Function at 0x120ec
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x0001c170]
xor rax, rsp
mov qword [rsp + 0xc8], rax
xor eax, eax
add dword [rcx + 0x18], 0xffffffff
mov rdx, rcx
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x68], rcx
jne 0x127ff
and dword [rsp + 0x50], eax
xor ebx, ebx
xor r15d, r15d
xor r14d, r14d
xor r13d, r13d
xor edi, edi
cmp dword [rcx + 0x14], eax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x78], rdi
jle 0x127ff
lea r12, [rcx + 0x24]
mov qword [rsp + 0x80], r12
mov ebp, dword [r12 + 4]
mov esi, dword [r12]
lea rax, [0x00010000]
and ebp, 0xfffffff
shr rsi, 1
add rbp, rax
and esi, 0xfffffff
mov qword [rsp + 0x40], rbp
cmp rbp, rbx
jb 0x121b4
lea rcx, [r15 + rbx]
lea rax, [rsi + rbp]
cmp rax, rcx
jbe 0x122bd
test r13d, r13d
je 0x121c7
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
and dword [rsp + 0x34], 0
test r14, r14
je 0x121d5
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
and qword [rsp + 0x20], 0
mov edx, 0xfff
mov ecx, ebp
and ecx, edx
mov eax, esi
mov rbx, rbp
and eax, edx
and rbx, 0xfffffffffffff000
xor r9d, r9d
lea r15d, [rcx + rax + 0xfff]
mov rax, rsi
xor r8d, r8d
shr r15d, 0xc
shr rax, 0xc
mov rcx, rbx
add r15d, eax
mov qword [rsp + 0x70], rbx
shl r15d, 0xc
mov edx, r15d
mov qword [rsp + 0x88], r15
mov qword [rsp + 0xa0], r15
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x127d5
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.0001176c
test eax, eax
je 0x127c9
test byte [r14 + 0xa], 5
mov dword [rsp + 0x34], 1
je 0x1226f
mov rdi, qword [r14 + 0x18]
jmp 0x12291
xor r9d, r9d
xor edx, edx
mov rcx, r14
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov rdi, rax
test rdi, rdi
je 0x127bb
mov edx, 4
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
test eax, eax
js 0x127bb
mov rdx, qword [rsp + 0x68]
sub rdi, rbx
mov qword [rsp + 0x78], rdi
lea rax, [rdi + rbp]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x127d5
test byte [r12], 1
jne 0x12789
mov r15d, dword [r12 + 4]
mov rdx, qword [rdx + 8]
and dword [rsp + 0x30], 0
and dword [rsp + 0x38], 0
and r15d, 0xfffffff
mov r9, rsi
xor al, al
mov r13d, r15d
and r9d, 7
not r13d
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0x58], r9
je 0x1252e
xor ebx, ebx
xor edi, edi
xor r11d, r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], edi
test r9d, r9d
jle 0x12372
lea r10d, [rbx + 0x38]
movzx r8d, byte [rbp]
xor al, r8b
cmp r11d, 4
jge 0x12348
lea ecx, [r10 - 0x20]
shl r8d, cl
or edi, r8d
jmp 0x12351
mov ecx, r10d
shl r8d, cl
or ebx, r8d
inc r11d
inc rbp
sub r10d, 8
cmp r11d, r9d
jl 0x1232e
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x40], rbp
