Function at 0x180056b00
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x100
mov rax, qword [0x180111618]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rsi, r9
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rbp - 0x79], rdx
mov qword [rbp - 0x71], r8
mov qword [rbp - 0x69], r9
mov r8, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x180056b4f
mov r8, qword [rdx]
mov dword [rsp + 0x50], 0xa9a8b6ac
mov word [rsp + 0x54], pe_nt_image_headers64
xor r12d, r12d
mov ecx, r12d
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 4
jb 0x180056b70
mov byte [rsp + 0x55], r12b
mov rdx, rsi
cmp qword [r9 + 0x18], 0x10
jb 0x180056b92
mov rdx, qword [r9]
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180056b9f
mov rcx, qword [r14]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x64
lea r9, [rbp - 0x61]
lea r8, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [rbp + 0x7f]
test ecx, ecx
je 0x1800573d0
lea eax, [rcx - 1]
mov rbx, 0xffffffffffffffff
cmp eax, 2
jbe 0x180057327
cmp ecx, 4
jne 0x180056c73
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180056c01
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114a8], xmm0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005739a
jmp 0x180057209
cmp ecx, 5
jne 0x180056d12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180056ca0
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114c0], xmm0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800573a0
jmp 0x180057209
cmp ecx, 6
jne 0x180056db4
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180056d40
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
cvttss2si eax, xmm0
mov dword [0x180112e58], eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800573a6
jmp 0x180057209
cmp ecx, 7
jne 0x180056e54
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180056de0
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
cvttss2si eax, xmm0
mov dword [0x180112e5c], eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800573ac
jmp 0x180057209
cmp ecx, 8
jne 0x180056ef2
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180056e80
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114c8], xmm0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800573b2
jmp 0x180057209
cmp ecx, 9
jne 0x180056f92
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180056f20
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114cc], xmm0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800573b8
jmp 0x180057209
cmp ecx, 0xa
jne 0x180057032
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180056fc0
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114d4], xmm0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800573be
jmp 0x180057209
cmp ecx, 0xb
jne 0x1800570d2
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180057060
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114d8], xmm0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800573c4
jmp 0x180057209
cmp ecx, 0xc
jne 0x180057172
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180057100
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114e0], xmm0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800573ca
jmp 0x180057209
cmp ecx, 0xd
jne 0x180057213
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800571a0
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114e4], xmm0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057327
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180057394
call fcn.18006e3e0
jmp 0x180057327
cmp ecx, 0xe
jne 0x180057272
mov qword [rsp + 0x30], r12
movdqa xmm0, xmmword [0x1800aba60]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180057240
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114ec], xmm0
jmp 0x18005731d
cmp ecx, 0xf
jne 0x1800572c5
mov qword [rsp + 0x30], r12
movdqa xmm0, xmmword [0x1800aba60]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180057296
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1801114f0], xmm0
jmp 0x18005731d
cmp ecx, 0x10
jne 0x180057327
mov qword [rsp + 0x30], r12
movdqa xmm0, xmmword [0x1800aba60]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rax, [rbp - 0x61]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800572f0
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.180004420
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18006afe0
movss dword [0x1800ca13c], xmm0
lea rcx, [rsp + 0x30]
call fcn.180002860
mov qword [rdi], r12
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
lea rax, [rbp - 0x61]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180057340
mov r8, rbx
lea rdx, [rbp - 0x61]
mov rcx, rdi
call fcn.180004420
nop
mov rcx, r15
call fcn.180002860
nop
mov rcx, r14
call fcn.180002860
nop
mov rcx, rsi
call fcn.180002860
mov rax, rdi
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.18006e500
add rsp, 0x100
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180075cf4
nop
call fcn.180075cf4
int3
call fcn.180075cf4
int3
call fcn.180075cf4
int3
call fcn.180075cf4
int3
call fcn.180075cf4
int3
call fcn.180075cf4
int3
call fcn.180075cf4
int3
call fcn.180075cf4
int3
call fcn.180075cf4
int3
mov dword [rsp + 0x50], 0x978f81
mov byte [rsp + 0x54], 1
lea rcx, [rsp + 0x50]
call fcn.1800677e0
mov rcx, rax
call fcn.180086168
mov dword [rsp + 0x50], 0x100b8c2
lea rcx, [rsp + 0x50]
call fcn.1800677b0
mov rdx, rax
lea rcx, [0x180113050]
call fcn.180001480
mov rbx, rax
mov dword [rsp + 0x58], 0xc5b6b1a7
mov dword [rsp + 0x5c], 0xddd9c7cb
mov word [rsp + 0x60], pe_nt_image_headers64
lea rcx, [rsp + 0x58]
call fcn.180067810
mov rdx, rax
mov rcx, rbx
call fcn.180001480
mov rbx, rax
movdqa xmm0, xmmword [0x1800abbf0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xdb80819d
mov word [rsp + 0x44], pe_nt_image_headers64
lea rcx, [rsp + 0x30]
call fcn.180067840
mov rdx, rax
mov rcx, rbx
call fcn.180001480
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1800860ac
int3