Function at 0x140128610
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov rbx, r9
mov qword [rbp - 8], r8
mov qword [rbp], rdx
mov rsi, rcx
mov eax, dword [0x140228dc0]
xor edx, edx
div dword [0x140228dc4]
add eax, 0xcdc7d729
xor eax, 0xd1b8a64a
cmp eax, 0x540c91fd
jbe 0x14012865f
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
xor ecx, ecx
nop word cs:[rax + rax]
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov r15, rsp
test cl, cl
jne 0x140128670
mov r14, rbx
shr r14, 1
movabs rax, 0x7ffffffffffffffd
mov r12, r14
or r12, 1
bt ebx, 1
adc r12, 0
cmp rbx, rax
ja 0x140128a83
mov eax, dword [0x140228dc8]
xor eax, dword [0x140228dcc]
imul rcx, rax, 0x2da8f339
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1a
not eax
mov ecx, eax
or ecx, 0xffffffe1
or eax, 0x41075f61
and eax, ecx
mov ecx, eax
not ecx
and ecx, 0xc
xor eax, 0x6f1a37b2
lea eax, [rax + rcx*2]
cmp eax, 0x7d9d0f01
jb 0x140128745
mov eax, dword [0x140228dd0]
mov r13d, dword [0x140228dd4]
mov ecx, eax
not ecx
and ecx, r13d
not r13d
and r13d, eax
sub r13d, ecx
add r13d, 0x9d15ad66
and r13d, 0xb89b4c5c
add r13d, 0xf80d2cba
lea rdx, [r12 + r12]
movzx eax, byte [0x14022cb78]
sub rsp, 0x20
xor ecx, ecx
call fcn.14014ee50
add rsp, 0x20
cmp r13d, 0xeff44169
jbe 0x140128761
lea rdx, [r12 + r12]
movzx eax, byte [0x14022cb78]
sub rsp, 0x20
xor ecx, ecx
call fcn.140107940
add rsp, 0x20
jmp 0x1401286f0
mov rdi, rax
nop word cs:[rax + rax]
mov eax, dword [0x140228dd8]
xor edx, edx
div dword [0x140228ddc]
imul eax, eax, 0x206e118f
cmp eax, 0x6046f868
je 0x140128770
test rdi, rdi
je 0x14012899b
mov qword [r15], 0
sub rsp, 0x30
mov qword [rsp + 0x20], r15
mov rcx, qword [rbp]
mov rdx, qword [rbp - 8]
mov r8, rdi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add rsp, 0x30
test eax, eax
je 0x1401288c6
nop word cs:[rax + rax]
mov eax, dword [0x140228df8]
add eax, dword [0x140228dfc]
or eax, 0xe9889c33
and eax, 0xf9889c7b
cmp eax, 0xd237a12d
je 0x1401287d0
mov rax, qword [r15]
mov ecx, dword [0x140228e00]
mov edx, dword [0x140228e04]
mov r8d, ecx
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, ecx
imul r9d, r8d
mov r8d, ecx
and r8d, edx
or ecx, edx
imul ecx, r8d
add ecx, r9d
or ecx, 0xd16fb38a
cmp ecx, 0xd72874f7
je 0x1401287f0
mov ecx, 0xab5cf13f
nop word cs:[rax + rax]
mov edx, dword [0x140228e08]
mov r8d, dword [0x140228e0c]
mov r9d, edx
xor r9d, r8d
not r9d
and r9d, r8d
add r9d, r9d
sub r8d, r9d
add r8d, edx
imul edx, r8d, 0xd397cba0
add edx, 0xd735dd5c
imul rdx, rcx
shr rdx, 0x39
cmp edx, 0x79d61f4d
ja 0x140128840
cmp rax, rbx
jne 0x140128957
mov word [rdi + r14*2], 0
mov qword [rsi], r12
mov eax, dword [0x140228e18]
and eax, dword [0x140228e1c]
or eax, 0x8b6658bb
add eax, 0x9d3e1f67
shr eax, 3
imul rax, rax, 0x14473879
shr rax, 0x39
cmp eax, 0xbe4f78d