movzx ebx, word [rsp + 0xc6]
mov r8d, dword [rsp + 0xc4]
movzx r10d, word [rsp + 0xc2]
movzx r11d, r8w
mov r9d, r13d
movzx edi, dx
sub r9d, edi
xor r9d, r8d
xor r9d, r15d
mov ecx, r9d
sub ecx, ebx
sub ecx, edx
xor r13d, ecx
mov r8d, r13d
mov ecx, r13d
sub r8d, edx
ror r8d, 0xe
imul r8d, r11d
rol ecx, 0xa
add r8d, ecx
xor r9d, r8d
mov r8d, ebx
xor r8d, r9d
mov ecx, r9d
shr ecx, 7
imul r8d, r10d
xor r8d, ecx
xor r13d, r8d
mov r8d, dword [rsp + 0xc4]
sub r8d, r13d
mov ecx, r13d
ror r8d, 0xd
imul r8d, edi
ror ecx, 0x10
xor r8d, ecx
xor r9d, r8d
mov r8d, r9d
mov ecx, r9d
sub r8d, edx
rol r8d, 7
imul r8d, ebx
rol ecx, 4
xor r8d, ecx
xor r13d, r8d
mov r15d, r13d
xor r15d, edx
xor r15d, r9d
mov r9d, dword [rsp + 0xc4]
xor r15d, r9d
mov r8d, r15d
mov ecx, r15d
sub r8d, edi
shr ecx, 1
rol r8d, 3
imul r8d, r10d
xor r8d, ecx
xor r13d, r8d
mov r8d, r13d
mov ecx, r13d
xor r8d, r9d
rol r8d, 0xa
imul r8d, edi
ror ecx, 0xc
xor r8d, ecx
mov ecx, edx
xor r15d, r8d
mov r8d, r15d
xor r8d, r9d
sub ecx, r8d
mov r8d, ebx
xor r13d, ecx
xor r8d, r13d
mov ecx, r13d
rol r8d, 3
imul r8d, r11d
ror ecx, 4
xor r8d, ecx
xor r15d, r8d
xor ebx, r15d
rol ebx, 2
imul ebx, r10d
mov ecx, r15d
xor r10d, r10d
rol ecx, 0xc
sub ebx, ecx
xor r13d, ebx
mov ecx, r13d
lea r8d, [r13 + r9]
xor r13d, dword [rsp + 0x30]
ror r8d, 8
mov r9d, r13d
imul r8d, edi
rol ecx, 2
sub r8d, ecx
mov rcx, qword [rsp + 0x58]
xor r8d, dword [rsp + 0x38]
xor r15d, r8d
mov r8d, r15d
test ecx, ecx
jle 0x124fa
mov r14, qword [rsp + 0x48]
cmp r10d, 4
jge 0x124de
rol r8d, 8
mov byte [r14], r8b
jmp 0x124e5
rol r9d, 8
mov byte [r14], r9b
inc r10d
inc r14
cmp r10d, ecx
jl 0x124cf
mov qword [rsp + 0x48], r14
mov r14, qword [rsp + 0x60]
lea r8d, [rcx - 4]
test r8d, r8d
jle 0x12516
mov ecx, 4
sub ecx, r8d
shl ecx, 3
shr r13d, cl
shl r13d, cl
jmp 0x1252e
xor r13d, r13d
test r8d, r8d
jns 0x1252e
neg r8d
shl r8d, 3
mov ecx, r8d
shr r15d, cl
shl r15d, cl
shr rsi, 3
mov qword [rsp + 0x90], rsi
test rsi, rsi
je 0x12775
movzx r8d, dx
mov r14, rsi
mov dword [rsp + 0x58], r8d
movzx edi, byte [rbp + 1]
movzx esi, byte [rbp]
movzx ebx, byte [rbp + 2]
movzx r11d, byte [rbp + 3]
movzx r8d, byte [rbp + 5]
movzx ecx, byte [rbp + 6]
movzx r10d, byte [rbp + 7]
add qword [rsp + 0x40], 8
movzx r9d, byte [rbp + 4]
mov ebp, r9d
mov r12d, esi
shl ebp, 8
shl r12d, 8
or ebp, r8d
or r12d, edi
shl ebp, 8
shl r12d, 8
or ebp, ecx
or r12d, ebx
shl ebp, 8
shl r12d, 8
or ebp, r10d
xor r10b, cl
or r12d, r11d
xor r10b, r8b
xor r13d, ebp
xor r10b, r9b
mov ecx, r13d
xor r10b, r11b
movzx r11d, word [rsp + 0xc6]
xor r10b, bl
mov ebx, dword [rsp + 0x58]
xor r10b, dil
