Function at 0x14020ee50
Capabilities:
Encode data using xor
Get disk information
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
xor edi, edi
mov dword [rbp + 0x1c0], 0x30564046
mov ecx, edi
mov word [rbp + 0x1c4], 0x36
movsxd rax, ecx
xor byte [rbp + rax + 0x1c0], cl
inc ecx
cmp ecx, 5
jb 0x14020ee81
lea rax, [rbp + 0x1c0]
mov dword [rsp + 0x48], 0x52
mov qword [rsp + 0x40], rax
mov ecx, edi
mov dword [rsp + 0x4c], 0x43
mov dword [rbp + 0x1c0], 0x564046
nop word [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax + 0x1c0], cl
inc ecx
cmp ecx, 3
jb 0x14020eec0
lea rax, [rbp + 0x1c0]
mov dword [rsp + 0x58], 0x36
mov qword [rsp + 0x50], rax
mov ecx, edi
xor eax, eax
mov dword [rsp + 0x5c], 0x27
mov byte [rbp + 0x1c4], al
mov dword [rbp + 0x1c0], 0x5044554e
movsxd rax, ecx
xor byte [rbp + rax + 0x1c0], cl
inc ecx
cmp ecx, 4
jb 0x14020ef01
lea rax, [rbp + 0x1c0]
mov dword [rsp + 0x68], 3
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x6c], 0x48
call qword [sym.imp.kernel32.dll_GetLogicalDrives]
mov r13b, 0x41
mov qword [rsp + 0x2d8], r12
mov ebx, eax
mov dword [rbp + 0x1c0], eax
test bl, 1
je 0x14020f02f
movzx r9d, r13b
lea r8, [0x1404ce718]
mov edx, 0xc
lea rcx, [rsp + 0x70]
call fcn.140204ad0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rsp + 0x70]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.kernel32.dll_CreateFileA]
mov r12, rax
test rax, rax
je 0x14020f02f
xor r9d, r9d
mov dword [rbp + 0x1c8], edi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14020f17a
lea r9, [rbp + 0x1c8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
lea rdx, [rbp - 0x80]
mov rcx, r12
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x14020f17a
mov r14d, edi
lea rbx, [rsp + 0x48]
nop dword [rax]
mov rcx, qword [rbx - 8]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x14020f000
mov eax, dword [rbx]
lea rdx, [rbp - 0x80]
add rdx, rax
call fcn.1403ddfe0
test eax, eax
je 0x14020f060
inc r14d
add rbx, 0x10
cmp r14d, 3
jb 0x14020eff0
mov ebx, dword [rbp + 0x1c0]
shr ebx, 1
inc r13b
mov dword [rbp + 0x1c0], ebx
cmp r13b, 0x5a
jle 0x14020ef47
mov r12, qword [rsp + 0x2d8]
mov al, 1
add rsp, 0x280
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ebx, edi
call fcn.1403df848
mov r15d, eax
cmp eax, 0x7f00
jl 0x14020f08a
cmp ebx, 0x80
jae 0x14020f08a
inc ebx
call fcn.1403df848
mov r15d, eax
cmp eax, 0x7f00
jge 0x14020f071
mov ebx, edi
call fcn.1403df848
mov esi, eax
cmp eax, 0x7f00
jl 0x14020f0b8
nop word [rax + rax]
cmp ebx, 0x80
jae 0x14020f0b8
inc ebx
call fcn.1403df848
mov esi, eax
cmp eax, 0x7f00
jge 0x14020f0a0
mov ebx, edi
call fcn.1403df848
mov edi, eax
cmp eax, 0x7f00
jl 0x14020f0e0
cmp ebx, 0x80
jae 0x14020f0e0
inc ebx
call fcn.1403df848
mov edi, eax
cmp eax, 0x7f00
jge 0x14020f0c8
xor ebx, ebx
call fcn.1403df848
cmp eax, 0x7f00
jl 0x14020f106
nop
cmp ebx, 0x80
jae 0x14020f106
inc ebx
call fcn.1403df848
cmp eax, 0x7f00
jge 0x14020f0f0
shl eax, 8
xor r9d, r9d
movzx ecx, dil
xor r8d, r8d
or ecx, eax
xor edi, edi
shl ecx, 8
xor edx, edx
movzx eax, sil
or ecx, eax
mov dword [rbp + 0x1d0], edi
shl ecx, 8
movzx eax, r15b
or ecx, eax
mov eax, r14d
add rax, rax
mov eax, dword [rsp + rax*8 + 0x4c]
mov dword [rbp + rax - 0x80], ecx
mov rcx, r12
call qword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14020f174
lea r9, [rbp + 0x1d0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
lea rdx, [rbp - 0x80]
mov rcx, r12
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x14020f029
mov ebx, dword [rbp + 0x1c0]
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x14020f02f