Function at 0x5a1c60
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
test rcx, rcx
mov rbp, rcx
mov rbx, rdx
mov r14, r8
je 0x5a1e20
mov eax, dword [0x007f0400]
cmp eax, 9
jg 0x5a2159
cmp eax, 6
je 0x5a2159
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_fseek
xor r12d, r12d
lea rsi, [rsp + 0x50]
jmp 0x5a1cf1
test r12d, r12d
jne 0x5a2144
mov r8, rbx
mov edx, 0x7e
mov rcx, rsi
call sub.msvcrt.dll_fgets
test rax, rax
je 0x5a2197
lea rdx, str.BEGIN_PGP_MESSAGE
mov rcx, rsi
call fcn.005a1bd0
mov dword [rbp + 0x18], eax
not eax
mov r12d, eax
shr r12d, 0x1f
mov rcx, rbx
call sub.msvcrt.dll_feof
test eax, eax
je 0x5a1cb4
mov rcx, rbx
call sub.msvcrt.dll_feof
test eax, eax
je 0x5a1d22
mov eax, 8
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r12d, r12d
je 0x5a1d09
lea r12, [rsp + 0x50]
xor r13d, r13d
nop
mov rcx, rbx
call sub.msvcrt.dll_feof
test eax, eax
jne 0x5a1e37
mov r8, rbx
mov edx, 0x7e
mov rcx, r12
call sub.msvcrt.dll_fgets
test rax, rax
je 0x5a208f
lea rdi, [0x00796a5b]
mov rsi, rax
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x5a1e37
lea rdi, [0x00796a5e]
mov rsi, rax
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x5a1e37
lea rdx, [0x00796a60]
mov rcx, r12
call sub.msvcrt.dll_strstr
test rax, rax
je 0x5a2099
lea rsi, str.Version
mov r8d, 7
lea r15, str.Comment
mov edi, 1
jmp 0x5a1dcb
mov rcx, r15
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, r15
mov rdx, r12
call sub.msvcrt.dll_strncmp
test eax, eax
cmove edi, r13d
add rsi, 8
mov r15, qword [rsi - 8]
test r15, r15
jne 0x5a1dc0
test edi, edi
je 0x5a1d30
cmp dword [0x007f0400], 1
jle 0x5a1d30
lea rdx, str.unknown_header:___s_n
mov r8, r12
mov ecx, 2
call fcn.0051c740
jmp 0x5a1d30
cmp dword [0x007f0400], 1
jg 0x5a216f
mov eax, 0xb
jmp 0x5a1d0e
lea r13, [rsp + 0xd0]
lea r15, [rsp + 0x40]
mov esi, 0xb704ce
nop dword [rax]
mov rcx, rbx
call sub.msvcrt.dll_feof
test eax, eax
jne 0x5a1fb6
mov r8, rbx
mov edx, 0x7e
mov rcx, r12
call sub.msvcrt.dll_fgets
test rax, rax
je 0x5a1fb6
mov r9, r12
mov r8d, dword [r9]
add r9, 4
lea edx, [r8 - 0x1010101]
not r8d
and edx, r8d
and edx, 0x80808080
je 0x5a1e7c
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea rcx, [r9 + 2]
cmove r9, rcx
add dl, dl
sbb r9, 3
sub r9, r12
test r9d, r9d
mov edi, r9d
jle 0x5a1edd
sub r9d, 1
movsxd rcx, r9d
movzx edx, byte [rsp + rcx + 0x50]
cmp dl, 0xa
je 0x5a1f92
cmp dl, 0xd
je 0x5a1f82
cmp byte [rsp + 0x50], 0x3d
jne 0x5a1ef6
mov rcx, rax
call sub.msvcrt.dll_strlen
cmp rax, 5
je 0x5a20ec
xor ecx, ecx
mov qword [rsp + 0x20], r15
mov r9, r13
movsxd r8, edi
mov rdx, r12
mov qword [rsp + 0x40], pe_nt_image_headers64
call fcn.00599290
test al, al
je 0x5a1fb6
mov eax, dword [rbp + 0x10]
mov r8, qword [rsp + 0x40]
