Function at 0x140227060
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov qword [rbp], rcx
mov eax, dword [0x1415959a0]
mov ecx, dword [0x1415959a4]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
imul rax, rax, 0x3c655665
shr rax, 0x3c
or eax, 0x5f42adf4
imul rax, rax, 0x60ff3403
shr rax, 0x3d
cmp eax, 0xcecec4a7
jbe 0x1402270d0
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
nop
mov ecx, dword [0x1415959a8]
mov edx, dword [0x1415959ac]
mov eax, ecx
not eax
mov r8d, edx
not r8d
mov r9d, eax
and r9d, 0xd9072b9d
and ecx, 0x26f8d462
or ecx, r9d
or eax, r8d
and r8d, 0xd9072b9d
and edx, 0x26f8d462
or edx, r8d
xor edx, ecx
not eax
or eax, edx
mov ecx, eax
and ecx, 0x1d8a0172
and eax, 0x150a0150
xor ecx, 0x571f835c
or ecx, eax
mov eax, ecx
or eax, 0xaf2e53af
or ecx, 0xef3fd3af
and ecx, eax
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov rdi, rsp
cmp ecx, 0xd39a9e14
je 0x1402270d0
xor r14d, r14d
mov r15d, 2
mov r12d, 3
lea rbx, [0x1415acb08]
mov r13, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
mov eax, dword [0x1415acb08]
nop word cs:[rax + rax]
mov ecx, dword [0x1415959b0]
mov edx, dword [0x1415959b4]
not ecx
mov r8d, ecx
and r8d, edx
not r8d
or ecx, edx
and ecx, r8d
not ecx
or ecx, 0x8fbc3380
add ecx, 0x533b35c0
not ecx
or ecx, 0x701e5a12
cmp ecx, 0xcbb8bc79
jb 0x140227180
cmp eax, 2
jge 0x1402272af
test eax, eax
jg 0x140227519
jne 0x140227495
mov eax, dword [0x1415959c8]
add eax, dword [0x1415959cc]
imul eax, eax, 0xc33c7899
mov ecx, eax
not ecx
or ecx, 0x479c5be1
add eax, ecx
add eax, 0x16ac9ec9
cmp eax, 0x909e92a5
jbe 0x140227210
xor eax, eax
lock cmpxchg dword [0x1415acb08], r15d
nop word cs:[rax + rax]
xor eax, eax
lock cmpxchg dword [0x1415acb08], r15d
sete cl
test r14b, r14b
jne 0x140227210
nop word cs:[rax + rax]
mov edx, dword [0x1415959d0]
mov r8d, dword [0x1415959d4]
not edx
not r8d
or r8d, edx
mov edx, r8d
not edx
and r8d, 0xedde53d3
mov r9d, edx
and r9d, 0x1221ac2c
imul r9d, r8d
mov r8d, edx
and r8d, 0xedde53d3
or edx, 0xedde53d3
imul edx, r8d
add edx, r9d
imul r8, rdx, 0x748cecb
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1d
mov r8d, edx
xor r8d, 0x48bf71e7
add r8d, edx
cmp r8d, 0xfae2b31a
ja 0x140227230
test cl, cl
je 0x140227180
jmp 0x1402273e6
jg 0x1402272d0
mov eax, 2
lock cmpxchg dword [0x1415acb08], r12d
jne 0x140227180
jmp 0x1402272d9
cmp eax, 4
jge 0x14022748f
mov dword [rdi], 3
sub rsp, 0x20
mov r8d, 4
mov rcx, rbx
mov rdx, rdi
mov r9d, 0xffffffff
call r13
add rsp, 0x20
nop dword [rax]
mov ecx, dword [0x141595a78]
mov edx, dword [0x141595a7c]
mov r8d, edx
and r8d, ecx
add ecx, edx
sub ecx, r8d
mov edx, ecx
xor edx, 0x53e2010a
xor ecx, 0xa01cd2b5
mov r8d, ecx
and r8d, 0x2c01fc74
and edx, 0xd3fe038b
imul edx, r8d
mov r8d, ecx
and r8d, 0xd3fe038b
or ecx, 0xd3fe038b
imul ecx, r8d
add ecx, edx
cmp ecx, 0x82733838
je 0x140227300
cmp eax, 1
je 0x14022716b
mov eax, dword [0x141595a80]
or eax, dword [0x141595a84]
add eax, 0x70cb74b5
imul rax, rax, 0x4b9bae39
shr rax, 0x3e
or eax, 0x2eab8662
cmp eax, 0xed6e4fa6
jbe 0x1402273a0
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141595a88]
or eax, dword [0x141595a8c]
imul rcx, rax, 0x6a248e97
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
imul esi, eax, 0x79b74e48
and esi, 0x4ffa2ea8
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
cmp esi, 0x6cb1023c
je 0x1402273a0
jmp 0x14022716b
mov rax, qword [rbp]
mov rax, qword [rax]
nop dword [rax]
mov ecx, dword [0x1415959e8]
imul ecx, dword [0x1415959ec]
and ecx, 0x3bf26dc4
add ecx, 0xab6e3ee8
and ecx, 0xfffeffe4
xor ecx, 0x477e9dc6
cmp ecx, 0xb825712d
je 0x1402273f0
mov ecx, dword [0x1415959f0]
or ecx, dword [0x1415959f4]
mov rdi, qword [rax]
mov edx, ecx
not edx
or ecx, 0x6264e474
or edx, 0x9d9b1b8b
and edx, ecx
mov ecx, edx
not ecx
and edx, 0x7f427f38
mov r8d, ecx
and r8d, 0x80bd80c7
imul r8d, edx
mov edx, ecx
and edx, 0x7f427f38
or ecx, 0x7f427f38
imul ecx, edx
add ecx, r8d
imul rdx, rcx, 0x20fc90e7
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
cmp ecx, 0xa8db9a57
jbe 0x140227585
jmp 0x1402275ba
je 0x140227572
mov eax, dword [0x1415959b8]
sub eax, dword [0x1415959bc]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x3741829e
and ecx, 0xc8be7d61
imul ecx, edx
mov edx, eax
and edx, 0xc8be7d61
or eax, 0xc8be7d61
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xf8b5ad17
and ecx, eax
imul eax, ecx, 0x22da30e2
cmp eax, 0xb0857eaa
jne 0x1402274f0
ud2
mov eax, dword [0x1415959c0]
xor edx, edx
div dword [0x1415959c4]
imul rax, rax, 0xdc6faab
shr rax, 0x3b
or eax, 0x84f21732
ud2
mov eax, dword [0x1415959d8]
xor edx, edx
div dword [0x1415959dc]
mov ecx, 0xcd73a2bf
imul rcx, rax
shr rcx, 0x3f
add ecx, 0x23935377
mov eax, ecx
not eax
mov edx, ecx
and edx, 0x23920114
and eax, 0x80002c0b
imul eax, edx
mov edx, ecx
and edx, 0x1526b
or ecx, 0x80017e6b
imul ecx, edx
add ecx, eax
cmp ecx, 0x4f089992
jbe 0x140227769
jmp 0x1402277af
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, dword [0x1415959f8]
and ecx, dword [0x1415959fc]
and ecx, 0xd857fcaa
imul rdx, rcx, 0x16f24e3b
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
mov qword [rax], 0
cmp ecx, 0x5d1ca5a5
jne 0x1402275c3
mov qword [rax], 0
jmp 0x140227585
test rdi, rdi
je 0x1402276b3
mov eax, dword [0x141595a08]
mov ecx, dword [0x141595a0c]
not eax
not ecx
and ecx, eax
xor ecx, 0x7c159401
imul eax, ecx, 0xe687e16f
or eax, 0x61f03b01
cmp eax, 0x701bba54
jae 0x140227600
movzx eax, byte [0x1415acbd0]
nop dword [rax]
mov eax, dword [0x141595a10]
xor edx, edx
div dword [0x141595a14]
and eax, 0xfffffff
xor eax, 0xfb934678
imul eax, eax, 0x2df355e7
or eax, 0xf288a0d1
movzx ecx, byte [0x1415acbd0]
cmp eax, 0xd849d9fd
jb 0x140227600
sub rsp, 0x20
mov edx, 0x818
xor ecx, ecx
call fcn.1401ac910
add rsp, 0x20
mov rsi, rax
nop dword [rax + rax]
mov eax, dword [0x141595a18]
xor edx, edx
div dword [0x141595a1c]
imul rcx, rax, 0x133be581
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
or eax, 0x279f4930
cmp eax, 0xbfdd0919
ja 0x140227650
test rsi, rsi
je 0x140227711
mov eax, dword [0x141595a30]
sub eax, dword [0x141595a34]
imul rax, rax, 0x6533c8bb
shr rax, 0x3e
or eax, 0xdbd307e6
cmp eax, 0x8f8d6915
jae 0x1402277c9
jmp 0x1402277fe
ud2
mov eax, dword [0x141595a20]
or eax, dword [0x141595a24]
or eax, 0x62880002
and eax, 0x73a8221b
xor eax, 0x2414f8ca
cmp eax, 0x24581851
jae 0x140227735
ud2
mov eax, 0xe346c3ed
nop word [rax + rax]
mov ecx, dword [0x141595a28]
and ecx, dword [0x141595a2c]
imul rcx, rax
shr rcx, 0x3f
or ecx, 0xffc83406
ud2
mov eax, dword [0x1415959e0]
sub eax, dword [0x1415959e4]
xor eax, 0x35fb7eb2
add eax, 0x9ebda1f4
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x460d767a
and ecx, 0xb9f28985
imul ecx, edx
mov edx, eax
and edx, 0xb9f28985
or eax, 0xb9f28985
imul eax, edx
add eax, ecx
ud2
ud2
mov eax, dword [0x141595a38]
mov ecx, dword [0x141595a3c]
not eax
not ecx
or ecx, eax
not ecx
add ecx, 0x27e748a5
not ecx
or ecx, 0xdd6f48b7
mov qword [rsi + 0x810], 0
cmp ecx, 0xcc66418c
jae 0x14022780b
mov qword [rsi + 0x810], 0
jmp 0x1402277c9
movzx eax, byte [0x1415acbd0]
sub rsp, 0x20
mov edx, 0x300
xor ecx, ecx
call fcn.14020ae90
add rsp, 0x20
test rax, rax
je 0x140227a26
mov rdx, rax
and rdx, 0xffffffffffffff80
lea rcx, [rdx + 0x80]
mov qword [rdx + 0x78], rax
mov qword [rdx + 0x80], 1
mov qword [rdx + 0x88], 1
mov qword [rdx + 0x100], rsi
mov qword [rdx + 0x180], rsi
mov qword [rdx + 0x200], 0
mov eax, dword [0x141595a58]
add eax, dword [0x141595a5c]
mov edx, eax
not edx
mov r8d, eax
and r8d, 0x8d7f2063
and edx, 0x7280df9c
imul edx, r8d
mov r8d, eax
and r8d, 0x7280df9c
or eax, 0x7280df9c
imul eax, r8d
add eax, edx
mov edx, eax
not edx
or edx, 0x8fc5e8a4
or eax, 0x703a1758
and eax, edx
add eax, 0x969dd3f1
cmp eax, 0x22e18cf
jae 0x1402278f0
mov qword [rcx + 0x200], 0
mov rax, qword [rdi]
mov qword [rax], rcx
mov eax, 4
xchg dword [0x1415acb08], eax
nop word cs:[rax + rax]
mov eax, dword [0x141595a60]
mov edx, dword [0x141595a64]
mov r8d, edx
not r8d
mov r9d, eax
and r9d, r8d
or r8d, eax
not r8d
imul r8d, r9d
mov r9d, eax
and r9d, edx
or eax, edx
imul eax, r9d
add eax, r8d
mov edx, eax
not edx
mov r8d, eax
and r8d, 0xb70bdb76
and edx, 0x48f42489
imul edx, r8d
mov r8d, eax
and r8d, 0x48f42489
or eax, 0x48f42489
imul eax, r8d
add edx, eax
add edx, 0xf0efcee8
mov eax, edx
xor eax, 0x3dbbcc9d
and edx, 0x42443362
add edx, edx
sub edx, eax
mov qword [rcx + 0x200], 0
mov rax, qword [rdi]
mov qword [rax], rcx
mov eax, 4
xchg dword [0x1415acb08], eax
cmp edx, 0xd86f803b
ja 0x1402278f0
nop dword [rax]
mov ecx, dword [0x141595a68]
imul ecx, dword [0x141595a6c]
or ecx, 0x9280f5d2
imul rcx, rcx, 0x2fc7b0e7
shr rcx, 0x3d
cmp ecx, 0xed6ade89
je 0x140227990
cmp eax, 3
jne 0x140227572
sub rsp, 0x20
lea rcx, [0x1415acb08]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressAll]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141595a70]
xor edx, edx
div dword [0x141595a74]
mov ecx, eax
not ecx
and ecx, 0x7358bc33
mov edx, eax
and edx, 0x8ca743cc
imul edx, ecx
mov ecx, eax
and ecx, 0x7358bc33
or eax, 0x7358bc33
imul eax, ecx
add eax, edx
add eax, 0x8a1ad6f4
cmp eax, 0x662f8513
jb 0x1402279e0
jmp 0x140227572
mov eax, dword [0x141595a40]
mov ecx, dword [0x141595a44]
mov edx, eax
and edx, ecx
add edx, edx
add eax, ecx
sub eax, edx
or eax, 0xdf74e9cd
mov ecx, eax
xor ecx, 0x810410
xor eax, 0x20080202
and eax, 0xa1084a0a
and ecx, 0x12c33530
or ecx, eax
cmp ecx, 0xa6a53bf3
je 0x140227aba
mov eax, dword [0x141595a48]
mov ecx, dword [0x141595a4c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
add eax, 0x48033a6d
imul rcx, rax, 0x49b43e97
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
lea ecx, [rax + 0x3d336cac]
add eax, eax
sub eax, ecx
ud2
ud2