Function at 0x478990
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x74
mov eax, dword [0x4c6060]
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0xa4]
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x20]
lea edx, [edi*4 + 0x10]
and edx, 0xfffffff0
lea ebx, [ecx + edx]
cmp ebx, dword [eax + 0x2c]
ja 0x4789d8
mov dword [eax + 0x20], ebx
mov eax, ecx
jmp 0x4789e2
mov ebx, dword [eax]
push edx
mov edx, dword [ebx + 0x14]
mov ecx, eax
call edx
mov ebx, dword [esi + 0xa4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], eax
mov eax, dword [0x4c6060]
or edi, 0x80000000
push eax
mov dword [esp + 0x4c], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [eax + 0x20]
mov ecx, ebx
sar ecx, 5
lea edx, [ecx*4 + 0x30]
and edx, 0xfffffff0
lea ecx, [edi + edx]
cmp ecx, dword [eax + 0x2c]
ja 0x478a2d
mov dword [eax + 0x20], ecx
mov dword [esp + 0x1c], edi
jmp 0x478a3d
mov edi, dword [eax]
push edx
mov edx, dword [edi + 0x14]
mov ecx, eax
call edx
mov dword [esp + 0x1c], eax
mov edi, eax
sar ebx, 7
fldz
mov ecx, edi
js 0x478a5b
mov eax, ecx
fst dword [eax]
add ecx, 0x10
sub ebx, 1
fst dword [eax + 4]
fst dword [eax + 8]
fst dword [eax + 0xc]
jns 0x478a46
mov ecx, dword [ebp + 8]
fld dword [esi + 0x40]
fadd dword [ecx]
fstp dword [esp + 0x30]
fld dword [esi + 0x44]
fadd dword [ecx + 4]
fstp dword [esp + 0x34]
fld dword [esi + 0x48]
fadd dword [ecx + 8]
fstp dword [esp + 0x38]
fld dword [esi + 0x60]
fmul dword [esp + 0x30]
fstp dword [esp + 0x30]
fld dword [esp + 0x34]
fmul dword [esi + 0x64]
fstp dword [esp + 0x34]
fld dword [esi + 0x68]
fmul dword [esp + 0x38]
fstp dword [esp + 0x38]
fld dword [esp + 0x30]
fld dword [0x4c59c0]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
je 0x478ab5
fst dword [esp + 0x30]
fld dword [esp + 0x34]
fld dword [0x4c59c4]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
je 0x478ace
fst dword [esp + 0x34]
fld dword [esp + 0x38]
fld dword [0x4c59c8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
je 0x478ae7
fst dword [esp + 0x38]
fxch st(3)
fcom dword [esp + 0x30]
fnstsw ax
test ah, 5
jnp 0x478af8
fst dword [esp + 0x30]
fcom dword [esp + 0x34]
fnstsw ax
test ah, 5
jnp 0x478b07
fst dword [esp + 0x34]
fcom dword [esp + 0x38]
fnstsw ax
test ah, 5
jnp 0x478b16
fst dword [esp + 0x38]
fld dword [esp + 0x30]
fld qword [0x4b9f08]
fadd st(1), st(0)
fxch st(1)
fstp dword [esp + 0x30]
mov eax, dword [esp + 0x30]
fld dword [esp + 0x34]
shr eax, 7
fadd st(1)
mov word [esp + 0x50], ax
fstp dword [esp + 0x34]
mov edx, dword [esp + 0x34]
fld dword [esp + 0x38]
shr edx, 7
fadd st(1)
mov word [esp + 0x52], dx
fstp dword [esp + 0x38]
mov eax, dword [esp + 0x38]
fld dword [ecx + 0x10]
shr eax, 7
fadd dword [esi + 0x50]
mov word [esp + 0x54], ax
fstp dword [esp + 0x30]
fld dword [ecx + 0x14]
fadd dword [esi + 0x54]
fstp dword [esp + 0x34]
fld dword [ecx + 0x18]
fadd dword [esi + 0x58]
fstp dword [esp + 0x38]
fld dword [esi + 0x60]
fmul dword [esp + 0x30]
fstp dword [esp + 0x30]
fld dword [esp + 0x34]
fmul dword [esi + 0x64]
fstp dword [esp + 0x34]
fld dword [esi + 0x68]
fmul dword [esp + 0x38]
fstp dword [esp + 0x38]
fld dword [esp + 0x30]
fcomp st(4)
fnstsw ax
test ah, 5
jnp 0x478bb4
fxch st(3)
fstp dword [esp + 0x30]
jmp 0x478bb6
fstp st(3)
fld dword [esp + 0x34]
fcomp st(2)
fnstsw ax
test ah, 5
jnp 0x478bcb
fxch st(1)
fstp dword [esp + 0x34]
jmp 0x478bcd
fstp st(1)
fld dword [esp + 0x38]
fcomp st(3)
fnstsw ax
test ah, 5
jnp 0x478be2
fxch st(2)
fstp dword [esp + 0x38]
jmp 0x478be4
fstp st(2)
fxch st(1)
fcom dword [esp + 0x30]
fnstsw ax
test ah, 5
jnp 0x478bf5
fst dword [esp + 0x30]
fcom dword [esp + 0x34]
fnstsw ax
test ah, 5
jnp 0x478c04
fst dword [esp + 0x34]
fcom dword [esp + 0x38]
fnstsw ax
test ah, 5
jnp 0x478c15
fstp dword [esp + 0x38]
jmp 0x478c17
fstp st(0)
fld dword [esp + 0x30]
mov ebx, dword [esp + 0x50]
fadd st(1)
and ebx, 0xfffe
mov dword [esp + 0x60], ebx
mov ebx, dword [esp + 0x52]
fstp dword [esp + 0x30]
mov eax, dword [esp + 0x30]
fld dword [esp + 0x34]
and ebx, 0xfffe
fadd st(1)
shr eax, 7
mov dword [esp + 0x64], ebx
mov ebx, dword [esp + 0x54]
fstp dword [esp + 0x34]
mov ecx, dword [esp + 0x34]
and ebx, 0xfffe
fadd dword [esp + 0x38]
shr ecx, 7
mov dword [esp + 0x68], ebx
movzx ebx, ax
movzx eax, cx
fstp dword [esp + 0x38]
mov edx, dword [esp + 0x38]
or eax, 1
mov dword [esp + 0x74], eax
shr edx, 7
movzx eax, dx
or eax, 1
mov dword [esp + 0x78], eax
mov eax, dword [esi + 0xac]
or ebx, 1
add eax, 4
cmp dword [esi + 0xd0], 0
mov dword [esp + 0x70], ebx
je 0x478d86
mov edx, dword [esp + 0x60]
mov ecx, 0x10
sub ecx, dword [esi + 0xd4]
sar edx, cl
test edx, edx
jle 0x478d86
mov ecx, dword [esi + 0xd8]
shl edx, 4
lea ebx, [edx + ecx - 0x10]
movzx ecx, word [ebx]
mov eax, ecx
and ecx, 0x1f
mov edx, 1
shl edx, cl
sar eax, 5
mov dword [esp + 0x28], ebx
xor dword [edi + eax*4], edx
mov edx, dword [ebx + 8]
sub edx, 1
mov eax, dword [ebx + 4]
mov dword [esp + 0x18], eax
js 0x478d1b
mov ecx, dword [esp + 0x18]
movzx ecx, word [ecx]
add dword [esp + 0x18], 2
mov eax, ecx
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
sar eax, 5
xor dword [edi + eax*4], ebx
sub edx, 1
jns 0x478cf4
mov ebx, dword [esp + 0x28]
movzx eax, word [ebx]
mov ecx, dword [esi + 0xac]
shl eax, 4
add eax, dword [esi + 0xa0]
movzx edx, word [eax + 8]
movzx ebx, word [eax + 0xa]
lea edx, [ecx + edx*4 + 4]
lea ecx, [ecx + ebx*4]
cmp edx, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
jae 0x478d74
test byte [edx], 1
jne 0x478d6d
movzx ecx, word [edx + 2]
mov eax, ecx
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
mov ecx, dword [esp + 0x28]
sar eax, 5
not ebx
and dword [edi + eax*4], ebx
mov eax, dword [esp + 0x24]
add edx, 4
cmp edx, ecx
jb 0x478d48
movzx eax, word [eax + 8]
mov ecx, dword [esi + 0xac]
mov ebx, dword [esp + 0x70]
lea eax, [ecx + eax*4 + 4]
movzx edx, word [eax]
cmp edx, dword [esp + 0x60]
jae 0x478db5
movzx ecx, word [eax + 2]
mov edx, ecx
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
sar edx, 5
add eax, 4
xor dword [edi + edx*4], ebx
movzx ecx, word [eax]
cmp ecx, dword [esp + 0x60]
jb 0x478d8f
mov ebx, dword [esp + 0x70]
movzx ecx, word [eax]
movzx edx, cx
cmp edx, ebx
jae 0x478ded
nop
test cl, 1
jne 0x478ddf
movzx ecx, word [eax + 2]
mov edx, ecx
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
sar edx, 5
xor dword [edi + edx*4], ebx
mov ebx, dword [esp + 0x70]
movzx ecx, word [eax + 4]
add eax, 4
movzx edx, cx
cmp edx, ebx
jb 0x478dc0
mov edi, dword [esi + 0xb8]
mov eax, dword [esi + 0xbc]
mov ecx, dword [esp + 0x64]
add esi, 0xb8
push ecx
lea ebx, [edi + eax*4 - 8]
lea eax, [edi + 4]
push ebx
push eax
mov ecx, esi
call fcn.00471f40
mov edx, dword [esp + 0x74]
sub eax, edi
sar eax, 2
push edx
mov word [esp + 0x34], ax
push ebx
lea eax, [edi + 4]
push eax
mov ecx, esi
call fcn.00471f40
mov esi, dword [esp + 0x20]
mov edx, dword [esi + 0xc8]
mov ecx, 0xfffffffc
sub ecx, edi
mov edi, dword [esi + 0xc4]
add eax, ecx
mov ecx, dword [esp + 0x68]
add esi, 0xc4
sar eax, 2
push ecx
lea ebx, [edi + edx*4 - 8]
mov word [esp + 0x38], ax
lea eax, [edi + 4]
push ebx
push eax
mov ecx, esi
call fcn.00471f40
mov edx, dword [esp + 0x78]
sub eax, edi
sar eax, 2
push edx
mov word [esp + 0x36], ax
push ebx
lea eax, [edi + 4]
push eax
mov ecx, esi
call fcn.00471f40
mov esi, dword [esp + 0x1c]
mov ecx, 0xfffffffc
sub ecx, edi
mov edi, dword [esp + 0x20]
add eax, ecx
mov ecx, dword [edi + 0xa4]
sar ecx, 5
sar eax, 2
lea ecx, [esi + ecx*4 + 4]
cmp esi, ecx
mov edx, esi
mov word [esp + 0x36], ax
mov eax, dword [edi + 0xa0]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
jae 0x478ffe
mov edi, dword [esp + 0x30]
add eax, 0x24
mov dword [esp + 0x24], eax
nop
mov ebx, dword [edx]
test ebx, ebx
mov dword [esp + 0x18], ebx
je 0x478fde
mov edi, edi
test bl, 0xf
je 0x478fba
test bl, 1
je 0x478f21
mov esi, dword [esp + 0x34]
mov ecx, dword [eax - 0x20]
sub esi, dword [eax - 0x24]
lea edx, [eax - 0x24]
sub ecx, edi
or ecx, esi
test ecx, 0x80008000
jne 0x478f21
test byte [eax - 0x18], 1
jne 0x478f21
mov ecx, dword [esp + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + ecx*4], edx
add ecx, 1
mov dword [esp + 0x44], ecx
jmp 0x478f29
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
test bl, 2
je 0x478f57
mov ebx, dword [eax - 0x10]
sub ebx, edi
mov edi, dword [esp + 0x34]
sub edi, dword [eax - 0x14]
lea edx, [eax - 0x14]
or ebx, edi
test ebx, 0x80008000
jne 0x478f57
test byte [eax - 8], 1
jne 0x478f57
mov dword [esi + ecx*4], edx
add ecx, 1
mov dword [esp + 0x44], ecx
test byte [esp + 0x18], 4
je 0x478f88
mov edi, dword [esp + 0x34]
mov ebx, dword [eax]
sub edi, dword [eax - 4]
sub ebx, dword [esp + 0x30]
lea edx, [eax - 4]
or edi, ebx
test edi, 0x80008000
jne 0x478f88
test byte [eax + 8], 1
jne 0x478f88
mov dword [esi + ecx*4], edx
add ecx, 1
mov dword [esp + 0x44], ecx
test byte [esp + 0x18], 8
je 0x478fba
mov edi, dword [eax + 0x10]
mov ebx, dword [esp + 0x34]
sub edi, dword [esp + 0x30]
sub ebx, dword [eax + 0xc]
lea edx, [eax + 0xc]
or edi, ebx
test edi, 0x80008000
jne 0x478fba
test byte [eax + 0x18], 1
jne 0x478fba
mov dword [esi + ecx*4], edx
add ecx, 1
mov dword [esp + 0x44], ecx
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x30]
add eax, 0x40
shr ebx, 4
mov dword [esp + 0x18], ebx
jne 0x478ee0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
add edx, 4
add eax, 0x200
cmp edx, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
jb 0x478ed0
mov edi, dword [esp + 0x20]
mov edx, dword [0x4c6060]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edx
call ebx
cmp esi, dword [eax + 0x28]
mov dword [eax + 0x20], esi
jne 0x47901f
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
push esi
call eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [esp + 0x44]
push edx
mov ecx, edi
call fcn.00477920
mov eax, dword [0x4c6060]
push eax
call ebx
mov edi, dword [esp + 0x14]
cmp edi, dword [eax + 0x28]
mov dword [eax + 0x20], edi
jne 0x47904d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
push edi
call eax
mov esi, dword [esp + 0x48]
test esi, esi
js 0x479073
mov ecx, dword [0x4c6060]
push ecx
call ebx
and esi, 0x3fffffff
add esi, esi
push 0x17
add esi, esi
push esi
push edi
mov ecx, eax
call fcn.004023e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8