f7
shl edx, 1
add eax, 0x5e0f30f7
sub eax, edx
add rcx, 0x30
mov qword [rsp + 0x100], rcx
cmp eax, 0xd0ebc14b
je 0x14001e2d3
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0xf8], rax
jmp 0x14001d897
mov eax, dword [0x140272e98]
xor edx, edx
div dword [0x140272e9c]
mov ecx, 0xee80ace3
xor ecx, 0x117f531c
mov edx, eax
xor edx, ecx
and edx, 0x2fc9b95d
mov r8d, 0xffffffff
xor r8d, 0x2fc9b95d
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x2fc9b95d
or eax, 0x2fc9b95d
imul eax, edx
add eax, ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0xf55947e1
and ecx, 0xf55947e1
mov edx, 0xbb0af411
xor edx, 0x44f50bee
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x4f5f8a23
xor ecx, 0xdb906831
imul eax, ecx
mov ecx, 0x5062cebe
xor ecx, 0x434a370c
cmp eax, ecx
jbe 0x14001e2dc
mov eax, dword [0x140272ea0]
and eax, dword [0x140272ea4]
sub eax, 0xc1291d46
xor eax, 0x441a05bd
add eax, 0x6c822ac3
mov dword [rsp + 0xf4], eax
call fcn.14000f24b
mov eax, dword [rsp + 0xf4]
cmp eax, 0xadeab4db
jae 0x14001d859
jmp 0x14001e2c9
mov rcx, qword [rsp + 0x108]
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0xe8], rax
cmp rax, rcx
jl 0x14001d991
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x100]
mov rax, qword [rax]
mov r9, rdx
shl r9, 4
mov rcx, rax
add rcx, r9
mov rcx, qword [rcx]
shl rdx, 4
add rax, rdx
add rax, 8
mov rdx, qword [rax]
call fcn.14001ace0
mov rax, qword [rsp + 0x120]
cmp byte [rax], 0
jne 0x14001e2c9
mov rdx, qword [rsp + 0xe8]
movabs rcx, 0xf3b31fdfec28afdf
movabs rax, 0xc4ce02013d75020
xor rcx, rax
mov rax, rdx
add rax, rcx
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl r8b
movabs rcx, 0x814ea372a8303c9c
movabs rdx, 0x7eb15c8d57cfc363
xor rcx, rdx
cmp rax, rcx
setg dl
mov cl, dl
xor cl, 0xff
mov r9b, r8b
xor r9b, 0xff
or cl, r9b
and dl, r8b
xor dl, 0xff
and cl, dl
xor cl, 0xff
test cl, 1
mov qword [rsp + 0xf8], rax
jne 0x14001d987
jmp 0x14001d897
call fcn.14000f24b
jmp 0x14001e2c9
mov rax, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rdx + 0x48]
cmp rcx, qword [rdx + 0x40]
mov qword [rsp + 0xe0], rax
jne 0x14001d9d9
mov rax, qword [rsp + 0x110]
mov cl, 0xbe
xor cl, 0xbf
mov byte [rax + 0x50], cl
mov eax, 1
mov qword [rsp + 0xd8], rax
jmp 0x14001dc24
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xd0], rax
mov eax, dword [0x140272ea8]
mov ecx, dword [0x140272eac]
mov edx, 0x473b0017
xor edx, 0xb8c4ffe8
xor ecx, edx
add eax, ecx
mov ecx, 0x57cd7295
xor ecx, 0x57cd7294
add eax, ecx
add eax, 0x2ec18268
mov ecx, 0xfb6c7608
xor ecx, 0x4632a791
xor edx, edx
div ecx
mov r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0x4f1eaa45
xor r8d, 0xd831b185
mov eax, 0x9c203d96
xor eax, 0x63dfc269
xor r8d, eax
mov edx, 0xde7cd42d
xor edx, 0x4fd1fbac
mov eax, 0x49dd9718
xor eax, 0xb62268e7
xor edx, eax
mov eax, ecx
and eax, 0x91ad2f81
and r11d, edx
mov r9d, r8d
and r9d, 0x91ad2f81
mov r10d, edx
and r10d, 0x972f1bc0
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0x67acda6
xor r8d, 0xf9853259
xor ecx, r8d
or edx, 0x91ad2f81
and ecx, edx
or eax, ecx
cmp eax, 0x6dfcaf17
jb 0x14001e2e5
mov r8, qword [rsp + 0x108]
mov eax, dword [0x140272eb0]
xor edx, edx
div dword [0x140272eb4]
or eax, 0xaac4b3ee
mov ecx, 0xd91366f
xor ecx, 0x8f80c478
xor eax, ecx
mov ecx, 0x5cd93de4
xor edx, edx
div ecx
mov rdx, qword [rsp + 0xd0]
mov ecx, 0x61f600c
xor ecx, 0x8a50756c
cmp rdx, r8
setl dl
mov byte [rsp + 0xcf], dl
cmp eax, ecx
je 0x14001daae
mov cl, byte [rsp + 0xcf]
mov eax, 2
test cl, 1
mov qword [rsp + 0xd8], rax
jne 0x14001dc24
jmp 0x14001db29
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0x100]
mov rax, qword [rax]
mov r9, rdx
shl r9, 4
mov rcx, rax
add rcx, r9
mov rcx, qword [rcx]
shl rdx, 4
add rax, rdx
add rax, 8
mov rdx, qword [rax]
call fcn.14001c090
mov rax, qword [rsp + 0x120]
mov al, byte [rax]
mov cl, 0xfe
xor cl, 0xfe
cmp al, cl
jne 0x14001e2c9
mov rdx, qword [rsp + 0xd0]
movabs rcx, 0xc1e8e18685db29a7
mov rax, rdx
sub rax, rcx
movabs rcx, 0x435690f8b999eca7
movabs r8, 0xbca96f0746661358
xor rcx, r8
add rax, rcx
movabs rcx, 0x7b381e088868029e
movabs r8, 0xbad0ff8e0db32b39
xor rcx, r8
add rax, rcx
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x6d4755d67239b6cd
movabs r8, 0x6d4755d67239b6cd
xor rdx, r8
cmp rcx, rdx
setl r8b
cmp rax, 0xffffffffffffffff
setg dl
mov cl, 1
xor cl, 0
xor r8b, cl
mov cl, dl
xor cl, r8b
and cl, dl
test cl, 1
mov qword [rsp + 0xe0], rax
jne 0x14001dc1a
jmp 0x14001d9d9
call fcn.14000f24b
jmp 0x14001e2c9
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0xa0], rcx
mov rcx, rax
add rcx, 0x18
mov qword [rsp + 0xa8], rcx
mov qword [rax + 0x18], 0
mov rcx, rax
add rcx, 0x20
mov qword [rsp + 0xb0], rcx
movabs rcx, 0x59abe8cf4ddd91fe
movabs rdx, 0x59abe8cf4ddd95fe
xor rcx, rdx
mov qword [rax + 0x20], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
add rcx, 0x68
movabs rdx, 0xb5aeff7a9c6104e7
movabs rax, 0xb5aeff7a9c6144e7
xor rdx, rax
call fcn.140014f80
mov rcx, qword [rsp + 0x128]
mov rdx, rax
mov rax, qword [rsp + 0x110]
mov r8, rax
add r8, 0x28
mov qword [rsp + 0xb8], r8
mov qword [rax + 0x28], rdx
xor eax, eax
cmp qword [rcx], 0
mov qword [rsp + 0xc0], rax
jg 0x14001dd3c
jmp 0x14001dd10
mov rcx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x98]
add rax, 1
cmp rax, qword [rcx]
mov qword [rsp + 0xc0], rax
jl 0x14001dd3c
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, 0
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
jg 0x14001df15
jmp 0x14001e062
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x98], rax
mov eax, dword [0x140272eb8]
xor eax, 0x81670f96
mov edx, dword [0x140272ebc]
mov ecx, eax
add ecx, 1
mov r8d, 0x389e761c
xor r8d, 0xc76189e3
xor eax, r8d
or eax, edx
add eax, ecx
or eax, 0xe2f6f35
mov edx, 0xe6f21b61
xor edx, 0x190de49e
mov ecx, eax
xor ecx, edx
and ecx, 0x8c1d472d
mov edx, 0xffffffff
xor edx, 0x8c1d472d
and eax, edx
sub eax, ecx
or eax, 0x31317389
cmp eax, 0x37b80eb2
jbe 0x14001e2ee
mov r9, qword [rsp + 0x110]
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x100]
mov r10d, dword [0x140272ec0]
mov r11d, dword [0x140272ec4]
mov ecx, r10d
xor ecx, 0xffffffff
mov edi, 0xea0b1b55
xor edi, 0x15f4e4aa
mov esi, r10d
xor esi, edi
or ecx, esi
xor ecx, 0xffffffff
mov esi, r11d
xor esi, 0xffffffff
or ecx, esi
and r11d, r11d
xor r11d, 0xffffffff
mov esi, 0xb478aa9a
xor esi, 0x4b875565
xor r10d, esi
xor r11d, 0xffffffff
or r10d, r11d
and ecx, r10d
xor ecx, 0xffffffff
add ecx, 0xa279d4c4
sub ecx, 0x31c89904
sub ecx, 0xa279d4c4
mov r10d, ecx
xor r10d, 0xffffffff
mov r11d, 0x4cb5f734
xor r11d, 0x9130ef44
and r11d, r10d
mov esi, 0xffffffff
xor esi, 0xdd851870
mov r10d, ecx
and r10d, esi
imul r10d, r11d
mov r11d, ecx
and r11d, 0xdd851870
mov esi, 0xa030c23e
xor esi, 0x7db5da4e
or ecx, esi
imul ecx, r11d
add ecx, r10d
mov r10d, ecx
and r10d, 0xae656abe
shl r10d, 1
xor ecx, 0xae656abe
add ecx, r10d
mov dword [rsp + 0x80], ecx
mov ecx, 0xae095edf
xor ecx, 0x6b504892
mov dword [rsp + 0x7c], ecx
mov rax, qword [rax]
mov r10, rdx
shl r10, 4
mov rcx, rax
add rcx, r10
mov rcx, qword [rcx]
mov qword [rcx + 8], 0
shl rdx, 4
add rax, rdx
add rax, 8
mov rdx, qword [rax]
call fcn.14001c6e0
mov rdx, qword [rsp + 0x120]
mov ecx, dword [rsp + 0x7c]
mov eax, dword [rsp + 0x80]
cmp byte [rdx], 0
sete dl
mov byte [rsp + 0x87], dl
cmp eax, ecx
ja 0x14001e2ee
mov al, byte [rsp + 0x87]
test al, 1
jne 0x14001dceb
jmp 0x14001e2c9
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov r8, rcx
shl r8, 4
mov rdx, rax
add rdx, r8
mov rdx, qword [rdx]
mov qword [rsp + 0x50], rdx
shl rcx, 4
add rax, rcx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rdx
mov rdx, rcx
and rdx, 0x10
shl rdx, 1
xor rcx, 0x10
add rcx, rdx
mov qword [rsp + 0x68], rcx
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
cmp rax, 0
je 0x14001dfb7
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call rax
mov rax, qword [rsp + 0x60]
cmp byte [rax + 0x60], 0
jne 0x14001dfff
mov rax, qword [rsp + 0x58]
movsx rdx, word [rax + 0x10]
mov qword [rsp + 0x40], rdx
mov ecx, 0x10
call fcn.14000efe0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x40]
mov r8, rax
movabs rax, 0x5f749e563c62828a
movabs r9, 0x5f749e563c62828a
xor rax, r9
sub rax, r8
add rcx, rax
call fcn.14001d203
mov rax, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x48]
movabs r8, 0xdc3da147cea2de78
movabs rcx, 0xdc3da147cea2de79
xor r8, rcx
mov rcx, rdx
and rcx, r8
movabs r8, 0xf4dbba90a431027d
movabs r9, 0xf4dbba90a431027c
xor r8, r9
or rdx, r8
add rcx, rdx
mov rax, qword [rax]
cmp rcx, rax
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
jl 0x14001df15
mov rax, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x90]
mov rcx, rax
add rcx, 0x30
mov qword [rsp + 0x30], rcx
mov r8, qword [rax + 0x30]
mov rcx, r8
add rcx, rdx
mov qword [rsp + 0x38], rcx
mov rax, rcx
xor rax, r8
xor rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x14001e16b
mov eax, dword [0x140272ec8]
xor edx, edx
div dword [0x140272ecc]
add eax, 0xf718d2c1
mov ecx, 0xf9c7e057
xor ecx, 0x5bbaba8c
add eax, ecx
mov ecx, 0x413cf84
xor ecx, 0xf30b1d45
sub eax, ecx
and eax, 0xab24962f
xor ecx, ecx
sub ecx, 0xd4150131
add eax, ecx
cmp eax, 0x2c9a8266
je 0x14001e2f7
mov ecx, dword [0x140272ed0]
and ecx, dword [0x140272ed4]
and ecx, 0x4ebdbdf8
mov eax, 0x6dbda9e4
xor eax, 0xd156cff
add ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0x7f7949f0
xor edx, 0x8086b60f
xor eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x26a5a557
or eax, edx
mov edx, 0xffffffff
xor edx, 0x26a5a557
mov r8d, 0xffffffff
xor r8d, 0x26a5a557
or edx, r8d
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov dword [rsp + 0x2c], eax
call fcn.14000f24b
mov eax, dword [rsp + 0x2c]
cmp eax, 0xcbc569ea
jae 0x14001e2f7
jmp 0x14001e2c9
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov qword [rcx], rdx
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14001e1be
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.1400190f0
mov rax, qword [rsp + 0xb8]
mov qword [rax], 0
mov eax, dword [0x140272ed8]
mov ecx, dword [0x140272edc]
xor ecx, 0xc7ad8896
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0x4cb89f6e
xor ecx, 0xffffffff
and ecx, 0x4cb89f6e
shl ecx, 1
mov edx, 0xeca479fd
xor edx, 0xa01ce693
sub ecx, edx
sub eax, ecx
mov ecx, 0x7a371b3f
xor ecx, 0x7f5210f1
xor eax, ecx
or eax, 0x80c86b2d
cmp eax, 0xd7e60b01
ja 0x14001e300
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov r8d, dword [0x140272ee0]
add r8d, dword [0x140272ee4]
mov eax, r8d
xor eax, 0xffffffff
xor r8d, 0xffffffff
or eax, r8d
mov r8d, 0x8248756e
xor r8d, 0xc0f03d60
mov r9d, 0x2c8eb14e
xor r9d, 0xd3714eb1
xor r8d, r9d
mov r9d, 0xffffffff
xor r9d, 0x42b8480e
or r8d, r9d
xor eax, 0xffffffff
mov r9d, 0x9043f52d
xor r9d, 0x6fbc0ad2
xor r8d, r9d
or eax, r8d
mov r8d, eax
and r8d, 0x44587bc2
xor r8d, 0xffffffff
mov r9d, 0xf9bc04fc
cld
add al, 0xbc
stc
xor r9d, 0xbde47f3e
add eax, r9d
add eax, ecx
add eax, 1
add eax, r8d
sub eax, 0xd420e3
mov qword [rdx], 0
mov qword [rcx], 0
cmp eax, 0x9853ab1c
add byte [rax - 0x39], cl
add al, byte [rax]
add byte [rax], al
add byte [rax - 0x39], cl
add dword [rax], eax
add byte [rax], al
add byte [0xd8558dda], bh
stosd dword [rdi], eax
push rbx
cwde
ja 0x14001e214
jmp 0x14001e2c9
add rsp, 0x138
pop rdi
pop rsi
ret
ja 0x14001e2f6
cld
fucomi st(1)
hlt
pop rsi
jmp 0x14001e2aa
cli
jae 0x14001e2bb
mov edx, 0xfff7c0e9
invalid
jle 0x14001e29e
mov esi, 0xfab8e9e1
invalid
jmp rdi
out 0x60, eax
or dword [rbx], 0xffffffe9
invalid
add dh, byte [rsi]
jbe 0x14001e292
jmp 0x14001e214