Function at 0x14004bef0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x29], edi
mov dword [rbp - 0x59], 0xef9aebef
mov dword [rbp - 0x55], 0xd59debe9
mov dword [rbp - 0x51], 0xa6d5dbd5
mov word [rbp - 0x4d], 0xd7
mov byte [rbp - 0x4b], 1
mov ecx, edi
nop word [rax + rax]
lea eax, [rcx - 0x27]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xd
jb 0x14004bf40
mov byte [rbp - 0x4b], dil
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 0x10
jb 0x14004bf6c
mov rax, qword [rbx]
jmp 0x14004bf6f
mov rax, rbx
mov byte [rax], dil
cmp byte [rbp - 0x59], dil
jne 0x14004bf7d
mov r8, rdi
jmp 0x14004bf8e
lea rax, [rbp - 0x59]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x14004bf85
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.140034cf0
mov dword [rbp - 0x29], 1
xor edx, edx
lea rcx, [rbp + 0x27]
call fcn.14004b9c0
nop
mov dl, 1
lea rcx, [rbp - 1]
call fcn.14004b9c0
nop
lea rcx, [rbp - 0x21]
call fcn.14004be20
mov rdx, rax
lea rcx, [rbp - 0x49]
call fcn.14004baf0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140049b70
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x14004c03c
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x14004c037
test cl, 0x1f
je 0x14004c007
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14004c017
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14004c027
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14004c034
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140054a50
mov word [rbp + 0x6f], Ordinal_50
mov byte [rbp + 0x71], 0
lea rax, [rbp + 0x6f]
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14004c050
lea rdx, [rbp + 0x6f]
mov rcx, rbx
call fcn.140049a20
mov dword [rbp + 0x77], 0x87e0ba
mov byte [rbp + 0x7b], 1
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x27]
xor byte [rbp + rcx + 0x77], al
inc rcx
cmp rcx, 3
jb 0x14004c080
mov byte [rbp + 0x7b], 0
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x6f]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, edi
test eax, eax
cmovne edx, dword [rbp + 0x6f]
lea rcx, [rbp - 0x21]
call fcn.140035930
mov rdx, rax
lea rcx, [rbp - 0x49]
call fcn.14004baf0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140049b70
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x14004c145
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x14004c140
test cl, 0x1f
je 0x14004c110
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14004c120
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14004c130
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14004c13d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140054a50
mov word [rbp + 0x6f], Ordinal_50
mov byte [rbp + 0x71], 0
lea rax, [rbp + 0x6f]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c160
lea rdx, [rbp + 0x6f]
mov rcx, rbx
call fcn.140049a20
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x39], rdi
mov byte [rbp - 0x49], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x49]
call fcn.140034e20
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x21]
call fcn.14004baf0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140049b70
nop
mov rax, qword [rbp - 9]
cmp rax, 0x10
jb 0x14004c215
inc rax
mov rcx, qword [rbp - 0x21]
cmp rax, 0x1000
jb 0x14004c210
test cl, 0x1f
je 0x14004c1e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14004c1f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14004c200
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14004c20d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140054a50
mov word [rbp + 0x6f], Ordinal_50
mov byte [rbp + 0x71], 0
lea rax, [rbp + 0x6f]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c230
lea rdx, [rbp + 0x6f]
mov rcx, rbx
call fcn.140049a20
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x39], rdi
mov byte [rbp - 0x49], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x49]
call fcn.140034e20
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x21]
call fcn.14004baf0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140049b70
nop
mov rax, qword [rbp - 9]
cmp rax, 0x10
jb 0x14004c2e6
inc rax
mov rcx, qword [rbp - 0x21]
cmp rax, 0x1000
jb 0x14004c2e0
test cl, 0x1f
je 0x14004c2b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14004c2c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14004c2d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14004c2dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140054a50
nop
mov rax, qword [rbp + 0x17]
cmp rax, 0x10
jb 0x14004c340
inc rax
mov rcx, qword [rbp - 1]
cmp rax, 0x1000
jb 0x14004c33b
test cl, 0x1f
je 0x14004c30b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14004c31b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14004c32b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14004c338
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140054a50
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xf], rdi
mov byte [rbp - 1], 0
mov rax, qword [rbp + 0x3f]
cmp rax, 0x10
jb 0x14004c3aa
inc rax
mov rcx, qword [rbp + 0x27]
cmp rax, 0x1000
jb 0x14004c3a5
test cl, 0x1f
je 0x14004c375
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14004c385
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14004c395
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14004c3a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140054a50
mov rax, rbx
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret