Function at 0x3600c9e8
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x208
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov r14, r9
mov dil, r8b
mov sil, dl
mov rbp, rcx
xor r15d, r15d
mov dword [rsp + 0x98], r15d
mov rax, qword [0x3601c018]
mov qword [rsp + 0xb8], rax
call fcn.36005750
mov r8d, 0x104
lea rdx, [rsp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xb8]
call fcn.36008eac
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600cbd4
mov rax, qword [rax + 0x1a8]
movabs rcx, 0x6b77de9e7e2361eb
sub rax, rcx
mov edx, 0xb23d5ceb
mov ecx, 0xaa3a90d9
mov r9d, 0x2b1e2dc
mov r8d, 0xb029cbd3
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x160]
movabs rcx, 0x88398b40f8ff091d
or rax, rcx
mov dword [rsp + 0x30], 0xead6882f
mov dword [rsp + 0x28], 0x7bf1c64a
mov dword [rsp + 0x20], 0x5cd4a431
mov edx, 0xc6e7da45
mov ecx, 0x19bb8d4b
mov r9d, 0xc8ff70ac
mov r8d, 0xfc58855
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x220]
movabs rcx, 0x34d8fccd18df2fd4
imul rax, rcx
mov ecx, 0xcaf9167c
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x80]
movabs rcx, 0xecb6ce134e81b401
imul rax, rcx
mov edx, 0xb3ddd686
mov ecx, 0xccaeefbf
mov r8d, 0x8eca5e93
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x280]
movabs rcx, 0x5b741782afb0ef51
sub rax, rcx
mov dword [rsp + 0x28], 0x9c7b05d7
mov dword [rsp + 0x20], 0x81d387de
mov edx, 0x4dfed3fc
mov ecx, 0xb0410ddc
mov r9d, 0xbd6bcde1
mov r8d, 0x3c321331
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x1d8]
xor edx, edx
movabs rcx, 0xbb5c6f7337672e24
div rcx
mov edx, 0x6649aa24
mov ecx, 0x34d878f7
mov r8d, 0xe3ca47b3
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x2c8]
movabs rcx, 0x3979adda354b28cf
sub rax, rcx
mov edx, 0xb7d57ec1
mov ecx, 0x672a7c09
call rax
mov dword [rsp + 0xc0], r15d
xor edx, edx
lea r8d, [rdx + 0x14]
lea rcx, [rsp + 0xc4]
call fcn.36010e70
lea rcx, [rsp + 0xc0]
call fcn.3600a6a0
or r13d, 0xffffffff
cmp al, r15b
jne 0x3600cd63
mov rax, qword [0x3601c018]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0xa8]
call fcn.360097c0
nop
mov rbx, qword [rax]
cmp rbx, r15
jne 0x3600cc33
mov eax, r15d
jmp 0x3600cc3c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.360069e0
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600cc84
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r15d
jg 0x3600cc84
mov rcx, qword [rsp + 0xa8]
add rcx, 0xfffffffffffffff4
call fcn.36010af8
mov byte [rsp + 0x258], 0x2a
lea r8, [rsp + 0x258]
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.360069e0
lea rcx, [rsp + 0xa0]
call fcn.3600974c
nop
mov rbx, qword [rax]
cmp rbx, r15
jne 0x3600ccc1
mov eax, r15d
jmp 0x3600ccca
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.360069e0
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600cd12
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r15d
jg 0x3600cd12
mov rcx, qword [rsp + 0xa0]
add rcx, 0xfffffffffffffff4
call fcn.36010af8
mov ebx, 0xc
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.36007074
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xcc]
call fcn.36010b20
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600cd63
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r15d
jg 0x3600cd63
call fcn.36010af8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600cdde
mov rax, qword [rax + 0x188]
movabs rcx, 0x4012e0adfaab6f2f
add rax, rcx
mov edx, 0x213d6a8b
mov ecx, 0x3bc5eab4
mov r9d, 0xbab40bcd
mov r8d, 0xce1fe0b6
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x168]
movabs rcx, 0xc2ea8ad8ad68c103
xor rax, rcx
mov edx, 0x8f92a039
mov ecx, 0x2d588683
mov r9d, 0xa40674ed
mov r8d, 0x260a7f32
call rax
mov ebx, dword [rsp + 0x58]
or ebx, 1
mov eax, ebx
or eax, 2
and ebx, 0xfffffffd
cmp sil, r15b
cmovne ebx, eax
call fcn.3600af68
mov ecx, ebx
or ecx, 4
and ebx, 0xfffffffb
cmp al, r15b
cmovne ebx, ecx
mov eax, ebx
mov r12d, 8
or eax, r12d
and ebx, 0xfffffff7
cmp dil, r15b
cmovne ebx, eax
mov dword [rsp + 0x58], ebx
mov rdx, qword [rsp + 0xb8]
lea rsi, [rdx - 0xc]
cmp dword [rsi], r15d
jl 0x3600ce36
mov qword [rsp + 0x78], rdx
lock add dword [rsi], 1
jmp 0x3600ce4c
mov rax, qword [0x3601c018]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.36008eac
lea rax, [rsp + 0x78]
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x8c], r15d
lea rdx, [rsp + 0x8c]
mov rcx, qword [rsp + 0x78]
call fcn.360045c4
mov edi, r15d
mov ecx, dword [rsp + 0x8c]
add ecx, 0xfffffffd
cmp ecx, r15d
jle 0x3600ce9f
mov rdx, rax
lea r8d, [rcx - 1]
shr r8d, 2
inc r8d
xor edi, dword [rdx]
add rdx, 4
sub r8, 1
jne 0x3600ce93
cmp rax, r15
je 0x3600cead
mov rcx, rax
call fcn.36010af0
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600cedc
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
cmp eax, r15d
jg 0x3600cedc
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff4
call fcn.36010af8
mov dword [rsp + 0x5c], edi
mov rax, qword [0x3601c018]
mov qword [rsp + 0x90], rax
mov byte [rsp + 0x260], 0x63
lea r8, [rsp + 0x260]
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.360069e0
mov byte [rsp + 0x268], 0x3a
lea r8, [rsp + 0x268]
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.360069e0
mov byte [rsp + 0x40], 0x5c
lea r8, [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.360069e0
mov dword [rsp + 0x88], r15d
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov r13d, dword [rsp + 0x88]
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x3601c010]
je 0x3600cfb1
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r15d
jg 0x3600cfb1
call fcn.36010af8
mov dword [rsp + 0x60], r13d
call fcn.36007cf4
mov dword [rsp + 0x64], eax
mov ecx, dword [rsp + 0xcc]
mov dword [rsp + 0x68], ecx
mov edx, dword [rsp + 0xd0]
mov dword [rsp + 0x6c], edx
mov r8d, dword [rsp + 0xd4]
mov dword [rsp + 0x70], r8d
mov r9, qword [0x3601d400]
cmp r9, r15
je 0x3600d0b5
mov rax, qword [r9 + 0x1c8]
movabs rcx, 0x25375f58f965345b
add rax, rcx
mov ecx, 0x3f55402e
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0xb8]
movabs rcx, 0x2eaeb33667b549e9
add rax, rcx
mov dword [rsp + 0x28], 0x4cb02f99
mov dword [rsp + 0x20], 0x8561b0bd
mov edx, 0x97818002
mov ecx, 0x7722a9ba
mov r9d, 0x7c61549b
mov r8d, 0x6f71c1ed
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x250]
xor edx, edx
movabs rcx, 0x43c321968ee6dfc
div rcx
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x2f0]
xor edx, edx
movabs rcx, 0x4148c21c368dc6de
div rcx
mov edx, 0x9065e93f
mov ecx, 0xf78f1839
mov r9d, 0x7c5e0c35
mov r8d, 0x4cc8284
call rax
mov r8d, dword [rsp + 0x70]
mov edx, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x64]
xor edi, dword [rsp + 0x58]
xor edi, r13d
xor edi, eax
xor edi, ecx
xor edi, edx
xor edi, r8d
mov dword [rsp + 0x74], edi
mov dword [r14], edi
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x54], r15d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.360039d8
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600d2a8
mov rax, qword [rax + 0x1c0]
movabs rcx, 0xfbde9e889aa2b2c1
or rax, rcx
mov dword [rsp + 0x28], 0xfd91d471
mov dword [rsp + 0x20], 0x6b33f0e0
mov edx, 0xe40f68ce
mov ecx, 0x29e61c1f
mov r9d, 0x3c7ff26d
mov r8d, 0x6f6c09ba
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0xa8]
movabs rcx, 0x1062008ec22a13a7
add rax, rcx
mov dword [rsp + 0x28], 0xa5ba5e61
mov dword [rsp + 0x20], 0x47cfda5d
mov edx, 0x13c6f0b1
mov ecx, 0xd044fce5
mov r9d, 0xb3c33b09
mov r8d, 0x185a666b
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x130]
movabs rcx, 0xaebfe8f483fc5a65
or rax, rcx
mov edx, 0xab2173
mov ecx, 0x5939e9bf
mov r8d, 0x17982a55
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x268]
xor edx, edx
movabs rcx, 0x37d4a70ab4127780
div rcx
mov r10, rdx
mov dword [rsp + 0x30], 0xdb06886a
mov dword [rsp + 0x28], 0x4bc93ea6
mov dword [rsp + 0x20], 0xbe02b200
mov edx, 0x597ca195
mov ecx, 0x8bf91a26
mov r9d, 0xe3f61631
mov r8d, 0x527ab1f5
call r10
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x110]
xor edx, edx
movabs rcx, 0xe9ba020161ba9ad8
div rcx
mov r10, rdx
mov dword [rsp + 0x28], 0x36491261
mov dword [rsp + 0x20], 0x9653ab3
mov edx, 0xe67315df
mov ecx, 0x9b835e97
mov r9d, 0xfd5d58c8
mov r8d, 0x682035b9
call r10
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x78]
movabs rcx, 0x4dfa94c9088ea463
xor rax, rcx
mov edx, 0x144897f3
mov ecx, 0x9251b187
mov r9d, 0x79d657f6
mov r8d, 0x17f1cac7
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x2a8]
movabs rcx, 0xc465ae9bec1cb761
xor rax, rcx
mov edx, 0xc9c2d630
mov ecx, 0x7ecfb4fb
mov r9d, 0xdc2c9eca
mov r8d, 0x53babe14
call rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.360039d8
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600d374
mov rax, qword [rax + 0x298]
movabs rcx, 0x75f8a22b153fbf60
add rax, rcx
mov edx, 0x4f9337d9
mov ecx, 0xa6a0e8da
mov r9d, 0xe1357dd2
mov r8d, 0x95c669c6
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x198]
movabs rcx, 0xdb859afda39f8245
imul rax, rcx
mov dword [rsp + 0x28], 0x961db32
mov dword [rsp + 0x20], 0x16bd974f
mov edx, 0x23b2fc7f
mov ecx, 0xaa470323
mov r9d, 0xaffa0b3a
mov r8d, 0xcf592daf
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x240]
movabs rcx, 0x2510709c49b82cba
sub rax, rcx
mov edx, 0x678cc1db
mov ecx, 0xc5834de6
mov r8d, 0xf306b4d5
call rax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.360039d8
mov r11d, dword [rsp + 0x60]
mov dword [rsp + 0x48], r11d
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.360039d8
mov r11, qword [0x3601c018]
mov qword [rbp], r11
mov dword [rsp + 0x98], 1
lea rdi, [rsp + 0x58]
mov edx, dword [rdi]
lea rcx, [rsp + 0xb0]
call fcn.36009ce8
nop
mov rbx, qword [rax]
cmp rbx, r15
jne 0x3600d40c
mov eax, r15d
jmp 0x3600d415
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, rbx
mov edx, eax
mov rcx, rbp
call fcn.360069e0
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600d457
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r15d
jg 0x3600d457
mov rcx, qword [rsp + 0xb0]
add rcx, 0xfffffffffffffff4
call fcn.36010af8
add rdi, 4
sub r12, 1
jne 0x3600d3ef
mov rcx, rbp
call fcn.360071d0
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_CharLowerA]
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600d5b9
mov rax, qword [rax + 0x228]
xor edx, edx
movabs rcx, 0xd19e36d42f716d5a
div rcx
mov r10, rdx
mov edx, 0xe75511e3
mov ecx, 0xf52defcd
mov r9d, 0xcef842f7
mov r8d, 0xf4fb2e60
call r10
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x158]
movabs rcx, 0x54aca5643f016f33
add rax, rcx
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x188]
movabs rcx, 0xac2723a883c06f96
imul rax, rcx
mov ecx, 0x50a9215c
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x1e8]
xor edx, edx
movabs rcx, 0x3e113df89549655c
div rcx
mov ecx, 0xa905222c
call rdx
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0xc8]
xor edx, edx
movabs rcx, 0x5519518caacc3152
div rcx
mov r10, rdx
mov dword [rsp + 0x28], 0xb3db3d40
mov dword [rsp + 0x20], 0xa564f30b
mov edx, 0xc9144c2a
mov ecx, 0xdc7ac936
mov r9d, 0xcd5afbbd
mov r8d, 0x2786adaf
call r10
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x160]
movabs rcx, 0x746ee1c28b983f83
imul rax, rcx
mov edx, 0x75f36f5e
mov ecx, 0x1137509
mov r9d, 0xb84ae745
mov r8d, 0x872b99cd
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x300]
movabs rcx, 0x2a23706b74e6579a
add rax, rcx
mov ecx, 0x961ef772
call rax
nop
cmp rsi, qword [0x3601c010]
je 0x3600d5d8
or eax, 0xffffffff
lock xadd dword [rsi], eax
dec eax
cmp eax, r15d
jg 0x3600d5d8
mov rcx, rsi
call fcn.36010af8
mov rax, rbp
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret