Function at 0x14004a3e0
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x14007b010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r9
xor r13d, r13d
mov r8, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14004a436
mov r8, qword [rdx]
mov dword [rsp + 0x30], 0x52514955
mov word [rsp + 0x34], pe_nt_image_headers64
mov rcx, r13
nop dword [rax + rax]
lea eax, [rcx + 0x1b]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x14004a450
mov byte [rsp + 0x35], 0
mov rdx, rdi
cmp qword [r9 + 0x18], 0x10
jb 0x14004a472
mov rdx, qword [r9]
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14004a47f
mov rcx, qword [r14]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], r13
mov qword [r12 + 0x18], r13
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004a4c0
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14004a6ba
mov qword [r12 + 0x18], 0xf
cmp rbx, 0x10
jae 0x14004a50a
mov qword [r12 + 0x10], rbx
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r12], 0
jmp 0x14004a5a5
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14004a53f
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140067c3c
test rax, rax
je 0x14004a56a
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x14004a583
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004a571
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004a6c0
jmp 0x14004a524
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004a580
call fcn.140067c3c
mov rbp, rax
jmp 0x14004a583
mov rbp, r13
mov qword [r12], rbp
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], rsi
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rbp], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14004a5df
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x14004a5da
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a6a5
mov rcx, r8
call fcn.140067560
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x14004a629
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14004a624
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a6ac
mov rcx, r8
call fcn.140067560
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14004a66f
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004a66a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a6b3
mov rcx, r8
call fcn.140067560
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rax, r12
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140067470
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14003efb0
int3
call fcn.14002da70
int3