jne 0x140128a85
jmp 0x140128af7
mov eax, dword [0x140228e10]
xor eax, dword [0x140228e14]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x9ff2d231
and ecx, 0x600d2dce
imul ecx, edx
mov edx, eax
and edx, 0x600d2dce
or eax, 0x600d2dce
imul eax, edx
add eax, ecx
add eax, 0x7286d2a
mov ecx, eax
and ecx, 0x18aa730
xor eax, 0x18aa730
lea eax, [rax + rcx*2]
cmp eax, 0xaa16d26
jne 0x140128923
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov r14, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [0x14020770a]
mov r15b, 1
movabs r12, 0x7ffffffffffffffd
nop
sub rsp, 0x20
call r14
add rsp, 0x20
test r15b, r15b
je 0x140128940
mov eax, 0x1b
jmp 0x14012896d
mov eax, 0x3a
lea rbx, str.ReadProcessMemory_returned_unexpected_number_of_bytes_readUnable_to_read_process_dataIntel_x86MIPSRISC_AlphaPPCSHXARMIntel_Itanium_based_x64RISC_Alpha_x64MSIL_Intel_or_AMD__x64Intel_Itanium_based_x86unknownARM_x64CPU
movabs r12, 0x7ffffffffffffffd
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rax
add r12, 3
mov qword [rsi], r12
mov rcx, qword [0x14022cb48]
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x140128b41
mov eax, dword [0x140228de0]
xor eax, dword [0x140228de4]
mov ecx, eax
not ecx
or ecx, 0x80018c30
and ecx, 0xa0c1ed3d
and eax, 0x7221080
sub eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xd95257c4
and ecx, 0x26aca81b
imul ecx, edx
mov edx, eax
and edx, 0x26aca01b
or eax, 0x26aca81b
imul eax, edx
add eax, ecx
cmp eax, 0x38419623
ja 0x140128a59
mov eax, dword [0x140228de8]
sub eax, dword [0x140228dec]
mov ecx, eax
not ecx
and ecx, 0x4ba455
mov edx, eax
and edx, 0xfb45baa
imul edx, ecx
mov ecx, eax
and ecx, 0x4ba455
or eax, 0x4ba455
imul eax, ecx
add eax, edx
mov ecx, eax
or ecx, 0xf6c533dd
mov edx, eax
not edx
and edx, 0x8328820
mov r8d, ecx
and r8d, 0xd3c8574a
imul r8d, edx
and ecx, 0x2c37a8b5
or eax, 0xfef7bbfd
imul eax, ecx
add eax, r8d
ud2
ud2
ud2
mov ecx, dword [0x140228e20]
mov eax, dword [0x140228e24]
mov edx, ecx
and edx, eax
or ecx, eax
not ecx
or ecx, edx
mov eax, ecx
not eax
and ecx, 0xa365ea81
mov edx, eax
and edx, 0x5c9a157e
or edx, ecx
xor edx, 0x9ecdd13d
and eax, 0x3da83bbc
or eax, edx
add eax, 0x622e3622
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xa37607f3
and ecx, 0x5c89f80c
imul ecx, edx
mov edx, eax
and edx, 0x5c89f80c
or eax, 0x5c89f80c
imul eax, edx
add eax, ecx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r12
cmp eax, 0x48ca9150
jbe 0x140128b10
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r12
jmp 0x140128a85
mov eax, dword [0x140228e28]
sub eax, dword [0x140228e2c]
mov ecx, eax
or ecx, 8
and eax, 0x86272940
xor eax, 0x230100
and ecx, 0x230108
or ecx, eax
or ecx, 0x79d8d6b7
cmp ecx, 0xf16088be
ja 0x140128b10
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret