Function at 0x3600c330
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x208
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov r14, r9
mov dil, r8b
mov sil, dl
mov rbp, rcx
xor r15d, r15d
mov dword [rsp + 0x98], r15d
mov rax, qword [0x3601c018]
mov qword [rsp + 0xb8], rax
call fcn.360052d4
mov r8d, 0x104
lea rdx, [rsp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xb8]
call fcn.360087f4
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600c499
mov rax, qword [rax + 0x1e8]
movabs rcx, 0xd984a8d114c942ef
xor rax, rcx
mov dword [rsp + 0x28], 0xbb6ead51
mov dword [rsp + 0x20], 0x40264052
mov edx, 0xd546799
mov ecx, 0xfd142779
mov r9d, 0x59490704
mov r8d, 0x62b83feb
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x78]
movabs rcx, 0xaca36c33202ad630
xor rax, rcx
mov edx, 0xb8fb9ca4
mov ecx, 0x9eebc62f
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x90]
xor edx, edx
movabs rcx, 0x9ae6a5e5ad199f25
div rcx
mov r10, rdx
mov dword [rsp + 0x30], 0xc6f218dd
mov dword [rsp + 0x28], 0x5f3b896c
mov dword [rsp + 0x20], 0xb51247f5
mov edx, 0xd17a30ad
mov ecx, 0x7dd1b4bc
mov r9d, 0x496f110d
mov r8d, 0x9bcced27
call r10
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x2c8]
movabs rcx, 0x3e170fb32535ad99
or rax, rcx
mov edx, 0xcd5ec23a
mov ecx, 0xf8839dd1
mov r8d, 0x565fc392
call rax
mov dword [rsp + 0xc0], r15d
xor edx, edx
lea r8d, [rdx + 0x14]
lea rcx, [rsp + 0xc4]
call fcn.36010b50
lea rcx, [rsp + 0xc0]
call fcn.36009fe8
or r12d, 0xffffffff
cmp al, r15b
jne 0x3600c628
mov rax, qword [0x3601c018]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0xa8]
call fcn.36009108
nop
mov rbx, qword [rax]
cmp rbx, r15
jne 0x3600c4f8
mov eax, r15d
jmp 0x3600c501
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.360063cc
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600c549
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r15d
jg 0x3600c549
mov rcx, qword [rsp + 0xa8]
add rcx, 0xfffffffffffffff4
call fcn.360107d4
mov byte [rsp + 0x258], 0x2a
lea r8, [rsp + 0x258]
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.360063cc
lea rcx, [rsp + 0xa0]
call fcn.36009094
nop
mov rbx, qword [rax]
cmp rbx, r15
jne 0x3600c586
mov eax, r15d
jmp 0x3600c58f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.360063cc
nop
mov rcx, qword [rsp + 0xa0]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600c5d7
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r15d
jg 0x3600c5d7
mov rcx, qword [rsp + 0xa0]
add rcx, 0xfffffffffffffff4
call fcn.360107d4
mov ebx, 0xc
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.36006ad8
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xcc]
call fcn.36010800
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600c628
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r15d
jg 0x3600c628
call fcn.360107d4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600c6bc
mov rax, qword [rax + 0x178]
movabs rcx, 0x6a1c6bbfd7c6b21d
xor rax, rcx
mov dword [rsp + 0x30], 0x165be1ae
mov dword [rsp + 0x28], 0xfa258787
mov dword [rsp + 0x20], 0x7ef6640d
mov edx, 0xd02224b1
mov ecx, 0xf2129bab
mov r9d, 0x67a9016c
mov r8d, 0xc76bd3d7
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x98]
movabs rcx, 0xa4bfa7b07bc02fbd
imul rax, rcx
mov edx, 0x2228c55d
mov ecx, 0x17d82bde
mov r9d, 0xf4eb57ef
mov r8d, 0xd0d1c783
call rax
mov ebx, dword [rsp + 0x58]
or ebx, 1
mov eax, ebx
or eax, 2
and ebx, 0xfffffffd
cmp sil, r15b
cmovne ebx, eax
call fcn.3600a8b0
mov ecx, ebx
or ecx, 4
and ebx, 0xfffffffb
cmp al, r15b
cmovne ebx, ecx
mov eax, ebx
mov r13d, 8
or eax, r13d
and ebx, 0xfffffff7
cmp dil, r15b
cmovne ebx, eax
mov dword [rsp + 0x58], ebx
mov rdx, qword [rsp + 0xb8]
lea rsi, [rdx - 0xc]
cmp dword [rsi], r15d
jl 0x3600c714
mov qword [rsp + 0x78], rdx
lock add dword [rsi], 1
jmp 0x3600c72a
mov rax, qword [0x3601c018]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.360087f4
lea rax, [rsp + 0x78]
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x8c], r15d
lea rdx, [rsp + 0x8c]
mov rcx, qword [rsp + 0x78]
call fcn.360044f8
mov edi, r15d
mov ecx, dword [rsp + 0x8c]
add ecx, 0xfffffffd
cmp ecx, r15d
jle 0x3600c77d
mov rdx, rax
lea r8d, [rcx - 1]
shr r8d, 2
inc r8d
xor edi, dword [rdx]
add rdx, 4
sub r8, 1
jne 0x3600c771
cmp rax, r15
je 0x3600c78b
mov rcx, rax
call fcn.360107cc
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600c7ba
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
cmp eax, r15d
jg 0x3600c7ba
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff4
call fcn.360107d4
mov dword [rsp + 0x5c], edi
mov rax, qword [0x3601c018]
mov qword [rsp + 0x90], rax
mov byte [rsp + 0x260], 0x63
lea r8, [rsp + 0x260]
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.360063cc
mov byte [rsp + 0x268], 0x3a
lea r8, [rsp + 0x268]
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.360063cc
mov byte [rsp + 0x40], 0x5c
lea r8, [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.360063cc
mov dword [rsp + 0x88], r15d
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov r12d, dword [rsp + 0x88]
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x3601c010]
je 0x3600c88f
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r15d
jg 0x3600c88f
call fcn.360107d4
mov dword [rsp + 0x60], r12d
call fcn.36007690
mov dword [rsp + 0x64], eax
mov ecx, dword [rsp + 0xcc]
mov dword [rsp + 0x68], ecx
mov edx, dword [rsp + 0xd0]
mov dword [rsp + 0x6c], edx
mov r8d, dword [rsp + 0xd4]
mov dword [rsp + 0x70], r8d
mov r9, qword [0x3601d400]
cmp r9, r15
je 0x3600c911
mov rax, qword [r9 + 0x188]
movabs rcx, 0x665cfa9ca14a6e4a
sub rax, rcx
mov dword [rsp + 0x20], 0xaab066ac
mov edx, 0x2c6f05a1
mov ecx, 0x3eb23d3c
mov r9d, 0xd9f699f9
mov r8d, 0xf6fcee0c
call rax
mov r8d, dword [rsp + 0x70]
mov edx, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x64]
xor edi, dword [rsp + 0x58]
xor edi, r12d
xor edi, eax
xor edi, ecx
xor edi, edx
xor edi, r8d
mov dword [rsp + 0x74], edi
mov dword [r14], edi
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x54], r15d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.360039d8
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600caa2
mov rax, qword [rax + 0x178]
movabs rcx, 0x4f749876bc19648c
or rax, rcx
mov dword [rsp + 0x20], 0x2fb7f055
mov edx, 0x90f3dda7
mov ecx, 0x660ebe07
mov r9d, 0x6146277f
mov r8d, 0x78ac3805
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x1c8]
movabs rcx, 0x6b10b5ac351b671e
add rax, rcx
mov edx, 0xf20f3c8f
mov ecx, 0xee171e39
mov r8d, 0xb953a32e
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0xf0]
movabs rcx, 0x766247393d2fca2e
sub rax, rcx
mov edx, 0x1e345164
mov ecx, 0x11a7d3e1
mov r8d, 0xf67313d0
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x158]
xor edx, edx
movabs rcx, 0x5ec85e8401d37352
div rcx
mov dword [rsp + 0x30], 0xd704cd6f
mov dword [rsp + 0x28], 0xd9157ba7
mov dword [rsp + 0x20], 0xa3604d43
mov edx, 0x177acc70
mov ecx, 0xb29aeaa2
mov r9d, 0xe5449297
mov r8d, 0x1b3ca1b0
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0xd0]
xor edx, edx
movabs rcx, 0xa7adc6f7ae7ad175
div rcx
mov edx, 0xcd993e97
mov ecx, 0xba696d84
mov r8d, 0x14998cbb
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0xe0]
xor edx, edx
movabs rcx, 0xac28dbf58b59bbd8
div rcx
mov dword [rsp + 0x20], 0xd03ed8c2
mov edx, 0xa9ad31a6
mov ecx, 0xc6a6bdb3
mov r9d, 0x92601129
mov r8d, 0x5f307aeb
call rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.360039d8
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600cb80
mov rax, qword [rax + 0x298]
movabs rcx, 0x4fb23f5664259c45
or rax, rcx
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x128]
movabs rcx, 0xbd44c5ed1b0cbfa4
or rax, rcx
mov dword [rsp + 0x20], 0x45a2f8ff
mov edx, 0xdcc02644
mov ecx, 0xdc792baa
mov r9d, 0x237248e8
mov r8d, 0x60d7e6b3
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x1d0]
xor edx, edx
movabs rcx, 0x12098c8e1e8682ec
div rcx
mov r10, rdx
mov dword [rsp + 0x20], 0xd62e7c58
mov edx, 0x23d41ee3
mov ecx, 0x210e437f
mov r9d, 0xc8596328
mov r8d, 0x5470bfea
call r10
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x240]
movabs rcx, 0x1595000941041f63
add rax, rcx
call rax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.360039d8
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600cd12
mov rax, qword [rax + 0x2e0]
movabs rcx, 0x44e2f368bd834c39
xor rax, rcx
mov edx, 0x10251323
mov ecx, 0x48d6dd86
mov r9d, 0x6330ca3c
mov r8d, 0x55f34b7a
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x280]
movabs rcx, 0x948fe45ade0730ef
or rax, rcx
mov edx, 0x2351516c
mov ecx, 0x36f081e7
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x298]
movabs rcx, 0xc02ad30a3c1762b1
imul rax, rcx
mov dword [rsp + 0x20], 0x419cbb30
mov edx, 0x9a0bd8f1
mov ecx, 0x7659882c
mov r9d, 0x61f6647
mov r8d, 0x5dc78152
call rax
mov r11, qword [0x3601d400]
mov rax, qword [r11 + 0x80]
movabs rcx, 0x9ab3500bbd4ce697
xor rax, rcx
mov edx, 0x84ff8442
mov ecx, 0x84fd7f58
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x80]
xor edx, edx
movabs rcx, 0xb0c05a19d52c6656
div rcx
mov r8, rdx
mov edx, 0xb8ba4b80
mov ecx, 0x2c5e9532
call r8
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x78]
xor edx, edx
movabs rcx, 0x24ffc9ad67fb9b41
div rcx
mov r8, rdx
mov edx, 0x7b55c6f
mov ecx, 0x9bbb0145
call r8
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x48]
xor edx, edx
movabs rcx, 0xc1f5d5c17f233623
div rcx
mov r10, rdx
mov dword [rsp + 0x28], 0x355ee905
mov dword [rsp + 0x20], 0xa953e94d
mov edx, 0xd8986a7
mov ecx, 0x169870ae
mov r9d, 0x5d531953
mov r8d, 0xebe6e096
call r10
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.360039d8
mov r11, qword [0x3601c018]
mov qword [rbp], r11
mov dword [rsp + 0x98], 1
lea rbx, [rsp + 0x58]
mov edx, dword [rbx]
lea rcx, [rsp + 0xb0]
call fcn.36009630
nop
mov rdi, qword [rax]
cmp rdi, r15
jne 0x3600cd79
mov eax, r15d
jmp 0x3600cd82
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, rdi
mov edx, eax
mov rcx, rbp
call fcn.360063cc
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x3601c010]
je 0x3600cdc4
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r15d
jg 0x3600cdc4
mov rcx, qword [rsp + 0xb0]
add rcx, 0xfffffffffffffff4
call fcn.360107d4
add rbx, 4
sub r13, 1
jne 0x3600cd5c
mov rcx, rbp
call fcn.36006c34
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_CharLowerA]
mov rax, qword [0x3601d400]
cmp rax, r15
je 0x3600ce62
mov rax, qword [rax + 0x2e8]
movabs rcx, 0x7a9f211dab64d512
or rax, rcx
mov edx, 0x45f76169
mov ecx, 0xc3a0d626
mov r9d, 0x7b3988e7
mov r8d, 0x5b6cc081
call rax
mov rax, qword [0x3601d400]
mov rax, qword [rax + 0x310]
xor edx, edx
movabs rcx, 0x18750d5d535ea9b2
div rcx
mov r10, rdx
mov dword [rsp + 0x28], 0x2ee94786
mov dword [rsp + 0x20], 0x6359e1ef
mov edx, 0x6d0f962b
mov ecx, 0x9f955146
mov r9d, 0x52f26db0
mov r8d, 0x63cc2534
call r10
nop
cmp rsi, qword [0x3601c010]
je 0x3600ce81
or eax, 0xffffffff
lock xadd dword [rsi], eax
dec eax
cmp eax, r15d
jg 0x3600ce81
mov rcx, rsi
call fcn.360107d4
mov rax, rbp
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret