Function at 0x140030490
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0xf8
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xd0], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0xd8], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0xe0], rax
mov rcx, rdx
add rcx, 8
mov qword [rsp + 0xe8], rcx
mov rcx, qword [rdx + 8]
mov qword [rsp + 0xf0], rcx
cmp rax, rcx
je 0x140030fbb
mov rax, qword [rsp + 0xf0]
cmp rax, 0
je 0x140030529
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
movabs rcx, 0x4c2909fc597befbf
movabs rdx, 0xc2909fc597befbf
xor rcx, rdx
and rax, rcx
cmp rax, 0
je 0x140030820
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xe0]
cmp rcx, 0
mov qword [rsp + 0xc0], rax
je 0x1400306fa
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xe0]
mov rdx, qword [rcx]
mov r8, 0xffffffffffffffff
movabs rcx, 0x4000000000000000
xor r8, rcx
mov rcx, rdx
xor rcx, r8
and rcx, rdx
cmp rcx, 0
mov qword [rsp + 0xc0], rax
jne 0x1400306fa
mov eax, dword [0x1402a9468]
mov ecx, dword [0x1402a946c]
xor ecx, 0x563b7299
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0x49372daa
xor eax, 0xf143d955
add ecx, eax
mov eax, 0x4afb4190
xor eax, 0x4567c44d
sub ecx, eax
sub ecx, 0xb874f4ff
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xbdd9949e
or eax, edx
mov edx, 0x9bb34d90
xor edx, 0x266ad90e
mov r8d, 0x903f35e5
xor r8d, 0x6fc0ca1a
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0xbdd9949e
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, eax
xor ecx, 0xd14bbb3f
mov edx, 0xffffffff
xor edx, 0xd14bbb3f
and eax, edx
shl eax, 1
sub eax, ecx
cmp eax, 0x39683144
je 0x140030fc5
mov eax, dword [0x1402a9470]
mov ecx, dword [0x1402a9474]
and eax, eax
mov edx, 0xdfac0f31
xor edx, 0x2053f0ce
xor eax, edx
and ecx, ecx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0xd83bec62
xor edx, edx
div ecx
mov ecx, eax
add ecx, 0x4cdfdfc4
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x3d005025
mov edx, 0xffffffff
xor edx, 0x3d005025
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov dword [rsp + 0xb4], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0xe0]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
mov rcx, qword [rsp + 0xe8]
mov eax, dword [rsp + 0xb4]
mov rcx, qword [rcx]
mov qword [rsp + 0xb8], rcx
cmp eax, 0x1d90f543
jae 0x140030fc5
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xc0], rax
jmp 0x1400306fa
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xa8], rax
mov eax, dword [0x1402a9478]
sub eax, dword [0x1402a947c]
add eax, 0x8e962dc2
add eax, 0xdf4316f4
sub eax, 0x8e962dc2
add eax, 0x4fcfc754
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x96c76bae
add ecx, eax
mov eax, 0xbbe91153
xor eax, 0xbbe91153
sub eax, ecx
cmp eax, 0x374f26f3
jbe 0x140030fce
mov rdx, qword [rsp + 0xd8]
mov r8, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xd0]
mov r10, qword [rsp + 0xc8]
mov esi, dword [0x1402a9480]
add esi, dword [0x1402a9484]
mov r11d, 0xffffffff
xor r11d, 0x35dad8a6
mov ecx, esi
and ecx, r11d
mov eax, esi
or eax, r11d
xor eax, 0xffffffff
imul eax, ecx
mov ecx, esi
and ecx, 0x35dad8a6
or esi, 0x35dad8a6
imul esi, ecx
add esi, eax
add esi, 0x1557d831
mov eax, esi
xor eax, 0xffffffff
and eax, 0xd06baa1d
mov edi, 0xffffffff
xor edi, 0xd06baa1d
and esi, edi
mov ecx, 0xd416e1fb
xor ecx, 0xf8e2b671
mov r11d, 0x210fac77
xor r11d, 0xdef05388
xor ecx, r11d
and ecx, 0xd06baa1d
mov r11d, 0xa41c6d2b
xor r11d, 0x88e83aa1
and r11d, edi
or eax, esi
or ecx, r11d
xor eax, ecx
mov ecx, 0x1a1f99e1
xor ecx, 0xfb1115cd
mov r10, qword [r10]
mov qword [r9], r10
mov qword [rdx], r8
cmp eax, ecx
je 0x140030fce
jmp 0x140030fbb
mov rax, qword [rsp + 0xe0]
cmp rax, 0
je 0x140030916
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0xa0], rax
xor rax, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
movabs rcx, 0x4000000000000000
xor rdx, rcx
mov rcx, 0xffffffffffffffff
movabs r8, 0x949ffa6603afd9f0
xor rcx, r8
or rax, rdx
movabs rdx, 0x949ffa6603afd9f0
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
movabs rcx, 0x71fd5a76c6ef5ece
movabs rdx, 0x71fd5a76c6ef5ece
xor rcx, rdx
cmp rax, rcx
jne 0x140030916
mov rcx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xa0]
movabs r8, 0x85190c0881bd1f4c
movabs r9, 0x3ae6f3f77e42e0b3
xor r8, r9
and rdx, r8
mov rax, qword [rax]
cmp rdx, rax
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
jge 0x140030bf2
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0xe0]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rax]
mov qword [rsp + 0x88], rdx
movabs rax, 0x9d6587a5342aa23a
movabs rcx, 0x9d6587a5342aa23b
xor rax, rcx
mov rcx, rdx
add rcx, rax
mov rax, rdx
and rax, 0xffffffffffffffff
shl rax, 1
add rdx, 0xffffffffffffffff
sub rdx, rax
movabs rax, 0x54d9b875d12755eb
movabs r8, 0xab26478a2ed8aa14
xor rax, r8
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
jge 0x140030a56
mov eax, dword [0x1402a9488]
xor eax, 0xea16155f
imul eax, dword [0x1402a948c]
add eax, 0xaeff6a18
sub eax, 0xe922a5ad
mov edx, 0xa5805834
xor edx, 0xe104dda
mov ecx, 0x19130c1
xor ecx, 0xfe6ecf3e
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xab9015ee
add eax, edx
sub eax, ecx
cmp eax, 0xebcc859d
je 0x140030fd7
mov eax, dword [0x1402a9490]
xor eax, 0x6f7aa25a
xor edx, edx
div dword [0x1402a9494]
mov ecx, 0x258d4a7
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x31135326
mov r8d, 0xffffffff
xor r8d, 0x31135326
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x31135326
mov r8d, 0x31457c4f
xor r8d, 0x562f69
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x1efb51c2
mov dword [rsp + 0x84], eax
call fcn.14000ee80
mov eax, dword [rsp + 0x84]
cmp eax, 0xe989fa62
jae 0x1400309d4
jmp 0x140030fbb
mov rax, qword [rsp + 0x88]
mov rcx, rax
add rcx, 9
mov qword [rsp + 0x78], rcx
mov rdx, 0xfffffffffffffffe
sub rdx, rax
mov rax, rcx
xor rax, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
and rax, rcx
mov rcx, rdx
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
and rcx, rdx
movabs rdx, 0x361c8ea90971ee9f
movabs r8, 0xc9e37156f68e1160
xor rdx, r8
xor rax, rdx
movabs rdx, 0xfe3951ee647e08fb
movabs r8, 0x1c6ae119b81f704
xor rdx, r8
xor rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x140030adb
call fcn.14000ee80
jmp 0x140030fbb
mov rax, qword [rsp + 0x78]
movabs rcx, 0x15cb64d7393e0d0b
movabs rdx, 0x15cb64d7393e0d0b
xor rcx, rdx
cmp rax, rcx
jge 0x140030bb9
mov eax, dword [0x1402a9498]
mov ecx, 0x47a2f823
xor ecx, 0xba9f9b38
xor eax, ecx
mov edx, dword [0x1402a949c]
mov ecx, eax
xor ecx, edx
mov r8d, 0xe570afea
xor r8d, 0x1a8f5015
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
sub eax, 0x7b03f497
sub eax, 0x2403ed68
mov ecx, 0xd99e866b
xor ecx, 0xa29d72fc
add eax, ecx
imul eax, eax, 0x72e9441d
xor ecx, ecx
sub ecx, 0x9bb81490
add eax, ecx
cmp eax, 0xbad57dbc
jb 0x140030fe0
mov eax, dword [0x1402a94a0]
imul eax, dword [0x1402a94a4]
imul eax, eax, 0x9c0f71e1
or eax, 0xe49cb9d
mov ecx, 0xd71a9f26
xor edx, edx
div ecx
mov dword [rsp + 0x74], eax
mov eax, 0x74e65dcb
xor eax, 0xe53d1920
mov dword [rsp + 0x70], eax
mov rcx, r8
mov rdx, r8
call fcn.140018506
mov ecx, dword [rsp + 0x70]
mov eax, dword [rsp + 0x74]
cmp eax, ecx
je 0x140030b66
jmp 0x140030fbb
mov rcx, qword [rsp + 0x78]
call fcn.1400149ad
mov rdx, qword [rsp + 0xd8]
mov rcx, rax
mov rax, qword [rsp + 0xc8]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x58], r8
mov qword [rcx], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
movabs rdx, 0xebbfe2a8cc8d6aa3
movabs rax, 0xebbfe2a8cc8d6aa2
xor rdx, rax
mov rax, rcx
add rax, rdx
mov qword [rsp + 0x68], rax
mov rdx, rcx
or rdx, rdx
xor rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
or r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rdx, r8
or rcx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
or rdx, rcx
xor rdx, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
movabs rcx, 0x90b6c82ef8dc2465
movabs r8, 0xc45c5c8a33f95e5e
xor rcx, r8
movabs r8, 0xe1701cdc90638ccd
movabs r9, 0x1e8fe3236f9c7332
xor r8, r9
xor rcx, r8
or rax, rdx
movabs rdx, 0x54ea94a4cb257a3b
or rcx, rdx
movabs rdx, 0x5ae9839943cc8034
movabs r8, 0xa5167c66bc337fcb
xor rdx, r8
xor rax, rdx
and rax, rcx
cmp rax, 0
jge 0x140030cf1
call fcn.14000ee80
jmp 0x140030fbb
mov rax, qword [rsp + 0x68]
movabs rcx, 0x7217dc6a76c47331
movabs rdx, 0x7217dc6a76c47331
xor rcx, rdx
cmp rax, rcx
jge 0x140030d26
mov rcx, r8
mov rdx, r8
call fcn.140018506
jmp 0x140030fbb
mov ecx, dword [0x1402a94a8]
xor ecx, 0xb49f8af1
mov r8d, dword [0x1402a94ac]
mov eax, 0x64eafa9c
xor eax, 0x9b150563
mov r9d, r8d
xor r9d, eax
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
mov r9d, 0x5469dcf2
xor r9d, 0xab96230d
xor eax, r9d
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov edx, 0x284f822a
xor edx, 0x2f82f9db
mov eax, 0xdfe81606
xor eax, 0x2017e9f9
xor edx, eax
mov eax, ecx
and eax, edx
mov edx, ecx
xor edx, 0x7cd7bf1
add ecx, edx
sub ecx, eax
mov eax, ecx
or eax, eax
mov edx, 0x56a8ba7
xor edx, 0xfa957458
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x6f3d78c6
mov r8d, 0xffffffff
xor r8d, 0x6f3d78c6
and edx, r8d
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
mov edx, 0x50f5fbcc
xor edx, 0xaf0a0433
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x6f3d78c6
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0xe3b22c06
xor ecx, 0x6c55dc53
mov edx, eax
xor edx, ecx
xor edx, 0xffffffff
mov ecx, 0xc0ecfab9
xor ecx, 0x4f0b0aec
and ecx, edx
shl ecx, 1
sub ecx, 0x8fe7f055
sub eax, ecx
cmp eax, 0x13024bdd
je 0x140030fe9
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xe8]
mov r8, qword [rsp + 0x58]
mov eax, dword [0x1402a94b0]
xor eax, 0xc61fbec7
xor eax, dword [0x1402a94b4]
mov r9d, eax
and r9d, 0x3e47a0e8
shl r9d, 1
add eax, 0x3e47a0e8
sub eax, r9d
xor eax, 0xb34fe5f6
sub eax, 0x9bff7803
add r8, 8
mov qword [rsp + 0x40], r8
mov rdx, qword [rdx]
add rdx, 8
mov qword [rsp + 0x48], rdx
cmp rcx, 0
sete cl
mov byte [rsp + 0x57], cl
cmp eax, 0x8767d9aa
jbe 0x140030e22
mov cl, byte [rsp + 0x57]
xor eax, eax
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x140030fbb
jmp 0x140030ea9
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1402a94b8]
imul eax, dword [0x1402a94bc]
mov ecx, 0x723e588
xor ecx, 0xc58ee718
imul eax, ecx
mov ecx, 0xa7c71bb
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xfa2afc66
xor edx, 0x5d50399
mov eax, ecx
xor eax, edx
and eax, 0xce2ef24a
mov edx, 0xffffffff
xor edx, 0xce2ef24a
and ecx, edx
or eax, ecx
cmp eax, 0xe6c2982d
jae 0x140030ff2
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov eax, dword [0x1402a94c0]
mov edx, dword [0x1402a94c4]
add eax, 0xbe3c2900
sub eax, edx
sub eax, 0xbe3c2900
mov edx, eax
add edx, 1
xor eax, 0xffffffff
or eax, 0xec3213ff
add eax, edx
and eax, 0xfa77c4cd
mov r10d, 0xeb9b8c2a
xor edx, edx
div r10d
mov rdx, qword [rsp + 0x60]
mov r9b, byte [r9 + rcx]
mov byte [r8 + rcx], r9b
mov r9, rcx
and r9, 1
shl r9, 1
movabs r10, 0x76b9774a9e3b2e4e
movabs r8, 0x76b9774a9e3b2e4f
xor r10, r8
mov r8, rcx
xor r8, r10
add r8, r9
mov qword [rsp + 0x20], r8
cmp rcx, rdx
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xfd001170
je 0x140030ff2
mov rax, qword [rsp + 0x20]
mov cl, byte [rsp + 0x2f]
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x140030fbb
jmp 0x140030ea9
add rsp, 0xf8
pop rdi
pop rsi
ret
in al, 0xe5
or dword [rcx], 0xffffffe9
outsb dx, byte [rsi]
idiv bh
jmp [rsi]
xchg esp, eax
jmp 0x14003074e
and ecx, ecx
xlatb
pop rax
jmp 0x1400309d4
jmp [rsi - 0x16e44e47]
scasb al, byte [rdi]
mov ecx, 0x7de91bb1
sti
invalid
jno 0x140030fdf
xchg esp, eax
sbb cl, ch
xor dh, bh
invalid
add al, 0x99
sti
cmp eax, 0xffff0ce9
invalid