I have looked at your raw download and at the info in the links I can find on the web:
https://www.uei.com/product/champion-plus/
https://www.amazon.ca/Rogers-Champion-U ... B074XD3Z6D
The first is a UEI page apparently aimed at vendors, the second is a Rogers Telecom version of it. By appearance it is probably an upgrade/replacement for the URC-2025 that has an S3F80 processor. The signature of the URC-2125 is 602015 and remotes with 6-digit signatures starting with a 6 have so far used the Texas Instruments CC2541 processor. However, there are various things that indicate that cannot be the case for the 2125. The raw download shows the length of the E2 data area to be 0x700 bytes, but this size must be a whole number of flash erase pages. The CC2541 has a page size of 0x800 bytes, and although there are other TI processors in that series with a 0x400 byte page size, that doesn't fit either. Also, that range of TI processors is designed to support Bluetooth, as do the three UEI remotes we know about that use it. There is no indication in the links that this remote has a Bluetooth interface. It cannot even be a MAXQ processor, as the ones UEI has used have a 0x200 byte page size and again, that doesn't fit. So what about the Samsung S3F80 again? That has 64K of flash and the raw download shows this has at least 128K.
I see no possibility other than that this uses a processor that we have not seen before. The initial 6 in the signature suggests this is again a Texas Instruments processor, but beyond that I cannot even guess. There are other mysteries too. This remote does follow the segment structure of all recent UEI remotes, but it has three segment types (hex values 27, 2B, 2D) that we have not seen before. These may support features of the new processor that also are new to us.
I see no way I can make any further progress without having one to experiment with. I see that you, ckeays, have kindly offered to donate one if it would help. It would certainly help me, but first I am in the UK which may be expensive in postage costs from Canada and secondly even then I cannot guarantee success. This remote seems sufficiently different from anything we have seen before that it probably requires a cooperate effort between the experts, as did the URC7980 which was the first remote with the TI CC2541 processor.