Function at 0x100135660
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1004946a0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x88], rdx
lea r13, [rcx + 0x18]
mov r14, qword [r13]
mov eax, 0xfffffff
lea r15, [0x100000000]
lea r11, [0x100000000]
mov qword [rsp + 0xa0], rcx
mov edx, dword [r14 + 1]
mov ebp, dword [r14 + 5]
and rbp, rax
mov qword [rsp + 0x90], r13
shr rdx, 1
and rdx, rax
add rbp, r15
mov eax, dword [0x1002f3aa4]
mov rcx, rax
mov qword [rsp + 0xa8], rbp
lea rsi, [rax + rdx - 1]
xor edx, edx
mov rax, rsi
div rcx
mov eax, dword [0x1002f3aa4]
sub rsi, rdx
mov r10d, dword [0x10005e244]
mov eax, dword [0x1002f3aa4]
mov eax, dword [0x10005e244]
test eax, eax
je 0x1001357a3
xor r8d, r8d
xor eax, eax
mov edi, dword [0x10005e244]
add edi, 0xffffffff
add rdi, 1
mov r9, rdi
je 0x10013575c
mov rcx, qword [0x100495210]
imul rcx, rcx, 0x343fd
shl rax, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
shr r9, 0x10
jne 0x100135730
mov qword [0x100495210], rcx
xor edx, edx
div rdi
test r10, r10
je 0x100135798
mov ecx, 0xffffc428
add r8, 1
mov eax, 0x3bd7
lock cmpxchg dword [r11 + rdx*4 + 0x478cb0], ecx
je 0x100135a67
mov ecx, dword [0x10005e244]
lea rax, [rdx + 1]
xor edx, edx
div rcx
cmp r8, r10
jb 0x100135766
xor ebx, ebx
test rbx, rbx
jne 0x1001358ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov r12d, eax
add rdi, 1
xor eax, eax
mov rcx, qword [0x10047b438]
mov r8, rcx
test rcx, rcx
mov r9, rcx
je 0x1001357f9
mov rcx, qword [0x100495210]
imul rcx, rcx, 0x343fd
shl rax, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
shr r9, 0x10
jne 0x1001357cd
mov qword [0x100495210], rcx
mov r9d, 0x40
xor edx, edx
div r8
mov r8d, 0x3000
mov rcx, rdx
shl rcx, 0x10
mov rdx, rsi
add rcx, qword [0x100493ee0]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x100135864
mov rdx, rax
lea r9, [0x1003c433c]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r8d, esi
mov rcx, rax
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlInstallFunctionTableCallback]
test al, al
jne 0x100135878
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp rdi, 0x11
jb 0x1001357ae
xor ebx, ebx
cmp rbx, 0x10000
jb 0x100135886
test bl, 3
je 0x1001358ab
test rbx, rbx
je 0x1001358a9
mov rcx, rbx
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlDeleteFunctionTable]
xor edx, edx
mov rcx, rbx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [0x100000000]
test rbx, rbx
je 0x1001356f7
mov rcx, rsi
mov rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
mov eax, 0x4574633
mov esi, ebp
add qword [r13], 9
mov r14d, dword [r14 + 1]
shr r14, 1
and r14d, 0xfffffff
sub esi, r15d
mov edi, dword [0x1002f3aa4]
xor eax, eax
sub rdi, r14
mov qword [rsp + 0x98], r14
mov dword [rsp + 0x38], esi
add rdi, 1
mov r8, rdi
je 0x10013593e
mov rcx, qword [0x100495210]
imul rcx, rcx, 0x343fd
shl rax, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
shr r8, 0x10
jne 0x100135912
mov qword [0x100495210], rcx
xor edx, edx
div rdi
mov ecx, esi
lea r12, [rdx + rbx]
mov r8, r12
mov qword [rsp + 0x78], r12
mov rdx, r14
mov eax, 0x6dc9f20e
lea rcx, [rsp + 0x80]
mov rdx, qword [r14 + rbp]
xor dil, dil
mov qword [rsp + 0x80], rdx
mov eax, 0x7eec09b1
mov r9d, dword [rsp + 0x84]
mov r11, qword [rsp + 0x80]
mov rcx, r15
and qword [rsp + 0x40], 0
mov ebx, 4
mov eax, 0xfffffff
and r11, rax
and r9, rax
mov rax, qword [0x1003f4900]
add r11, r15
sub rcx, rax
mov qword [rsp + 0x30], rcx
jne 0x100135a7e
xor r10d, r10d
test r9, r9
je 0x100135e50
mov eax, dword [rsp + 0x44]
mov r12d, 0xf7df258b
mov r8d, dword [rsp + 0x40]
movzx ecx, byte [r11 + r10]
add r10, 1
sub ecx, 0x820da75
add r8d, ecx
add ecx, eax
mov eax, ecx
imul eax, eax, 0xa5eb
rol eax, 0xb
ror ecx, 0xb
xor eax, ecx
imul rax, r12
mov qword [rsp + 0x30], rax
shr rax, 0x20
mov ecx, dword [rsp + 0x30]
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov eax, edx
sar eax, 0x1f
btr eax, 0x1f
add eax, edx
imul rax, r12
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x30]
shr rax, 0x20
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov eax, edx
sar eax, 0x1f
btr eax, 0x1f
add eax, edx
add r8d, eax
cmp r10, r9
jb 0x1001359d1
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], r8d
jmp 0x100135e4b
mov ecx, dword [0x1002f3aa4]
imul rcx, rdx
lea rbx, [rcx + r11 + 0x425000]
jmp 0x10013579a
movsxd rcx, dword [0x10000003c]
mov r8d, dword [rcx + r15 + 0xb0]
add r8, r15
lea rax, [r11 + r9]
mov edx, dword [rcx + r15 + 0xb4]
mov qword [rsp + 0x68], rax
mov eax, r11d
sub eax, r15d
mov r10d, eax
mov ecx, eax
mov rax, 0xfffffffffffff000
mov rbx, rcx
lea r15, [rcx + r9]
and r10, rax
sub rbx, r10
mov rcx, r15
and rcx, rax
mov qword [rsp + 0x50], rcx
sub r15, rcx
add rdx, r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x60], r15
jmp 0x100135aec
mov eax, dword [r8]
cmp rax, r10
jae 0x100135af1
mov eax, dword [r8 + 4]
add r8, rax
cmp r8, rdx
jne 0x100135add
xor esi, esi
cmp r8, rdx
je 0x100135b2b
mov eax, dword [r8]
cmp rax, r10
jne 0x100135b2b
mov ecx, dword [r8 + 4]
sub rcx, 8
shr rcx, 1
je 0x100135b26
mov ax, word [r8 + rsi*2 + 8]
and eax, 0xfff
cmp rax, rbx
jae 0x100135b26
add rsi, 1
cmp rsi, rcx
jne 0x100135b0d
mov rcx, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x44]
mov ebx, dword [rsp + 0x40]
mov r12d, 0xf7df258b
lea rbp, [0x100000000]
mov r14, qword [rsp + 0x30]
cmp r8, rdx
je 0x100135d81
mov eax, dword [r8]
cmp rax, rcx
ja 0x100135d81
mov edi, dword [r8 + 4]
lea rax, [rdi - 8]
shr rax, 1
cmp rsi, rax
jne 0x100135b87
add r8, rdi
cmp r8, rdx
je 0x100135d81
mov eax, dword [r8]
cmp rax, rcx
ja 0x100135d81
xor esi, esi
jmp 0x100135b5b
mov eax, dword [r8]
cmp rax, rcx
jne 0x100135ba3
mov ax, word [r8 + rsi*2 + 8]
and eax, 0xfff
cmp rax, r15
jae 0x100135d81
mov rax, rsi
add rsi, 1
test word [r8 + rax*2 + 8], 0xf000
je 0x100135b46
movzx r10d, word [r8 + rax*2 + 8]
xor r13d, r13d
mov r15d, r10d
and r15d, 0xfff
add r15d, dword [r8]
add r15, rbp
mov rax, r15
sub rax, r11
je 0x100135c71
mov rdi, rax
movzx ecx, byte [r11 + r13]
add r13, 1
sub ecx, 0x820da75
add ebx, ecx
add ecx, r9d
mov eax, ecx
imul eax, eax, 0xa5eb
rol eax, 0xb
ror ecx, 0xb
xor eax, ecx
imul rax, r12
mov qword [rsp + 0x58], rax
shr rax, 0x20
mov ecx, dword [rsp + 0x58]
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov eax, edx
sar eax, 0x1f
btr eax, 0x1f
add eax, edx
imul rax, r12
mov qword [rsp + 0x58], rax
mov ecx, dword [rsp + 0x58]
shr rax, 0x20
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov r9d, edx
sar r9d, 0x1f
btr r9d, 0x1f
add r9d, edx
add ebx, r9d
cmp r13, rdi
jb 0x100135bdc
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], ebx
mov rax, qword [r15]
mov qword [rsp + 0x58], rax
shr r10d, 0xc
cmp r10d, 3
je 0x100135c91
sub r10d, 0xa
neg r10d
sbb edx, edx
add edx, 3
jmp 0x100135c96
mov edx, 2
mov r10, r14
neg r10
sub edx, 2
je 0x100135cbc
cmp edx, 1
je 0x100135cac
or r10, 0xffffffffffffffff
jmp 0x100135cc7
add rax, r10
mov qword [rsp + 0x58], rax
mov r10d, 8
jmp 0x100135cc7
add dword [rsp + 0x58], r10d
mov r10d, 4
xor r11d, r11d
test r10, r10
je 0x100135d69
movzx ecx, byte [rsp + r11 + 0x58]
add r11, 1
sub ecx, 0x820da75
add ebx, ecx
add ecx, r9d
mov eax, ecx
imul eax, eax, 0xa5eb
rol eax, 0xb
ror ecx, 0xb
xor eax, ecx
imul rax, r12
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x30]
shr rax, 0x20
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov eax, edx
sar eax, 0x1f
btr eax, 0x1f
add eax, edx
imul rax, r12
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x30]
shr rax, 0x20
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov r9d, edx
sar r9d, 0x1f
btr r9d, 0x1f
add r9d, edx
add ebx, r9d
cmp r11, r10
jb 0x100135cd3
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], ebx
mov rcx, qword [rsp + 0x50]
lea r11, [r10 + r15]
mov r15, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
jmp 0x100135b46
xor r8d, r8d
mov dil, r8b
mov r14, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa8]
mov r10, qword [rsp + 0x68]
mov r13, qword [rsp + 0x90]
sub r10, r11
je 0x100135e42
movzx ecx, byte [r11 + r8]
add r8, 1
sub ecx, 0x820da75
add ebx, ecx
add ecx, r9d
mov eax, ecx
imul eax, eax, 0xa5eb
rol eax, 0xb
ror ecx, 0xb
xor eax, ecx
imul rax, r12
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x30]
shr rax, 0x20
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov eax, edx
sar eax, 0x1f
btr eax, 0x1f
add eax, edx
imul rax, r12
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x30]
shr rax, 0x20
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov r9d, edx
sar r9d, 0x1f
btr r9d, 0x1f
add r9d, edx
add ebx, r9d
cmp r8, r10
jb 0x100135dad
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], ebx
mov esi, dword [rsp + 0x38]
mov ebx, 4
mov r12, qword [rsp + 0x78]
xor ecx, ecx
mov al, cl
add rcx, 1
and eax, 7
cmp rcx, 8
mov al, byte [rsp + rax + 0x40]
mov byte [rsp + rcx + 0xb7], al
jb 0x100135e52
mov eax, 0xf6984f46
mov r15b, r14b
xor r11d, r11d
mov r10, rbp
mov rax, qword [rsp + 0xb8]
and r15d, 7
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x30], r12
je 0x100136392
xor r8d, r8d
mov r12d, esi
not r12d
and dword [rsp + 0x48], r8d
test r15d, r15d
mov dword [rsp + 0x60], r8d
jle 0x100135eea
lea r9d, [r11 + 0x38]
movzx edx, byte [r10]
cmp r11d, ebx
jge 0x100135ec7
lea ecx, [r9 - 0x20]
shl edx, cl
or dword [rsp + 0x48], edx
jmp 0x100135ecf
mov ecx, r9d
shl edx, cl
or r8d, edx
add r11d, 1
add r10, 1
sub r9d, 8
cmp r11d, r15d
jl 0x100135eb2
mov dword [rsp + 0x60], r8d
mov qword [rsp + 0x50], r10
movzx r11d, word [rsp + 0xbe]
mov r8d, dword [rsp + 0xbc]
mov ecx, esi
movzx ebx, r8w
mov esi, ebx
mov edx, eax
movzx r10d, ax
movzx r9d, word [rsp + 0xba]
ror ecx, 1
xor ecx, r11d
imul ecx, ebx
xor r12d, ecx
xor edx, r12d
rol edx, 4
mov ecx, r12d
rol ecx, 1
imul esi, edx
sub esi, ecx
mov ecx, r9d
xor esi, dword [rsp + 0x38]
mov edx, esi
add r8d, esi
rol r8d, 7
ror edx, 2
imul ecx, r8d
add edx, ecx
mov r8d, r9d
mov ecx, r10d
xor r12d, edx
mov edx, r12d
xor r8d, r12d
rol r8d, 7
ror edx, 8
imul ecx, r8d
xor edx, ecx
xor esi, edx
mov ecx, r11d
mov edx, esi
mov r8d, esi
sub r8d, eax
rol r8d, 1
rol edx, 8
imul ecx, r8d
sub ecx, edx
xor r12d, ecx
mov ecx, r12d
mov r8d, dword [rsp + 0xbc]
sub ecx, ebx
mov edx, r8d
xor ecx, eax
xor esi, ecx
mov ecx, esi
sub edx, esi
ror edx, 0xf
rol ecx, 0xc
imul edx, r9d
xor ecx, edx
xor r12d, ecx
mov ecx, r12d
mov edx, r8d
sub edx, r12d
rol edx, 0xf
rol ecx, 2
imul edx, r10d
add ecx, edx
xor esi, ecx
mov edx, esi
mov ecx, esi
sub edx, ebx
shr ecx, 0xe
imul edx, r11d
sub edx, ecx
xor r12d, edx
mov edx, r12d
mov ecx, r12d
sub edx, r11d
shr ecx, 0xa
rol edx, 3
imul edx, ebx
xor edx, ecx
xor esi, edx
mov r11d, r8d
xor r11d, eax
xor r11d, r12d
xor r11d, esi
mov ecx, r11d
xor ebx, r11d
ror ecx, 9
imul ebx, r10d
xor ecx, ebx
xor ecx, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x60]
xor r10d, r10d
xor r11d, ebx
lea edx, [r10 + 4]
xor esi, ecx
mov r8d, esi
test r15d, r15d
mov r9d, r11d
jle 0x100136054
mov rcx, qword [rsp + 0x30]
cmp r10d, edx
jge 0x100136038
rol r8d, 8
mov byte [rcx], r8b
add rcx, 1
xor dil, r8b
jmp 0x100136046
rol r9d, 8
mov byte [rcx], r9b
add rcx, 1
xor dil, r9b
add r10d, 1
cmp r10d, r15d
jl 0x100136023
mov qword [rsp + 0x30], rcx
lea ecx, [r15 - 4]
test ecx, ecx
jle 0x100136379
sub edx, ecx
shl edx, 3
mov ecx, edx
shr r11d, cl
shl r11d, cl
mov r12, qword [rsp + 0x30]
mov r10, qword [rsp + 0x50]
mov rcx, r14
shr rcx, 3
mov qword [rsp + 0xb0], rcx
je 0x1001362bd
movzx ecx, word [rsp + 0xba]
mov r13d, dword [rsp + 0x48]
movzx edx, word [rsp + 0xbe]
mov r15d, dword [rsp + 0xbc]
mov rbp, qword [rsp + 0xb0]
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x60], edx
xor r11d, r11d
test ecx, ecx
jns 0x10013606d
neg ecx
shl ecx, 3
shr esi, cl
shl esi, cl
jmp 0x10013606d
mov dword [rsp + 0x48], esi
mov ebx, esi
not ebx
xor esi, esi
jmp 0x100136077