Function at 0x180066ea4
Capabilities:
Delete file
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x31d0
call fcn.180082cd0
sub rsp, rax
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov qword [rsp + 0x3228], rbx
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x31c0], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
call fcn.180065fcc
mov ecx, 8
call fcn.18006ea94
xor r14d, r14d
cmp rax, r14
je 0x180066f10
lea rcx, [rsp + 0xc0]
mov qword [rax], rcx
jmp 0x180066f13
mov rax, r14
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], r14
mov rdx, rdi
lea rcx, [rsp + 0xc0]
call fcn.180068804
nop
mov rcx, qword [rsp + 0xe0]
sub rcx, qword [rsp + 0xd8]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edx, r14d
jg 0x180066f88
lea rcx, [rsp + 0xc0]
call fcn.18004d450
xor eax, eax
jmp 0x180067792
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x7c], 5
mov dword [rsp + 0x80], 3
mov dword [rsp + 0x84], 7
or r15, 0xffffffffffffffff
mov rdi, r15
mov qword [rsp + 0xf0], r15
mov ebx, r14d
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, dword [rbp]
mov edx, 0x80000000
mov rcx, r12
call qword [0x1800bfe40]
mov rsi, rax
cmp rdi, r15
je 0x180067005
cmp rdi, r14
je 0x180067005
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, rsi
mov qword [rsp + 0xf0], rsi
cmp rsi, r14
je 0x18006701a
cmp rsi, r15
jne 0x180067025
inc ebx
add rbp, 4
cmp ebx, 4
jb 0x180066fc5
cmp rsi, r14
je 0x18006776f
cmp rsi, r15
je 0x18006776f
mov byte [rsp + 0x1c0], r14b
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x1c1]
call fcn.1800729a0
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x1c0]
call fcn.18006496c
cmp eax, r14d
jne 0x18006708a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.18004d450
xor eax, eax
jmp 0x180067792
mov ecx, 8
call fcn.18006ea94
cmp rax, r14
je 0x1800670a3
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
jmp 0x1800670a6
mov rax, r14
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x40], r14b
lea r8, [rsp + 0x40]
mov ebx, 0x40
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180068f74
nop
cmp dword [rsp + 0xa78], 0x63636573
sete al
cmp al, r14b
je 0x180067121
mov rdi, qword [rsp + 0x60]
cmp rdi, qword [rsp + 0x68]
jbe 0x1800670ec
call fcn.18006e940
mov rax, qword [rsp + 0x48]
cmp rax, r14
jne 0x180067100
call fcn.18006e940
mov r11, r14
jmp 0x180067103
mov r11, qword [rax]
cmp rdi, qword [r11 + 0x20]
jb 0x18006710e
call fcn.18006e940
mov rcx, rdi
lea rdx, [rsp + 0xa7c]
mov r8, rbx
call fcn.18006f6e0
mov ebx, r14d
cmp dword [rsp + 0x360], r14d
jbe 0x18006772b
mov ebp, r14d
mov r12d, sendto
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov eax, ebp
lea rdx, [rsp + rax + 0x364]
mov r8d, 0xa
lea rcx, [rsp + 0x88]
call fcn.180006440
nop
mov r12d, ebx
mov rax, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
sub rax, rdi
cmp rax, r12
jbe 0x1800676ca
cmp rdi, qword [rsp + 0x68]
jbe 0x180067196
call fcn.18006e940
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdi
mov r8, r12
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x78]
call fcn.180068b68
mov rdi, rax
mov rcx, qword [rax]
cmp rcx, r14
jne 0x1800671da
call fcn.18006e940
mov rcx, qword [rdi]
cmp rcx, r14
jne 0x1800671da
mov rax, r14
jmp 0x1800671dd
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
cmp qword [rdi + 8], rax
jb 0x1800671ec
call fcn.18006e940
mov rax, qword [rdi + 8]
mov dil, byte [rax]
mov r12d, sendto
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xf8]
call fcn.180004de0
mov byte [rsp + 0x120], dil
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xc0]
call fcn.1800684c8
mov dil, al
cmp qword [rsp + 0x118], 0x10
jb 0x180067264
mov rcx, qword [rsp + 0x100]
call fcn.18006e998
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
cmp qword [rsp + 0xa8], 0x10
jb 0x180067294
mov rcx, qword [rsp + 0x90]
call fcn.18006e998
cmp dil, r14b
jne 0x1800672b0
inc ebx
add ebp, 0xa
cmp ebx, dword [rsp + 0x360]
jb 0x18006713b
jmp 0x18006772b
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x5e4]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x5e4]
lea rcx, [rsp + 0x88]
call fcn.180006440
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x198]
call fcn.180064938
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x180067322
mov rcx, qword [rsp + 0x90]
call fcn.18006e998
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r13
call qword [0x1800bfe40]
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, r14
je 0x18006763f
cmp rax, r15
je 0x18006763f
xor r9d, r9d
xor r8d, r8d
mov ebp, 0x1000
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xb0], r14d
xor eax, eax
mov dword [rsp + 0xb4], eax
lea r8, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae r8, qword [rsp + 0x1a0]
mov edx, ebp
lea rcx, [rsp + 0x21c0]
call fcn.180065ed0
mov byte [rsp + 0x11c0], r14b
xor edx, edx
lea r8d, [rbp - 1]
lea rcx, [rsp + 0x11c1]
call fcn.1800729a0
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
je 0x180067596
mov r15d, 0x3ffff
mov rbx, qword [rsp + 0xb0]
cmp dword [rsp + 0x44], r14d
jbe 0x180067596
lea r9, [rsp + 0x11c0]
mov r10d, 0x100
mov rax, rbx
cqo
mov ecx, 0xfff
and rdx, rcx
add rax, rdx
and rax, rcx
sub rax, rdx
mov r8, rax
cqo
and rdx, r15
add rax, rdx
and rax, r15
sub rax, rdx
shl eax, 4
add rax, qword [0x1800bfae0]
mov rcx, qword [rax]
xor qword [r9], rcx
mov rax, qword [rax + 8]
xor qword [r9 + 8], rax
mov rax, qword [rsp + r8 + 0x21c0]
xor qword [r9], rax
mov rax, qword [rsp + r8 + 0x21c8]
xor qword [r9 + 8], rax
add rbx, 0x10
add r9, 0x10
sub r10, 1
jne 0x18006743c
mov dword [rsp + 0xb0], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xb0]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r14d
je 0x18006750c
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x11c0]
call fcn.1800729a0
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
jne 0x180067423
jmp 0x180067596
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x180067537
mov rcx, qword [rsp + 0x1a0]
call fcn.18006e998
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x18006755e
call fcn.18006e998
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.18004d450
xor eax, eax
jmp 0x180067792
xor r9d, r9d
lea r8, [rsp + 0x66c]
mov edx, dword [rsp + 0x668]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x1800675dd
mov rcx, qword [rsp + 0x1a0]
call fcn.18006e998
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180067604
call fcn.18006e998
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.18004d450
mov eax, 1
jmp 0x180067792
cmp rax, r15
je 0x180067653
cmp rax, r14
je 0x180067653
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x18006766b
mov rcx, qword [rsp + 0x1a0]
call fcn.18006e998
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180067692
call fcn.18006e998
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.18004d450
xor eax, eax
jmp 0x180067792
mov qword [rsp + 0x150], socket
mov qword [rsp + 0x148], r14
mov byte [rsp + 0x138], r14b
mov r8d, 0x1b
lea rdx, str.invalid_vector_T__subscript
lea rcx, [rsp + 0x130]
call fcn.180006440
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x158]
call fcn.1800011b0
lea rdx, [0x1800b7c18]
lea rcx, [rsp + 0x158]
call fcn.18006edc4
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x18006773a
call fcn.18006e998
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.18004d450
xor eax, eax
jmp 0x180067792
cmp rsi, r15
je 0x180067783
cmp rsi, r14
je 0x180067783
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.18004d450
xor eax, eax
mov rcx, qword [rsp + 0x31c0]
xor rcx, rsp
call fcn.18006e130
mov rbx, qword [rsp + 0x3228]
add rsp, 0x31d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret