Function at 0x140024000
Capabilities:
Delete file
Encode data using xor
Get file size
Hash data with md5
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x240]
call fcn.14002a3f0
mov r8d, 0x104
lea rdx, [rbp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
xor r12d, r12d
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r12b
lea rax, [rbp + 0x240]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x1400240a0
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x60]
call fcn.1400019d0
nop
mov r8d, 8
lea rdx, str.001.dat
lea rcx, [rbp - 0x60]
call fcn.1400028c0
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
lea rax, [rbp + 0x240]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140024101
mov r8, rdi
lea rdx, [rbp + 0x240]
lea rcx, [rsp + 0x78]
call fcn.1400019d0
nop
mov r8d, 8
lea rdx, str.002.dat
lea rcx, [rsp + 0x78]
call fcn.1400028c0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbx
call fcn.140021b90
mov esi, r12d
mov dword [rsp + 0x70], r12d
mov r14, r12
mov qword [rsp + 0x40], r12
lea r15, [rbp + 0x194]
mov qword [rsp + 0x48], r15
mov rax, qword [rbx]
mov rcx, qword [r14 + rax]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 5
lea rcx, [rbp - 0x40]
test rax, rax
je 0x140024195
call fcn.1400012e0
jmp 0x1400241b9
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
xor r8d, r8d
lea rdx, [0x140061cb8]
call fcn.1400019d0
nop
mov rax, qword [rbx]
mov rax, qword [r14 + rax]
mov ecx, dword [rax + 0x78]
mov dword [r15 - 4], ecx
mov dword [r15], r12d
movsxd rax, esi
lea rcx, [rax + rax*2]
lea rdi, [rbp + 0x198]
lea rdi, [rdi + rcx*8]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea edx, [rax + 0x15]
lea rcx, [rbp - 8]
call fcn.1400140b0
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x58], rax
mov rbx, qword [rbp - 8]
mov qword [rsp + 0x50], rbx
cmp rax, 0xffffffffffffffff
je 0x1400244d6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x1400244c7
mov ecx, esi
call fcn.140028424
mov rdi, rax
mov qword [rsp + 0x60], rax
mov dword [rbp - 0x68], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x68]
mov r8d, esi
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400242ca
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x20], 0x67452301
mov dword [rbp + 0x24], 0xefcdab89
mov dword [rbp + 0x28], 0x98badcfe
mov dword [rbp + 0x2c], 0x10325476
mov r8d, esi
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.1400158b0
lea rcx, [rbp + 0x20]
call fcn.1400159b0
movups xmm0, xmmword [rbp + 0x78]
movups xmmword [r15 + 4], xmm0
mov eax, esi
and eax, 0xf
mov ecx, 0x10
sub ecx, eax
add ecx, 0x10
add ecx, esi
call fcn.140028424
mov r13, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
call fcn.14001a8a0
mov r15, qword [rbp - 0x20]
lea r12, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae r12, rbx
test r13, r13
je 0x140024327
test r15, r15
je 0x14002431f
movups xmm0, xmmword [r15]
movups xmmword [r13], xmm0
jmp 0x140024337
xorps xmm0, xmm0
movups xmmword [r13], xmm0
call fcn.14003314c
mov dword [rax], 0x16
call fcn.14002e448
lea rbx, [r13 + 0x10]
mov r9, rsi
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14001c890
movzx ecx, sil
and cl, 0xf
movsx eax, cl
mov edi, 0x10
sub edi, eax
movsx rax, cl
mov r8d, 0x10
sub r8, rax
lea rcx, [r13 + 0x10]
add rcx, rsi
mov edx, edi
call fcn.14002a3f0
add edi, esi
lea esi, [rdi + 0x10]
mov rdx, r12
lea rcx, [rbp + 0x90]
call fcn.140001bf0
movups xmm0, xmmword [r15]
movaps xmmword [rbp + 0x180], xmm0
lea r8, [rbp + 0x180]
test rdi, rdi
je 0x1400243ed
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
mov rax, rbx
sub r8, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400243c0
lea rdx, [rbp + 0x90]
mov rcx, rbx
call fcn.140002300
mov r8, rbx
add rbx, 0x10
sub rdi, 1
jne 0x1400243b0
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002446c
lea r9d, [r12 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp - 0x64], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x64]
mov r8d, esi
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x48]
mov dword [r15], esi
jmp 0x140024471
mov r15, qword [rsp + 0x48]
mov rcx, r13
call fcn.140027b1c
mov rcx, qword [rsp + 0x60]
call fcn.140027b1c
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400244bd
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400244b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024699
call fcn.140027b1c
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x70]
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140024541
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov r8d, 0xa8
lea rdx, [rbp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x10]
cmp rax, 0x10
jb 0x14002457d
lea rdx, [rax + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140024574
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002469f
mov rcx, rbx
call fcn.140027b1c
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400245b8
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400245b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246a5
call fcn.140027b1c
inc esi
mov dword [rsp + 0x70], esi
add r14, 0x10
mov qword [rsp + 0x40], r14
add r15, 0x18
mov qword [rsp + 0x48], r15
cmp esi, 7
jge 0x1400245df
mov rbx, qword [rsp + 0x68]
jmp 0x140024170
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14002461b
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024616
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246ab
call fcn.140027b1c
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140024663
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002465e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024693
call fcn.140027b1c
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140027ad0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002e468
nop
call fcn.14002e468
nop
call fcn.14002e468
nop
call fcn.14002e468
nop
call fcn.14002e468
int3