test eax, eax
cmove eax, esi
test r8, r8
je 0x5a1f65
lea r10, [0x00796c60]
xor ecx, ecx
xor edx, edx
nop dword [rax]
mov r9d, eax
shr eax, 0x10
xor al, byte [rsp + rdx + 0xd0]
shl r9d, 8
add ecx, 1
mov edx, ecx
movzx eax, al
xor r9d, dword [r10 + rax*4]
cmp r8, rdx
mov eax, r9d
ja 0x5a1f40
and eax, 0xffffff
mov r9, r14
mov edx, 1
mov dword [rbp + 0x10], eax
mov rcx, r13
call sub.msvcrt.dll_fwrite
jmp 0x5a1e50
movsxd rdx, r9d
mov edi, r9d
mov byte [rsp + rdx + 0x50], 0
jmp 0x5a1edd
test r9d, r9d
mov byte [rsp + rcx + 0x50], 0
je 0x5a213d
lea ecx, [rdi - 2]
mov edi, r9d
movsxd rdx, ecx
mov r9d, ecx
movzx edx, byte [rsp + rdx + 0x50]
jmp 0x5a1ed4
xor esi, esi
mov r8, rbx
mov edx, 0x7e
mov rcx, r12
call sub.msvcrt.dll_fgets
test rax, rax
je 0x5a20e4
mov rdx, r12
mov ecx, dword [rdx]
add rdx, 4
lea eax, [rcx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x5a1fd4
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea rcx, [rdx + 2]
cmove rdx, rcx
add al, al
sbb rdx, 3
sub rdx, r12
lea ecx, [rdx - 1]
movsxd r8, ecx
movzx eax, byte [rsp + r8 + 0x50]
cmp al, 0xa
jne 0x5a202a
lea ecx, [rdx - 2]
mov byte [rsp + r8 + 0x50], 0
movsxd rax, ecx
movzx eax, byte [rsp + rax + 0x50]
cmp al, 0xd
je 0x5a20d0
lea rdx, str.END_PGP_MESSAGE
mov rcx, r12
call fcn.005a1bd0
test eax, eax
mov dword [rbp + 0x1c], eax
js 0x5a2051
cmp dword [rbp + 0x18], eax
je 0x5a20dd
mov eax, 8
mov r9d, dword [rbp + 0x10]
xor edx, edx
cmp r9d, esi
sete dl
mov dword [rbp + 0x14], edx
or edx, eax
jne 0x5a1d0e
mov eax, dword [0x007f0400]
cmp eax, 9
jg 0x5a21a9
cmp eax, 6
je 0x5a21a9
mov eax, 9
jmp 0x5a1d0e
mov eax, 0xffffffff
jmp 0x5a1d0e
cmp dword [0x007f0400], 1
jle 0x5a1d09
lea r8, str.armor.c
lea rdx, [0x00796a36]
mov r9d, 0x165
mov ecx, 2
call fcn.0051c740
jmp 0x5a1d09
movsxd rcx, ecx
mov byte [rsp + rcx + 0x50], 0
jmp 0x5a2032
xor eax, eax
jmp 0x5a2056
mov eax, dword [rbp + 0x1c]
jmp 0x5a2048
lea rax, [rsp + 0x48]
lea r8d, [rdi - 1]
lea rdx, [r12 + 1]
lea r9, [rsp + 0x30]
xor ecx, ecx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
movsxd r8, r8d
mov qword [rsp + 0x48], 4
call fcn.00599290
movzx esi, byte [rsp + 0x30]
movzx eax, byte [rsp + 0x31]
shl esi, 0x10
shl eax, 8
or esi, eax
movzx eax, byte [rsp + 0x32]
or esi, eax
jmp 0x5a1fb8
xor edi, edi
jmp 0x5a1edd
mov rcx, rbx
call sub.msvcrt.dll_feof
test eax, eax
jne 0x5a1d09
jmp 0x5a1d27
lea rdx, str.armor_filter:_decode_n
mov ecx, 6
call fcn.0051c740
jmp 0x5a1c9d
lea r8, str.armor.c
lea rdx, [0x00796a36]
mov r9d, 0x13e
mov ecx, 2
call fcn.0051c740
mov eax, 0xb
jmp 0x5a1d0e
mov rcx, rbx
call sub.msvcrt.dll_feof
mov eax, 8
jmp 0x5a1d0e
lea rdx, str.file_crc_08X_afx_crc_08X_n
mov r8d, esi
mov ecx, 6
call fcn.0051c740
mov eax, 9
jmp 0x5a1d0e