Function at 0x402420
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00419900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004198e0]
test rbx, rbx
je 0x402474
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40246b
test rsi, rsi
je 0x40246b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402450
lea rcx, [0x00419900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4027b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00411490]
mov rdx, rcx
cmp word [r8], 0x5a4d
jne 0x40281d
mov rcx, r8
call fcn.00402690
test eax, eax
je 0x40281d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40281d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402814
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40281f
add rax, 0x28
cmp rax, r9
jne 0x402800
xor eax, eax
add rsp, 0x28
ret

Function at 0x402db0
Capabilities:
Encode data using xor

Disassembly:
mov eax, r9d
shr eax, 4
and r9d, 0xf
jne 0x402e95
test eax, eax
je 0x402e92
push rbp
sub eax, 1
shl rax, 4
mov rbp, rsp
push r15
mov r15, r8
push r14
mov r14, rcx
push r13
mov r13, rdx
push r12
push rdi
lea rdi, [r8 + rax + 0x10]
push rsi
lea rsi, [rcx + 0x1e4]
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
lea rbx, [rsp + 0x20]
lea r12, [rsp + 0x30]
mov rdx, rsi
mov rax, rbx
nop dword [rax + rax]
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
lea rcx, [rsp + 0x30]
cmp rax, rcx
jne 0x402e10
xor eax, eax
nop word [rax + rax]
movzx edx, byte [r13 + rax]
mov byte [r14 + rax + 0x1e4], dl
add rax, 1
cmp rax, 0x10
jne 0x402e30
mov rdx, rsi
mov r8, r15
mov rcx, r14
call fcn.00403090
mov rdx, rbx
mov rax, r15
nop dword [rax]
movzx ecx, byte [rdx]
add rdx, 1
xor byte [rax], cl
add rax, 1
cmp r12, rdx
jne 0x402e60
add r15, 0x10
add r13, 0x10
cmp r15, rdi
jne 0x402e05
lea rsp, [rbp - 0x38]
xor eax, eax
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor eax, eax
ret
mov eax, 0xffffffff
ret

Function at 0x402f00
Capabilities:
Encode data using xor

Disassembly:
mov eax, r9d
shr eax, 4
and r9d, 0xf
jne 0x402f97
test eax, eax
je 0x402f94
push r12
sub eax, 1
mov r12, r8
push rbp
shl rax, 4
push rdi
lea rbp, [rdx + rax + 0x10]
lea rdi, [rcx + 0x1e4]
push rsi
mov rsi, rdx
push rbx
mov rbx, rcx
sub rsp, 0x20
nop
xor eax, eax
movzx edx, byte [rsi + rax]
xor byte [rbx + rax + 0x1e4], dl
add rax, 1
cmp rax, 0x10
jne 0x402f42
mov rdx, rdi
mov rcx, rbx
call fcn.004037a0
xor eax, eax
movzx edx, byte [rbx + rax + 0x1e4]
mov byte [r12 + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x402f64
add rsi, 0x10
add r12, 0x10
cmp rsi, rbp
jne 0x402f40
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
ret
mov eax, 0xffffffff
ret