Function at 0x1400220a0
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], rcx
mov ecx, dword [0x1402a8e68]
or ecx, dword [0x1402a8e6c]
sub ecx, 0xab9b608c
add ecx, 0xd7f016c9
sub ecx, 0xe2296a27
sub ecx, 0xd7f016c9
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x4ca0ddeb
mov edx, 0xffffffff
xor edx, 0x4ca0ddeb
and ecx, edx
or eax, ecx
cmp eax, 0x8eccf32d
jae 0x14002283d
mov rcx, qword [rsp + 0x78]
mov eax, dword [0x1402a8e70]
mov r8d, dword [0x1402a8e74]
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
imul eax, eax, 0x4cb15622
and eax, 0x5239379a
mov r8d, 0xa0a50636
xor r8d, 0xda16d3e5
xor edx, edx
div r8d
movabs rdx, 0x9ed42bd16a80f08c
movabs r8, 0x9ed42bd16a80f09d
xor rdx, r8
cmp rcx, rdx
setl cl
mov byte [rsp + 0x77], cl
cmp eax, 0x9b680e8d
jae 0x1400220fc
mov al, byte [rsp + 0x77]
test al, 1
jne 0x140022177
jmp 0x1400221a1
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
add rcx, 0x68
call fcn.140013e80
mov qword [rsp + 0x68], rax
jmp 0x1400226d5
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
xor eax, eax
sub rax, r8
xor ecx, ecx
sub rcx, rdx
add rax, rcx
movabs r9, 0xf2a12368dcdda042
movabs rcx, 0xf2a12368dcdda042
xor r9, rcx
sub r9, rax
mov qword [rsp + 0x60], r9
mov rax, r9
xor rax, 0xffffffffffffffff
mov rcx, r9
xor rcx, 0xffffffffffffffff
and rax, rcx
mov rcx, rdx
or rcx, rcx
xor rcx, 0xffffffffffffffff
or rax, rcx
movabs rcx, 0x825070ef9cb34513
movabs r10, 0x7daf8f10634cbaec
xor rcx, r10
xor rax, rcx
mov rcx, r9
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
and rcx, rdx
or rax, rcx
movabs rcx, 0x81d3bccf78d1f157
movabs rdx, 0x7e2c4330872e0ea8
xor rcx, rdx
xor rax, rcx
movabs rcx, 0x9423a284d7b041f8
movabs rdx, 0x6bdc5d7b284fbe07
xor rcx, rdx
mov rdx, r9
xor rdx, rcx
movabs rcx, 0xe7027a07ccea4f56
movabs r10, 0xed969c67c961247
xor rcx, r10
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0xe9db13c1b07c5d11
xor r10, rdx
and r9, r10
movabs r11, 0x6b5731c8b9b9ee1a
movabs rdx, 0x94a8ce37464611e5
xor r11, rdx
mov rdx, r8
xor rdx, r11
movabs r11, 0xe9db13c1b07c5d11
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x1400222d8
call fcn.14000ee80
jmp 0x1400226d5
mov rdx, qword [rsp + 0x60]
mov rax, rdx
add rax, 0xffffffffffffffff
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xece2040b26a89a5e
movabs r8, 0xece2040b26a89a5e
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg dl
mov al, dl
xor al, 0xff
xor dl, 0xff
and al, dl
or cl, cl
xor edx, edx
xor dl, 1
xor cl, dl
or al, cl
xor al, 0xff
test al, 1
jne 0x140022331
jmp 0x14002233b
call fcn.14000ee80
jmp 0x1400226d5
mov rdx, qword [rsp + 0x60]
mov rax, rdx
add rax, 1
mov qword [rsp + 0x58], rax
movabs rcx, 0x4e9dd965992d2605
movabs r8, 0x4e9dd965992d2605
xor rcx, r8
sub rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x14002237d
call fcn.14000ee80
jmp 0x1400226d5
mov rax, qword [rsp + 0x58]
cmp rax, 0
jge 0x14002239c
mov rcx, r8
mov rdx, r8
call fcn.140018506
jmp 0x1400226d5
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
add rcx, 0x68
call fcn.140013e80
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rcx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor edx, edx
sub rdx, 1
sub rcx, rdx
mov rdx, r8
sub rdx, rcx
and rdx, rax
mov rcx, r8
xor rcx, 0xffffffffffffffff
and rcx, rdx
movabs rax, 0x68dc2592ae3962cf
movabs r9, 0x9723da6d51c69d30
xor rax, r9
mov r9, rdx
xor r9, rax
mov rax, r8
and rax, r9
sub rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, r8
cmp rcx, 0
setl cl
xor rax, rdx
cmp rax, 0xffffffffffffffff
setg dl
mov al, cl
xor al, 0xff
mov r8b, dl
xor r8b, 0xff
or al, r8b
xor cl, 0xff
xor dl, 0xff
or cl, dl
and al, cl
xor al, 0xff
test al, 1
jne 0x140022453
jmp 0x14002245d
call fcn.14000ee80
jmp 0x1400226d5
mov rax, qword [rsp + 0x50]
xor ecx, ecx
mov edx, ecx
sub rdx, rax
movabs rcx, 0x5a87fbfb641660cc
movabs r8, 0x5a87fbfb641660cc
xor rcx, r8
movabs r8, 0x2cc6d34620872e22
movabs r9, 0xd3392cb9df78d1dc
xor r8, r9
sub rcx, r8
add rdx, rcx
xor ecx, ecx
sub rcx, rdx
mov qword [rsp + 0x40], rcx
xor rcx, rax
movabs rdx, 0x65740828afeaec76
movabs r8, 0x65740828afeaec76
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 1
setg al
and al, cl
test al, 1
jne 0x1400224dd
jmp 0x140022593
mov eax, dword [0x1402a8e78]
and eax, dword [0x1402a8e7c]
mov ecx, 0x3a5905e6
xor edx, edx
div ecx
mov ecx, 0x4f1a7b35
xor ecx, 0x96e03d73
sub eax, ecx
xor eax, 0x7138de0b
cmp eax, 0x4fe40f1a
je 0x140022846
mov eax, dword [0x1402a8e80]
sub eax, dword [0x1402a8e84]
mov ecx, eax
xor ecx, 0x83c114ea
xor ecx, 0xffffffff
mov edx, 0xdaf98742
xor edx, 0x593893a8
and edx, ecx
mov ecx, 0xd57dd7f7
xor ecx, 0xd57dd7f5
imul ecx, edx
sub ecx, 0x83c114ea
sub eax, ecx
mov ecx, 0x29f8f00d
xor edx, edx
div ecx
mov edx, 0x9574e5c5
xor edx, 0x74ebfd15
mov ecx, eax
and ecx, edx
mov edx, 0xd76937fc
xor edx, 0xd76937fe
imul ecx, edx
xor eax, 0xe19f18d0
add eax, ecx
mov dword [rsp + 0x3c], eax
call fcn.14000ee80
mov eax, dword [rsp + 0x3c]
cmp eax, 0xfa972aa8
je 0x140022846
jmp 0x1400226d5
mov ecx, dword [0x1402a8e88]
mov edx, dword [0x1402a8e8c]
mov eax, ecx
and eax, edx
shl eax, 1
add ecx, edx
sub ecx, eax
mov edx, ecx
and edx, 0x74ac8221
mov eax, 0xbf007ace
xor eax, 0xbf007acc
imul eax, edx
mov edx, 0x705d6abb
xor edx, 0x4f1e89a
add ecx, edx
sub ecx, eax
mov edx, 0x6529b7f
xor edx, 0xf9ad6480
mov eax, ecx
xor eax, edx
mov edx, 0xf4e7376d
xor edx, 0x867ee91a
mov r8d, 0xb314690c
xor r8d, 0x4ceb96f3
xor edx, r8d
and eax, edx
mov edx, 0xcf563236
xor edx, 0xbdcfec41
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x6585ec45
xor ecx, 0x9a7a13ba
xor eax, ecx
imul eax, eax, 0xb05781fc
cmp eax, 0x9d91f74a
jae 0x14002284f
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x40]
mov eax, dword [0x1402a8e90]
xor eax, 0xea677ed3
mov r10d, dword [0x1402a8e94]
mov r9d, eax
xor r9d, r10d
xor r10d, 0xffffffff
and eax, r10d
shl eax, 1
sub eax, r9d
mov r9d, 0x9e5c9619
xor r9d, 0x85e2c47c
or eax, r9d
and eax, 0x94cd1c52
mov r9d, 0x8657f77d
xor r9d, 0xfa4da820
imul eax, r9d
mov r9, r8
and r9, rdx
movabs r10, 0x2c1d7406ee8a6eb8
movabs r11, 0x2c1d7406ee8a6eba
xor r10, r11
imul r9, r10
xor r8, rdx
add r8, r9
mov r9w, cx
mov word [r8], r9w
add rcx, rdx
mov qword [rsp + 0x30], rcx
cmp eax, 0xaec6da57
je 0x14002284f
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
jmp 0x1400226d5
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r10d, dword [0x1402a8e98]
mov r9d, dword [0x1402a8e9c]
mov ecx, 0x25d9fc86
xor ecx, 0xda260379
mov eax, r10d
xor eax, ecx
mov ecx, 0xfb5933c2
xor ecx, 0x4a6cc3d
mov edx, r9d
xor edx, ecx
mov ecx, 0x4f4eb803
xor ecx, 0x20e91632
mov r8d, 0xa0dad3c0
xor r8d, 0x5f252c3f
xor ecx, r8d
mov r11d, eax
and r11d, 0x6fa7ae31
and r10d, ecx
mov r8d, edx
and r8d, 0x6fa7ae31
and r9d, ecx
or r11d, r10d
or r8d, r9d
xor r11d, r8d
or eax, edx
xor eax, 0xffffffff
or ecx, 0x6fa7ae31
and eax, ecx
or r11d, eax
mov ecx, r11d
xor ecx, 0x8535c833
mov eax, 0xdf451a17
xor eax, 0x20bae5e8
xor ecx, eax
and ecx, 0x8535c833
mov eax, 0x11bd124b
xor eax, 0x11bd1249
imul eax, ecx
sub eax, 0x8535c833
sub r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x2e560bfb
mov edx, 0xffffffff
xor edx, 0xbe151e00
mov eax, ecx
and eax, 0xbe151e00
and r11d, edx
mov r9d, r8d
and r9d, 0xbe151e00
mov r10d, edx
and r10d, 0x2e560bfb
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xbe151e00
and ecx, edx
or eax, ecx
or eax, 0xd8ea42c4
cmp eax, 0x678bee05
je 0x140022858
mov eax, dword [0x1402a8ea0]
xor eax, 0x69620de7
mov ecx, dword [str.TPNZ]
add eax, 0xa9eee21e
add eax, ecx
sub eax, 0xa9eee21e
sub eax, 0xbae21b00
mov ecx, 0x412bec89
xor ecx, 0x2ba6f14a
add eax, ecx
imul eax, eax, 0xc16c5ad6
cmp eax, 0x1ede945
jbe 0x140022858
mov rax, qword [rsp + 0x28]
add rsp, 0x88
ret
add byte [rax], al
add bl, al
xor eax, 0xe9f25faf
mov dh, 0xf8
invalid
mov edx, dword [rdx - 0x3f16998b]
cld
invalid
xchg edx, eax
in eax, 0xeb
mov dl, 0xe9
sar ch, cl
invalid
jle 0x140022839
enter 0xffffffffffffe906, 0xffffffffffffff8f
invalid