movzx edi, word [rsp + 0xc2]
xor r10b, sil
xor al, r10b
mov r10d, dword [rsp + 0xc4]
lea r8d, [r13 + r10]
movzx esi, r10w
ror r8d, 8
imul r8d, ebx
rol ecx, 2
sub r8d, ecx
xor r8d, r12d
xor r15d, r8d
mov r8d, r11d
xor r8d, r15d
mov ecx, r15d
rol r8d, 2
imul r8d, edi
rol ecx, 0xc
sub r8d, ecx
xor r13d, r8d
mov r8d, r11d
xor r8d, r13d
mov ecx, r13d
rol r8d, 3
imul r8d, esi
ror ecx, 4
xor r8d, ecx
mov ecx, edx
xor r15d, r8d
mov r8d, r15d
xor r8d, r10d
sub ecx, r8d
xor r13d, ecx
mov r8d, r13d
mov ecx, r13d
xor r8d, r10d
rol r8d, 0xa
imul r8d, ebx
ror ecx, 0xc
xor r8d, ecx
xor r15d, r8d
mov r8d, r15d
mov ecx, r15d
sub r8d, ebx
shr ecx, 1
rol r8d, 3
imul r8d, edi
xor r8d, ecx
xor r13d, r8d
mov r9d, r13d
xor r9d, edx
xor r9d, r15d
xor r9d, r10d
mov ecx, r9d
mov r8d, r9d
sub r8d, edx
rol r8d, 7
imul r8d, r11d
rol ecx, 4
xor r8d, ecx
xor r13d, r8d
mov r8d, r10d
sub r8d, r13d
mov ecx, r13d
ror r8d, 0xd
imul r8d, ebx
ror ecx, 0x10
xor r8d, ecx
xor r9d, r8d
mov r8d, r11d
xor r8d, r9d
mov ecx, r9d
shr ecx, 7
imul r8d, edi
xor r8d, ecx
xor r13d, r8d
mov ecx, r13d
mov r8d, r13d
sub r8d, edx
ror r8d, 0xe
imul r8d, esi
rol ecx, 0xa
add r8d, ecx
xor r9d, r8d
mov ecx, r9d
sub ecx, r11d
sub ecx, edx
xor r13d, ecx
mov rcx, qword [rsp + 0x48]
mov r15d, r13d
xor r13d, dword [rsp + 0x30]
mov dword [rsp + 0x30], ebp
mov rbp, qword [rsp + 0x40]
sub r15d, ebx
mov byte [rcx + 7], r13b
xor r15d, dword [rsp + 0x38]
mov dword [rsp + 0x38], r12d
xor r15d, r9d
xor r15d, r10d
mov byte [rcx + 3], r15b
ror r15d, 8
ror r13d, 8
mov byte [rcx + 2], r15b
ror r15d, 8
mov byte [rcx + 6], r13b
ror r13d, 8
mov byte [rcx + 1], r15b
ror r15d, 8
mov byte [rcx + 5], r13b
ror r13d, 8
mov byte [rcx], r15b
mov byte [rcx + 4], r13b
add rcx, 8
ror r15d, 8
ror r13d, 8
sub r14, 1
mov qword [rsp + 0x48], rcx
jne 0x1254f
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x80]
or dword [r12], 1
mov rdx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov byte [r12 - 4], al
mov eax, dword [rsp + 0x50]
add r12, 0x10
inc eax
mov qword [rsp + 0x80], r12
cmp eax, dword [rdx + 0x14]
mov dword [rsp + 0x50], eax
jge 0x127dd
mov rbx, qword [rsp + 0x70]
mov r13d, dword [rsp + 0x34]
mov r15, qword [rsp + 0x88]
jmp 0x12177
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
and dword [rsp + 0x34], 0
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
xor r14d, r14d
mov dword [rsp + 0x3c], 0x8007000e
cmp dword [rsp + 0x34], 0
je 0x127ed
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
test r14, r14
je 0x127fb
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.000110ac
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret