Function at 0x140127a60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
test rdx, rdx
je 0x140127bdf
mov r14, rdx
mov rcx, rdx
call fcn.140151160
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x140228ca0]
xor edx, edx
div dword [0x140228ca4]
and eax, 0x1ea5e7c5
add eax, 0x740475d1
mov edx, eax
not edx
mov r8d, eax
and r8d, 0xf02c2c15
and edx, 0xed3c3ca
imul edx, r8d
mov r8d, eax
and r8d, 0xe83d3c2
or eax, 0xed3d3ca
imul eax, r8d
add eax, edx
cmp eax, 0x12db2fe1
jb 0x140127a90
nop dword [rax]
mov eax, dword [0x140228ca8]
mov edx, dword [0x140228cac]
mov r8d, eax
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, eax
imul r9d, r8d
mov r8d, eax
and r8d, edx
or eax, edx
imul eax, r8d
add eax, r9d
mov edx, eax
not edx
or eax, 0xd4d78a0d
or edx, 0x2b2875f2
and edx, eax
not edx
add edx, 0x6e36462b
mov eax, edx
and eax, 0x5ba4a2c1
add eax, eax
sub edx, eax
add edx, 0x5ba4a2c1
cmp edx, 0xaae45253
ja 0x140127ae0
test ecx, ecx
je 0x140127c7b
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ebp, eax
mov eax, 0xcd506e57
mov ebx, ebp
nop dword [rax]
mov ecx, dword [0x140228cd0]
mov edx, ecx
not edx
or edx, dword [0x140228cd4]
add ecx, edx
inc ecx
xor ecx, 0xc400816a
or ecx, 0x291f5e94
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x7cc8db37
je 0x140127b60
test ebp, ebp
je 0x140127d98
mov eax, dword [0x140228cd8]
mov ecx, dword [0x140228cdc]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
or ecx, 0x3c4bff
add ecx, 0xbd60664d
mov eax, ecx
not eax
or ecx, 0x286dc5e7
or eax, 0xd7923208
and eax, ecx
cmp eax, 0x475af4f7
jbe 0x140127e15
jmp 0x140127e5f
movabs rax, 0x8000000000000000
mov ecx, dword [0x140228c88]
and ecx, dword [0x140228c8c]
imul ecx, ecx, 0x8d6aeb63
add ecx, 0xa273b820
mov edx, 0x8da8428d
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0x588c38f1
jbe 0x140127c20
mov qword [rsi], rax
nop dword [rax]
mov ecx, dword [0x140228c90]
imul ecx, dword [0x140228c94]
xor ecx, 0x2e61fd29
add ecx, 0x79137e95
not ecx
or ecx, 0x91b6f012
mov qword [rsi], rax
cmp ecx, 0xa3d44a11
ja 0x140127c20
nop dword [rax]
mov eax, dword [0x140228c98]
mov ecx, dword [0x140228c9c]
not eax
not ecx
or ecx, eax
add ecx, 0x6274ea97
and ecx, 0xb9e208ed
cmp ecx, 0xd8723fa9
jae 0x140127c50
jmp 0x140127df0
movabs rax, 0x8000000000000000
mov ecx, dword [0x140228cb8]
and ecx, dword [0x140228cbc]
mov edx, ecx
and edx, 0x6e41cde1
and ecx, 0x6841cd81
add ecx, ecx
sub edx, ecx
imul ecx, edx, 0xdb8bb2ed
add ecx, 0x25d1213d
cmp ecx, 0x75cc4930
jbe 0x140127cc0
mov qword [rsi], rax
nop word [rax + rax]
mov edx, dword [0x140228cc0]
mov r8d, dword [0x140228cc4]
mov ecx, edx
not ecx
mov r9d, r8d
not r9d
mov r10d, ecx
and r10d, 0x252a7990
and edx, 0x1ad5866f
or edx, r10d
or ecx, r9d
and r9d, 0x252a7990
and r8d, 0x1ad5866f
or r8d, r9d
xor r8d, edx
not ecx
or ecx, r8d
add ecx, 0x2d2b15a5
not ecx
or ecx, 0x804800
and ecx, 0x28847840
mov qword [rsi], rax
cmp ecx, 0xc4f4ec2e
je 0x140127cc0
nop word cs:[rax + rax]
mov eax, dword [0x140228cc8]
sub eax, dword [0x140228ccc]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x16716ffe
and ecx, 0xe98e9001
imul ecx, edx
mov edx, eax
and edx, 0xe98e9001
or eax, 0xe98e9001
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
and ecx, 0xd5cea8b
mov edx, eax
and edx, 0x32a31574
imul edx, ecx
mov ecx, eax
and ecx, 0xd5cea8b
or eax, 0xd5cea8b
imul eax, ecx
add eax, edx
or eax, 0xcb3d6425
cmp eax, 0x33f7cea0
jb 0x140127d30
jmp 0x140127df0
mov eax, dword [0x140228cf0]
xor eax, dword [0x140228cf4]
mov ecx, eax
xor ecx, 0x1467ce64
xor eax, 0x48801001
and eax, 0x58c11465
mov edx, ecx
and edx, 0x273eeb9a
imul edx, eax
mov eax, ecx
and eax, 0x58c11465
or ecx, 0x58c11465
imul ecx, eax
add ecx, edx
or ecx, 0xafad729f
cmp ecx, 0x69591ad0
jne 0x1401281f5
jmp 0x140128275
mov eax, dword [0x140228cb0]
xor eax, dword [0x140228cb4]
and eax, 0x8775fdd2
cmp eax, 0x164d9834
je 0x140127df0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15d, dword [0x140228ce0]
mov eax, dword [0x140228ce4]
mov ecx, r15d
not ecx
and ecx, eax
mov edx, eax
not edx
and edx, r15d
imul edx, ecx
mov ecx, r15d
and ecx, eax
or r15d, eax
imul r15d, ecx
add r15d, edx
or r15d, 0xe9aaf8ca
mov ecx, 8
mov rdx, rbx
call fcn.140107940
cmp r15d, 0xbb277301
jne 0x140127e6e
mov ecx, 8
mov rdx, rbx
call fcn.140107940
jmp 0x140127e15
mov rdi, rax
test rax, rax
je 0x140128167
mov eax, dword [0x140228d08]
sub eax, dword [0x140228d0c]
and eax, 0x70658f37
add eax, 0xd57dc8d5
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x102d1533
and ecx, 0xe2d28acc
imul ecx, edx
mov edx, eax
and edx, 0xe5d2cacc
or eax, 0xe7d2cacc
imul eax, edx
add eax, ecx
cmp eax, 0x6619e7cb
jbe 0x140127ed0
mov ecx, ebp
mov rdx, rdi
mov r8, r14
call fcn.140151180
nop dword [rax + rax]
mov eax, dword [0x140228d10]
xor eax, dword [0x140228d14]
mov r15d, eax
not r15d
or r15d, 0xac4024
and eax, 0x88038d80
and r15d, 0x52ac523c
or r15d, eax
not r15d
add r15d, 0x37293bd2
mov ecx, ebp
mov rdx, rdi
mov r8, r14
call fcn.140151180
cmp r15d, 0xaf5e33e8
ja 0x140127ed0
nop dword [rax + rax]
mov ecx, dword [0x140228d18]
imul ecx, dword [0x140228d1c]
imul ecx, ecx, 0xcdeb7f68
mov edx, ecx
xor edx, 0x8d84822d
and ecx, 0x8d848228
or ecx, edx
imul ecx, ecx, 0xe7cd61cd
cmp ecx, 0xd2819bbd
ja 0x140127f20
nop word cs:[rax + rax]
mov ecx, dword [0x140228d20]
imul ecx, dword [0x140228d24]
mov edx, ecx
not edx
mov r8d, ecx
and r8d, 0x751d0091
and edx, 0x8ae2ff6e
imul edx, r8d
mov r8d, ecx
and r8d, 0x8ae2ff6e
or ecx, 0x8ae2ff6e
imul ecx, r8d
add ecx, edx
mov edx, ecx
not edx
and edx, 0x91fff98b
and ecx, 0x6e000674
sub ecx, edx
and ecx, 0xcc15af4b
cmp ecx, 0xa3be986e
ja 0x140127f60
test eax, eax
je 0x1401280fd
mov eax, 0xa2929501
nop dword [rax + rax]
mov ecx, dword [0x140228d58]
mov edx, dword [0x140228d5c]
mov r8d, edx
not r8d
and r8d, ecx
xor edx, ecx
add edx, ecx
sub edx, r8d
add edx, 0xa5ae611c
imul rdx, rax
shr rdx, 0x3e
add edx, 0x2afe783f
cmp edx, 0x61802649
ja 0x140127fd0
movzx eax, byte [rdi]
nop dword [rax + rax]
mov ecx, dword [0x140228d60]
sub ecx, dword [0x140228d64]
mov edx, ecx
not edx
and edx, 0x15994465
mov r8d, ecx
and r8d, 0xa66bb9a
imul r8d, edx
mov edx, ecx
and edx, 0x15994465
or ecx, 0x15994465
imul ecx, edx
add ecx, r8d
not ecx
or ecx, 0xe7e2aa35
mov edx, ecx
not edx
and ecx, 0x43611e7b
mov r8d, edx
and r8d, 0x181c4180
imul r8d, ecx
mov ecx, edx
and ecx, 0x1144a
or edx, 0x43611e7b
imul edx, ecx
add edx, r8d
cmp edx, 0x966375c8
jb 0x140128010
nop word cs:[rax + rax]
mov ecx, dword [0x140228d68]
and ecx, dword [0x140228d6c]
or ecx, 0xa59dd8d1
imul rcx, rcx, 0x40c742c9
shr rcx, 0x3d
cmp ecx, 0x517f9f79
je 0x140128090
cmp al, 1
jne 0x1401281a3
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov eax, dword [0x140228d88]
imul eax, dword [0x140228d8c]
mov ecx, eax
not ecx
or ecx, 0x400d1000
and ecx, 0x470d1b40
and eax, 0x2022c40e
sub eax, ecx
add eax, 0x20f0b56c
cmp eax, 0x9b84f016
jae 0x140128588
jmp 0x1401285cd
movabs rbx, 0x8000000000000000
mov eax, dword [0x140228d28]
xor edx, edx
div dword [0x140228d2c]
mov ecx, eax
xor ecx, 0x182aaf2
add ecx, eax
and eax, 0x27d550d
sub ecx, eax
mov eax, ecx
not eax
mov edx, ecx
or edx, 0xfd01a539
mov r8d, edx
and r8d, 0x98b3f523
and eax, 0x24c0ac4
imul eax, r8d
and edx, 0x674c0adc
or ecx, 0xff4daffd
imul ecx, edx
add ecx, eax
cmp ecx, 0x367a9c11
jae 0x14012841c
jmp 0x140128453
ud2
mov eax, dword [0x140228d98]
or eax, dword [0x140228d9c]
mov ecx, eax
or ecx, 0x5d394f89
not eax
and eax, 0x2403056
mov edx, ecx
and edx, 0xa986c4a0
or edx, eax
xor edx, 0x120b2852
and ecx, 0x4472130c
or ecx, edx
shr ecx, 1
imul rax, rcx, 0x462948e9
shr rax, 0x3d
cmp eax, 0xda2a0fd
jne 0x1401285d3
jmp 0x140128605
mov eax, dword [0x140228cf8]
mov ecx, dword [0x140228cfc]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
xor ecx, 0xd9e4ad6c
add ecx, eax
and eax, 0x261b5293
sub ecx, eax
imul edi, ecx, 0x92c6c2e4
mov eax, edi
not eax
and eax, 0xf8b3971
mov ecx, edi
and ecx, 0xf074c68c
imul ecx, eax
mov eax, edi
and eax, 0xf8b3970
or edi, 0xf8b3971
imul edi, eax
add edi, ecx
mov edx, 1
xor ecx, ecx
mov r8, r14
call fcn.140151180
cmp edi, 0xd10d3290
jae 0x14012828a
mov edx, 1
xor ecx, ecx
mov r8, r14
call qword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1401281f5
test eax, eax
jne 0x140128318
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rax, 0x8000000000000000
mov ecx, dword [0x140228d00]
mov edx, dword [0x140228d04]
mov r8d, ecx
or r8d, edx
not ecx
not edx
and edx, ecx
not edx
and edx, r8d
mov ecx, edx
not ecx
or edx, 0x96c858b3
or ecx, 0x6937a74c
and ecx, edx
not ecx
add ecx, 0x42be9439
mov edx, ecx
not edx
mov r8d, ecx
and r8d, 0xf8a5c9df
and edx, 0x75a3620
imul edx, r8d
mov r8d, ecx
and r8d, 0x75a3620
or ecx, 0x75a3620
imul ecx, r8d
add ecx, edx
cmp ecx, 0x9897d651
jbe 0x14012840a
jmp 0x140128417
mov eax, dword [0x140228d70]
mov ecx, dword [0x140228d74]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
mov eax, ecx
not eax
mov edx, ecx
and edx, 0x3afb57c2
and eax, 0x504a83d
imul eax, edx
mov edx, ecx
and edx, 0x504a83d
or ecx, 0x504a83d
imul ecx, edx
add ecx, eax
and ecx, 0x31212118
cmp ecx, 0x3e4fc6ab
jbe 0x140128367
ud2
mov eax, dword [0x140228d78]
or eax, dword [0x140228d7c]
mov ecx, eax
xor ecx, 0xa912a820
and ecx, eax
or ecx, 0x56a557df
add ecx, 0xb61c4ed5
ud2
mov qword [rsi], rax
xor ecx, ecx
test cl, cl
je 0x140127df0
mov qword [rsi], rax
jmp 0x14012840a
mov ebp, dword [0x140228d30]
sub ebp, dword [0x140228d34]
xor ebp, 0x52250705
add ebp, 0x3ca1a96f
mov eax, ebp
xor eax, 0x3e7f3f8a
or ebp, 0xc180c075
and ebp, eax
call fcn.14014f250
mov qword [rsi], rbx
cmp ebp, 0x678c820c
jae 0x14012845e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsi], rbx
jmp 0x14012841c
mov eax, dword [0x140228d38]
add eax, dword [0x140228d3c]
imul eax, eax, 0x8d8768f3
and eax, 0x6899d9ea
xor eax, 0x9c997f1a
cmp eax, 0xafd0ce04
jae 0x140128488
mov rax, qword [0x14022cb48]
mov eax, 0x847303eb
nop dword [rax]
mov ecx, dword [0x140228d40]
mov edx, dword [0x140228d44]
add ecx, edx
add ecx, 0x35651f6c
shr ecx, 1
imul rcx, rax
shr rcx, 0x3e
mov rsi, qword [0x14022cb48]
cmp ecx, 0x37c33208
je 0x140128490
mov eax, dword [0x140228d48]
mov ecx, dword [0x140228d4c]
mov edx, eax
xor edx, ecx
not edx
or eax, ecx
and eax, edx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x60d6f82f
and ecx, 0x9f2907d0
imul ecx, edx
mov edx, eax
and edx, 0x9f2907d0
or eax, 0x9f2907d0
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
and ecx, 0x2a188481
mov edx, eax
and edx, 0xd5e77b70
imul edx, ecx
mov ecx, eax
and ecx, 0x2a188480
or eax, 0x2a188481
imul eax, ecx
add eax, edx
cmp eax, 0x2662947d
jne 0x140128536
mov rcx, rsi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x140228d50]
xor edx, edx
div dword [0x140228d54]
mov ebx, eax
imul rax, rbx, 0xc68953d
shr rax, 0x20
sub ebx, eax
shr ebx, 1
add ebx, eax
shr ebx, 0x1f
add ebx, 0x2ee0cacd
xor ebx, 0x215f5fe9
mov rcx, rsi
xor edx, edx
mov r8, rdi
call r14
cmp ebx, 0xc7e69af1
jae 0x140128540
jmp 0x140127df0
mov eax, dword [0x140228d90]
mov ecx, dword [0x140228d94]
mov edx, ecx
not edx
and edx, eax
xor ecx, eax
add ecx, eax
sub ecx, edx
mov eax, ecx
not eax
or eax, 0xc665ab6c
add eax, ecx
add eax, 0x35b68253
mov ecx, 0xae258d87
imul rcx, rax
shr rcx, 0x3e
mov qword [rsi + 0x10], rbx
cmp ecx, 0x653b1863
jbe 0x140127df0
mov qword [rsi + 0x10], rbx
jmp 0x140128588
mov eax, dword [0x140228da0]
or eax, dword [0x140228da4]
add eax, 0xb37fcec2
mov ecx, 0xad613621
imul rcx, rax
shr rcx, 0x3e
or ecx, 0xf14670a
ud2
ud2