Function at 0x140048060
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x14004824d
mov rax, qword [rsp + 0x40]
mov rcx, 0xffffffffffffffff
xor rcx, 0xfffffffffffffff0
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x140048227
mov r8, qword [rsp + 0x38]
movabs rcx, 0x490d9b66afecfcd1
mov rax, r8
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x8822ba5c7bba11a8
movabs rdx, 0xc12f213ad456ed79
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
mov rdx, rax
xor rdx, 0xffffffffffffffff
and rcx, rdx
mov rdx, r8
or rdx, rdx
xor rdx, 0xffffffffffffffff
or rcx, rdx
movabs rdx, 0x6dc33f27fef30f78
movabs r9, 0x923cc0d8010cf087
xor rdx, r9
xor rcx, rdx
mov rdx, rax
or rdx, r8
movabs r8, 0x5f2766c2c1c81da7
movabs r9, 0xa0d8993d3e37e258
xor r8, r9
xor rdx, r8
or rcx, rdx
xor rcx, 0xffffffffffffffff
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14004816b
jmp 0x140048206
mov ecx, dword [0x1402743f8]
xor ecx, 0x9a54aace
mov eax, dword [0x1402743fc]
xor eax, 0x6d6ff887
and ecx, eax
xor ecx, 0xd46f4c59
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xff1baca2
mov edx, 0xffffffff
xor edx, 0xff1baca2
and ecx, edx
or eax, ecx
mov ecx, 0xc6fe5f23
xor ecx, 0xfd59a1e9
sub eax, ecx
cmp eax, 0xd88ddf35
jae 0x140048253
mov eax, dword [0x140274400]
mov ecx, 0xd12c2f29
xor ecx, 0x934ed143
xor eax, ecx
xor edx, edx
div dword [0x140274404]
and eax, 0x17fc5b71
and eax, 0x8b9d3447
mov ecx, 0x2341c2f3
xor edx, edx
div ecx
mov dword [rsp + 0x24], eax
call fcn.14000f24b
mov eax, dword [rsp + 0x24]
cmp eax, 0xf3783d35
ja 0x1400481bb
jmp 0x14004824d
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.1400200e0
jmp 0x14004824d
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 1
and cl, 1
call fcn.1400200e0
mov rcx, qword [rsp + 0x40]
call fcn.140020296
nop
add rsp, 0x48
ret
loope 0x14004828d
invalid
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x60], rax
mov r8, 0xffffffffffffffff
xor r8, 1
xor ecx, ecx
sub rcx, 1
sub r8, rcx
mov rcx, rdx
sub rcx, r8
mov qword [rsp + 0x68], rcx
movabs r8, 0x6606f74a3a2ac598
movabs r9, 0x99f908b5c5d53a67
xor r8, r9
xor rdx, r8
and rcx, rdx
mov qword [rsp + 0x70], rcx
cmp rax, 0
je 0x140048459
mov rax, qword [rsp + 0x70]
cmp rax, 0
jl 0x1400483c7
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rax]
mov rcx, r8
xor rcx, 0xffffffffffffffff
mov r9, 0xffffffffffffffff
movabs r10, 0xbfffffffffffffff
xor r9, r10
or rcx, r9
movabs r9, 0xbfffffffffffffff
and r8, r9
movabs r9, 0xf05957c77db7e1c6
movabs r10, 0xfa6a83882481e39
xor r9, r10
xor r8, r9
and rcx, r8
xor rcx, 0xffffffffffffffff
cmp rcx, rdx
mov qword [rsp + 0x38], rax
jge 0x1400484a3
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
movabs r8, 0x3284e898d3d78cb6
movabs rax, 0x3284e898d3d78cb7
xor r8, rax
movabs r9, 0xba0f2980cf7e4f43
movabs rax, 0xba0f2980cf7e4f4b
xor r9, rax
movabs rax, 0xbb7f0733d127fe12
movabs r10, 0xbb7f0733d127fe1a
xor rax, r10
mov qword [rsp + 0x20], rax
call fcn.1400265f0
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
mov qword [rsp + 0x38], rax
jmp 0x1400484a3
mov eax, dword [0x140274408]
mov ecx, dword [0x14027440c]
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
mov ecx, 0x6712c3cf
xor ecx, 0x8586c6b
imul eax, ecx
mov ecx, 0x8b229d8f
xor ecx, 0xf376c991
or eax, ecx
mov ecx, eax
xor ecx, 0x1024d593
mov edx, 0xeeeca267
xor edx, 0x11135d98
xor ecx, edx
or eax, 0x1024d593
and eax, ecx
cmp eax, 0xb52b7ca4
ja 0x1400484c9
mov eax, dword [0x140274410]
or eax, dword [0x140274414]
mov ecx, 0x45654cd8
xor edx, edx
div ecx
xor eax, 0x876cdf9d
add eax, 0xf5c492ac
mov dword [rsp + 0x34], eax
call fcn.14000f24b
mov eax, dword [rsp + 0x34]
cmp eax, 0x362242c1
je 0x14004841d
jmp 0x1400484c4
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r8d, 1
add byte [rax], al
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.1400265f0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x38], rax
jge 0x1400484a3
call fcn.14000f24b
jmp 0x1400484c4
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov qword [r8], r9
mov qword [rax + rcx*8 + 8], rdx
add rsp, 0x78
ret
jle 0x1400484d1
jle 0x140048467
jmp 0x14004841d
invalid