Function at 0x14004a6d0
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x14007b010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r9
xor r13d, r13d
mov r8, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14004a726
mov r8, qword [rdx]
mov dword [rsp + 0x30], 0x52514955
mov word [rsp + 0x34], pe_nt_image_headers64
mov rcx, r13
nop dword [rax + rax]
lea eax, [rcx + 0x1b]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x14004a740
mov byte [rsp + 0x35], 0
mov rdx, rdi
cmp qword [r9 + 0x18], 0x10
jb 0x14004a762
mov rdx, qword [r9]
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14004a76f
mov rcx, qword [r14]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], r13
mov qword [r12 + 0x18], r13
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004a7b0
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14004a9aa
mov qword [r12 + 0x18], 0xf
cmp rbx, 0x10
jae 0x14004a7fa
mov qword [r12 + 0x10], rbx
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rbx], 0
jmp 0x14004a895
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14004a82f
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140067c3c
test rax, rax
je 0x14004a85a
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x14004a873
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004a861
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004a9b0
jmp 0x14004a814
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004a870
call fcn.140067c3c
mov rbp, rax
jmp 0x14004a873
mov rbp, r13
mov qword [r12], rbp
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], rsi
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rbp], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14004a8cf
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x14004a8ca
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a995
mov rcx, r8
call fcn.140067560
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x14004a919
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14004a914
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a99c
mov rcx, r8
call fcn.140067560
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14004a95f
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004a95a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a9a3
mov rcx, r8
call fcn.140067560
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rax, r12
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140067470
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14003efb0
int3
call fcn.14002da70
int3