Function at 0x14004e180
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbx
sub rsp, 0x260
mov rbx, qword [0x140083e18]
xor edx, edx
cmp byte [rbx + 6], dl
je 0x14004e4c2
mov r8d, 0x21f
lea rcx, [rsp + 0x34]
call sub.VCRUNTIME140.dll_memset
mov eax, 0xeada2d49
mov dword [rsp + 0x30], 0x550f0231
xor r8d, r8d
lea r9, [0x14006eaf0]
nop dword [rax]
nop word [rax + rax]
movzx ecx, al
movzx edx, byte [rsp + r8 + 0x30]
xor rdx, rcx
shr eax, 8
movzx ecx, byte [rsp + r8 + 0x31]
xor eax, dword [r9 + rdx*4]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x32]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x33]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x34]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x35]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x36]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x37]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x38]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x39]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x3a]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x3b]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x3c]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x3d]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x3e]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x3f]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x40]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x41]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x42]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x43]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x44]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x45]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x46]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x47]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x48]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x49]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x4a]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x4b]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x4c]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x4d]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x4e]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x4f]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x50]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x51]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x52]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x53]
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
movzx edx, byte [rsp + r8 + 0x54]
add r8, 0x25
movzx ecx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [r9 + rdx*4]
cmp r8, 0x4a
jb 0x14004e1d0
mov edx, eax
mov byte [rsp + 0x7a], al
shr edx, 8
mov r8d, 0x223
mov byte [rsp + 0x7b], dl
mov edx, eax
shr edx, 0x10
shr eax, 0x18
mov byte [rsp + 0x7d], al
mov byte [rsp + 0x7c], dl
jmp 0x14004e4e4
mov r8d, 0x220
lea rcx, [rsp + 0x33]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x40
mov word [rsp + 0x30], 0xf02
mov byte [rsp + 0x32], 0x55
mov rcx, qword [rbx + 0x60]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x260
pop rbx
ret