Function at 0x140009fb0
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x1400e5080]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r9
xor r13d, r13d
mov r8, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14000a006
mov r8, qword [rdx]
mov dword [rsp + 0x30], 0x444b534b
mov word [rsp + 0x34], 0x100
mov rcx, r13
nop dword [rax + rax]
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x14000a020
mov byte [rsp + 0x35], 0
mov rdx, rdi
cmp qword [r9 + 0x18], 0x10
jb 0x14000a042
mov rdx, qword [r9]
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14000a04f
mov rcx, qword [r14]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], r13
mov qword [r12 + 0x18], r13
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000a090
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14000a28a
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
cmp rbx, 0x10
jae 0x14000a0da
mov qword [r12 + 0x10], rbx
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r12], 0
jmp 0x14000a175
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14000a10f
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400ba2e0
test rax, rax
je 0x14000a13a
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x14000a153
mov rsi, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14000a141
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a290
jmp 0x14000a0f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000a150
call fcn.1400ba2e0
mov rbp, rax
jmp 0x14000a153
mov rbp, r13
mov qword [r12], rbp
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], rsi
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rbp], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14000a1af
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x14000a1aa
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a275
mov rcx, r8
call fcn.1400ba040
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r15], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x14000a1f9
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14000a1f4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a27c
mov rcx, r8
call fcn.1400ba040
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r14], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000a23f
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000a23a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a283
mov rcx, r8
call fcn.1400ba040
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rax, r12
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400ba020
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001df0
int3
call fcn.140001d50
int3