Function at 0x140002820
Capabilities:
Encode data using xor

Disassembly:
push r12
push r15
sub rsp, 0x38
mov r12, rdx
mov r15d, ecx
mov edx, ecx
lea rcx, str.___Fetching_information_about_syscall:_0x_0.8X._n
call fcn.140001010
mov r8, qword [0x140026c80]
test r8, r8
jne 0x14000286f
call fcn.140002600
test eax, eax
jne 0x140002868
lea rcx, str.____NTConfig_init_failed_n
call fcn.140001010
xor eax, eax
add rsp, 0x38
pop r15
pop r12
ret
mov r8, qword [0x140026c80]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x28], r13
mov r13d, 0xff
mov qword [rsp + 0x20], r14
xor r14d, r14d
mov ebp, r14d
mov dword [r12 + 4], r15d
cmp dword [0x140026c78], ebp
lea ebx, [r14 + 1]
jbe 0x140002afa
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x30], rdi
nop
mov rax, qword [0x140026c68]
mov ebx, r14d
mov esi, dword [rax + rbp*4]
mov rax, qword [0x140026c70]
add rsi, r8
movzx ecx, word [rax + rbp*2]
mov rax, qword [0x140026c60]
mov edi, dword [rax + rcx*4]
mov rcx, rsi
add rdi, r8
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
mov rcx, r14
test eax, eax
je 0x14000290b
nop dword [rax + rax]
movsx eax, byte [rcx + rsi]
inc rcx
add eax, ebx
imul ebx, eax, 0x101
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x1400028f0
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp eax, r15d
je 0x140002944
mov eax, dword [0x140026c78]
inc rbp
cmp rbp, rax
jae 0x14000293a
mov r8, qword [0x140026c80]
jmp 0x1400028b0
mov ebx, 1
jmp 0x140002af0
mov qword [r12 + 8], rdi
movzx eax, byte [rdi]
cmp al, 0x4c
jne 0x140002994
cmp byte [rdi + 1], 0x8b
jne 0x140002a48
cmp byte [rdi + 2], 0xd1
jne 0x140002a48
cmp byte [rdi + 3], 0xb8
jne 0x140002a48
cmp byte [rdi + 6], r14b
jne 0x140002a48
mov ebx, 1
cmp byte [rdi + 7], r14b
jne 0x140002a4d
movzx ecx, byte [rdi + 5]
movzx eax, byte [rdi + 4]
jmp 0x140002ae7
mov ebx, 1
cmp al, 0xe9
jne 0x140002a4d
movzx ecx, bx
nop dword [rax]
nop dword [rax + rax]
movzx r8d, cx
mov eax, r8d
neg eax
shl eax, 5
movsxd rdx, eax
add rdx, rdi
cmp byte [rdx], 0x4c
jne 0x1400029e5
cmp byte [rdx + 1], 0x8b
jne 0x1400029e5
cmp byte [rdx + 2], 0xd1
jne 0x1400029e5
cmp byte [rdx + 3], 0xb8
jne 0x1400029e5
cmp byte [rdx + 6], r14b
jne 0x1400029e5
cmp byte [rdx + 7], r14b
je 0x140002a1c
mov edx, r8d
shl edx, 5
add rdx, rdi
cmp byte [rdx], 0x4c
jne 0x140002a11
cmp byte [rdx + 1], 0x8b
jne 0x140002a11
cmp byte [rdx + 2], 0xd1
jne 0x140002a11
cmp byte [rdx + 3], 0xb8
jne 0x140002a11
cmp byte [rdx + 6], r14b
jne 0x140002a11
cmp byte [rdx + 7], r14b
je 0x140002a32
inc cx
cmp cx, r13w
jbe 0x1400029b0
jmp 0x140002a4d
movzx ecx, byte [rdx + 4]
movzx eax, byte [rdx + 5]
sub ecx, r8d
shl eax, 8
or ecx, eax
mov dword [r12], ecx
jmp 0x140002a4d
movzx ecx, byte [rdx + 5]
movzx eax, byte [rdx + 4]
shl ecx, 8
add eax, r8d
or ecx, eax
mov dword [r12], ecx
jmp 0x140002a4d
mov ebx, 1
cmp byte [rdi + 3], 0xe9
jne 0x140002af0
movzx ecx, bx
nop word [rax + rax]
movzx r8d, cx
mov eax, r8d
neg eax
shl eax, 5
movsxd rdx, eax
add rdx, rdi
cmp byte [rdx], 0x4c
jne 0x140002a95
cmp byte [rdx + 1], 0x8b
jne 0x140002a95
cmp byte [rdx + 2], 0xd1
jne 0x140002a95
cmp byte [rdx + 3], 0xb8
jne 0x140002a95
cmp byte [rdx + 6], r14b
jne 0x140002a95
cmp byte [rdx + 7], r14b
je 0x140002acc
mov edx, r8d
shl edx, 5
add rdx, rdi
cmp byte [rdx], 0x4c
jne 0x140002ac1
cmp byte [rdx + 1], 0x8b
jne 0x140002ac1
cmp byte [rdx + 2], 0xd1
jne 0x140002ac1
cmp byte [rdx + 3], 0xb8
jne 0x140002ac1
cmp byte [rdx + 6], r14b
jne 0x140002ac1
cmp byte [rdx + 7], r14b
je 0x140002adc
inc cx
cmp cx, r13w
jbe 0x140002a60
jmp 0x140002af0
movzx ecx, byte [rdx + 4]
movzx eax, byte [rdx + 5]
sub ecx, r8d
shl eax, 8
jmp 0x140002aea
movzx eax, byte [rdx + 4]
movzx ecx, byte [rdx + 5]
add eax, r8d
shl ecx, 8
or ecx, eax
mov dword [r12], ecx
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov r8, qword [r12 + 8]
mov rbp, qword [rsp + 0x58]
test r8, r8
je 0x140002b77
nop dword [rax]
mov edx, r14d
lea ecx, [r14 + 1]
add rdx, r13
add rdx, r8
cmp byte [rdx], 0xf
jne 0x140002b2d
cmp byte [rcx + r8 + 0xff], 5
je 0x140002b37
mov r14d, ecx
cmp ecx, r13d
jbe 0x140002b10
jmp 0x140002b48
lea rcx, str.___Found_a_jump_address_for_indirect_syscall:_0x_p._n
mov qword [r12 + 0x10], rdx
call fcn.140001010
cmp dword [r12], 0
je 0x140002b6b
cmp dword [r12 + 4], 0
je 0x140002b6b
cmp qword [r12 + 8], 0
je 0x140002b6b
cmp qword [r12 + 0x10], 0
je 0x140002b6b
mov eax, ebx
jmp 0x140002b79
lea rcx, str.____Failed_getting_information_about_specified_syscall._n
call fcn.140001010
xor eax, eax
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x38
pop r15
pop r12
ret