Function at 0x140128b60
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, rdx
mov rdi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
mov rsi, rax
nop word [rax + rax]
mov eax, dword [0x140228e30]
xor eax, dword [0x140228e34]
xor eax, 0xa157e720
add eax, 0x1c634513
cmp eax, 0x3f6c73f3
jb 0x140128b90
test rsi, rsi
je 0x140128bf8
mov eax, dword [0x140228e50]
mov ecx, dword [0x140228e54]
mov edx, eax
not edx
and eax, ecx
not ecx
or ecx, edx
not eax
and eax, ecx
not eax
imul eax, eax, 0xdb9d6c67
mov ecx, 0x8f09b2d7
imul rcx, rax
shr rcx, 0x3c
add ecx, 0x28ee185a
cmp ecx, 0xf24e1fa6
jbe 0x140128d6f
jmp 0x140128d91
mov qword [rdi], 0
mov qword [rdi + 8], 8
mov eax, dword [0x140228e38]
mov ecx, dword [0x140228e3c]
mov edx, eax
not edx
mov r8d, ecx
not r8d
mov r9d, edx
and r9d, 0x557e423f
and eax, 0xaa81bdc0
or eax, r9d
or edx, r8d
and r8d, 0x557e423f
and ecx, 0xaa81bdc0
or ecx, r8d
xor ecx, eax
not edx
or edx, ecx
imul eax, edx, 0x2f211411
mov ecx, eax
and ecx, 0x28f6c1d0
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x28f6c1d0
imul rcx, rax, 0x14b534f1
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xf01a3059
ja 0x140128cb9
mov eax, dword [0x140228e40]
mov ecx, eax
not ecx
or ecx, dword [0x140228e44]
lea edx, [rax + rcx]
inc edx
add eax, ecx
not edx
or edx, 0x71a090c2
add eax, edx
add eax, 2
xor eax, 0xdb27e625
add eax, 0x41bafc32
mov qword [rdi + 0x10], 0
cmp eax, 0xb25b2939
jae 0x140128cd0
mov qword [rdi + 0x10], 0
jmp 0x140128c7c
mov eax, dword [0x140228e4c]
add eax, dword [0x140228e48]
mov ecx, eax
not ecx
or eax, 0x69d90b0a
and ecx, 0x10008451
mov edx, eax
and edx, 0xa63670a4
or edx, ecx
xor edx, 0x9ee3e3d5
and eax, 0xc72a6c8e
or eax, edx
mov ecx, eax
not ecx
and ecx, 0x1424d0b5
mov edx, eax
and edx, 0x8b03274a
imul edx, ecx
mov ecx, eax
and ecx, 0x74fcd8b5
or eax, 0x74fcd8b5
imul eax, ecx
add eax, edx
cmp eax, 0x70a21d5d
jb 0x140128cd0
mov eax, dword [0x140228e68]
add eax, dword [0x140228e6c]
mov ecx, eax
xor ecx, 0x4f205a86
and eax, 0x30dfa579
add eax, eax
sub eax, ecx
or eax, 0x104f6dee
add eax, 0xcadfa6d8
cmp eax, 0x58eef2b0
jb 0x140128d30
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, dword [0x140228e58]
add ecx, dword [0x140228e5c]
movsxd rax, dword [rsp + 0x2c]
mov qword [rsp + 0x30], 0
cmp ecx, 0xdb7b5606
jne 0x140128d9c
mov qword [rsp + 0x30], 0
jmp 0x140128d6f
mov qword [rsp + 0x48], rdi
mov ecx, dword [0x140228e60]
mov edx, dword [0x140228e64]
mov r8d, ecx
and r8d, edx
or ecx, edx
not r8d
and r8d, ecx
mov ecx, r8d
and ecx, 0x50000000
not r8d
or ecx, 0x35f9eb5
or r8d, 0xffbe7ffb
and r8d, ecx
cmp r8d, 0xd1b891b3
ja 0x140128def
mov qword [rsp + 0x38], 8
xor ecx, ecx
test cl, cl
je 0x140128dfa
mov qword [rsp + 0x38], 8
jmp 0x140128de0
mov qword [rsp + 0x40], 0
test eax, eax
je 0x140128fde
lea rax, [rsi + rax*8]
mov qword [rsp + 0x50], rax
mov ebp, 8
xor r13d, r13d
lea rbx, [rsp + 0x58]
lea r14, [rsp + 0x30]
mov rdi, rsi
jmp 0x140128e62
add rdi, 8
mov rax, r13
shl rax, 5
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbp + rax + 0x10], xmm1
movups xmmword [rbp + rax], xmm0
inc r13
mov qword [rsp + 0x40], r13
cmp rdi, qword [rsp + 0x50]
je 0x140128fde
mov eax, dword [0x140228e70]
mov ecx, dword [0x140228e74]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
or eax, 0xc738fbff
xor eax, 0xe08c3ff3
cmp eax, 0x381136cb
ja 0x140128fc0
nop word cs:[rax + rax]
mov eax, dword [0x140228e78]
xor edx, edx
div dword [0x140228e7c]
add eax, 0x26daa1eb
xor eax, 0xeefda604
imul r12, rax, 0x5927f3b3
shr r12, 0x3e
mov r15, qword [rdi]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, r15
mov r8, rax
call fcn.1400b7770
cmp r12d, 0x1bda67ab
ja 0x140128fc0
cmp r13, qword [rsp + 0x30]
jne 0x140128e30
mov eax, dword [0x140228e98]
add eax, dword [0x140228e9c]
imul eax, eax, 0xdd3697a5
or eax, 0x4c6fdc6b
imul rax, rax, 0x1b45bdf9
shr rax, 0x3c
cmp eax, 0x5b906b30
jbe 0x140128f40
mov rcx, r14
call fcn.1401298c0
nop word cs:[rax + rax]
mov eax, dword [0x140228ea0]
xor edx, edx
div dword [0x140228ea4]
mov ebp, eax
and eax, 0xa164d26
or ebp, 0xa164d26
add ebp, eax
or ebp, 0xe2a5d982
add ebp, 0x26e4397d
mov rcx, r14
call fcn.1401298c0
cmp ebp, 0x214d1a8c
ja 0x140128f40
mov eax, dword [0x140228ea8]
mov ecx, dword [0x140228eac]
not eax
not ecx
and ecx, eax
not ecx
add ecx, 0x29e9f5af
mov eax, ecx
and eax, 0x1b97f4d7
add eax, eax
sub ecx, eax
add ecx, 0x7801650d
cmp ecx, 0x3b96959f
ja 0x140128f79
mov rbp, qword [rsp + 0x38]
jmp 0x140128e30
mov r15, qword [rdi]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, r15
mov r8, rax
call fcn.1400b7770
jmp 0x140128eb0
mov eax, dword [0x140228e80]
mov ecx, dword [0x140228e84]
not eax
not ecx
mov edx, eax
or edx, ecx
not edx
and ecx, eax
or ecx, edx
not ecx
or ecx, 0x20dd2046
imul eax, ecx, 0x601054d3
cmp eax, 0x84f86b9c
jne 0x140129016
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax]
mov eax, dword [0x140228e88]
mov ecx, dword [0x140228e8c]
not eax
mov edx, eax
and edx, ecx
or eax, ecx
not eax
or eax, edx
mov ebx, eax
and ebx, 0xb32a4a4a
and eax, 0x90224a40
sub ebx, eax
add ebx, 0xd076cb60
and ebx, 0xffffffca
xor ebx, 0xb341b41e
mov rcx, rsi
call rdi
add ebx, 0x8c5a1dbb
jb 0x140129020
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rcx], xmm0
mov eax, 0xd3b1042d
nop
mov ecx, dword [0x140228e90]
mov edx, dword [0x140228e94]
mov r8d, ecx
xor r8d, edx
not r8d
and r8d, edx
add r8d, r8d
sub edx, r8d
add edx, ecx
and edx, 0xd5ee8650
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0x66aca4c7
je 0x140129080
jmp 0x140128d30