Function at 0x180036594
Capabilities:
Delete file
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x31d0
call fcn.18006dc60
sub rsp, rax
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov qword [rsp + 0x3228], rbx
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x31c0], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
call fcn.180035768
mov ecx, 8
call fcn.180058f28
xor r14d, r14d
cmp rax, r14
je 0x180036600
lea rcx, [rsp + 0xc0]
mov qword [rax], rcx
jmp 0x180036603
mov rax, r14
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], r14
mov rdx, rdi
lea rcx, [rsp + 0xc0]
call fcn.180037ddc
nop
mov rcx, qword [rsp + 0xe0]
sub rcx, qword [rsp + 0xd8]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edx, r14d
jg 0x180036678
lea rcx, [rsp + 0xc0]
call fcn.180037888
xor eax, eax
jmp 0x180036e82
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x7c], 5
mov dword [rsp + 0x80], 3
mov dword [rsp + 0x84], 7
or r15, 0xffffffffffffffff
mov rdi, r15
mov qword [rsp + 0xf0], r15
mov ebx, r14d
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, dword [rbp]
mov edx, 0x80000000
mov rcx, r12
call qword [0x1800a7890]
mov rsi, rax
cmp rdi, r15
je 0x1800366f5
cmp rdi, r14
je 0x1800366f5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, rsi
mov qword [rsp + 0xf0], rsi
cmp rsi, r14
je 0x18003670a
cmp rsi, r15
jne 0x180036715
inc ebx
add rbp, 4
cmp ebx, 4
jb 0x1800366b5
cmp rsi, r14
je 0x180036e5f
cmp rsi, r15
je 0x180036e5f
mov byte [rsp + 0x1c0], r14b
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x1c1]
call fcn.180059db0
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x1c0]
call fcn.1800341d4
cmp eax, r14d
jne 0x18003677a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037888
xor eax, eax
jmp 0x180036e82
mov ecx, 8
call fcn.180058f28
cmp rax, r14
je 0x180036793
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
jmp 0x180036796
mov rax, r14
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x40], r14b
lea r8, [rsp + 0x40]
mov ebx, 0x40
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180038d58
nop
cmp dword [rsp + 0xa78], 0x63636573
sete al
cmp al, r14b
je 0x180036811
mov rdi, qword [rsp + 0x60]
cmp rdi, qword [rsp + 0x68]
jbe 0x1800367dc
call fcn.180058f08
mov rax, qword [rsp + 0x48]
cmp rax, r14
jne 0x1800367f0
call fcn.180058f08
mov r11, r14
jmp 0x1800367f3
mov r11, qword [rax]
cmp rdi, qword [r11 + 0x20]
jb 0x1800367fe
call fcn.180058f08
mov rcx, rdi
lea rdx, [rsp + 0xa7c]
mov r8, rbx
call fcn.180059820
mov ebx, r14d
cmp dword [rsp + 0x360], r14d
jbe 0x180036e1b
mov ebp, r14d
mov r12d, sendto
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov eax, ebp
lea rdx, [rsp + rax + 0x364]
mov r8d, 0xa
lea rcx, [rsp + 0x88]
call fcn.180007360
nop
mov r12d, ebx
mov rax, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
sub rax, rdi
cmp rax, r12
jbe 0x180036dba
cmp rdi, qword [rsp + 0x68]
jbe 0x180036886
call fcn.180058f08
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdi
mov r8, r12
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x78]
call fcn.1800381a8
mov rdi, rax
mov rcx, qword [rax]
cmp rcx, r14
jne 0x1800368ca
call fcn.180058f08
mov rcx, qword [rdi]
cmp rcx, r14
jne 0x1800368ca
mov rax, r14
jmp 0x1800368cd
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
cmp qword [rdi + 8], rax
jb 0x1800368dc
call fcn.180058f08
mov rax, qword [rdi + 8]
mov dil, byte [rax]
mov r12d, sendto
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xf8]
call fcn.180007250
mov byte [rsp + 0x120], dil
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xc0]
call fcn.180037a98
mov dil, al
cmp qword [rsp + 0x118], 0x10
jb 0x180036954
mov rcx, qword [rsp + 0x100]
call fcn.180058b34
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
cmp qword [rsp + 0xa8], 0x10
jb 0x180036984
mov rcx, qword [rsp + 0x90]
call fcn.180058b34
cmp dil, r14b
jne 0x1800369a0
inc ebx
add ebp, 0xa
cmp ebx, dword [rsp + 0x360]
jb 0x18003682b
jmp 0x180036e1b
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x5e4]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x5e4]
lea rcx, [rsp + 0x88]
call fcn.180007360
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x198]
call fcn.1800341a0
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x180036a12
mov rcx, qword [rsp + 0x90]
call fcn.180058b34
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r13
call qword [0x1800a7890]
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, r14
je 0x180036d2f
cmp rax, r15
je 0x180036d2f
xor r9d, r9d
xor r8d, r8d
mov ebp, 0x1000
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xb0], r14d
xor eax, eax
mov dword [rsp + 0xb4], eax
lea r8, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae r8, qword [rsp + 0x1a0]
mov edx, ebp
lea rcx, [rsp + 0x21c0]
call fcn.18003566c
mov byte [rsp + 0x11c0], r14b
xor edx, edx
lea r8d, [rbp - 1]
lea rcx, [rsp + 0x11c1]
call fcn.180059db0
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
je 0x180036c86
mov r15d, 0x3ffff
mov rbx, qword [rsp + 0xb0]
cmp dword [rsp + 0x44], r14d
jbe 0x180036c86
lea r9, [rsp + 0x11c0]
mov r10d, pe_nt_image_headers64
mov rax, rbx
cqo
mov ecx, 0xfff
and rdx, rcx
add rax, rdx
and rax, rcx
sub rax, rdx
mov r8, rax
cqo
and rdx, r15
add rax, rdx
and rax, r15
sub rax, rdx
shl eax, 4
add rax, qword [0x1800a71e8]
mov rcx, qword [rax]
xor qword [r9], rcx
mov rax, qword [rax + 8]
xor qword [r9 + 8], rax
mov rax, qword [rsp + r8 + 0x21c0]
xor qword [r9], rax
mov rax, qword [rsp + r8 + 0x21c8]
xor qword [r9 + 8], rax
add rbx, 0x10
add r9, 0x10
sub r10, 1
jne 0x180036b2c
mov dword [rsp + 0xb0], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xb0]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r14d
je 0x180036bfc
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x11c0]
call fcn.180059db0
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
jne 0x180036b13
jmp 0x180036c86
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x180036c27
mov rcx, qword [rsp + 0x1a0]
call fcn.180058b34
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180036c4e
call fcn.180058b34
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180058b34
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037888
xor eax, eax
jmp 0x180036e82
xor r9d, r9d
lea r8, [rsp + 0x66c]
mov edx, dword [rsp + 0x668]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x180036ccd
mov rcx, qword [rsp + 0x1a0]
call fcn.180058b34
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180036cf4
call fcn.180058b34
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180058b34
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037888
mov eax, 1
jmp 0x180036e82
cmp rax, r15
je 0x180036d43
cmp rax, r14
je 0x180036d43
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x180036d5b
mov rcx, qword [rsp + 0x1a0]
call fcn.180058b34
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180036d82
call fcn.180058b34
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180058b34
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037888
xor eax, eax
jmp 0x180036e82
mov qword [rsp + 0x150], sendto
mov qword [rsp + 0x148], r14
mov byte [rsp + 0x138], r14b
mov r8d, 0x1b
lea rdx, str.invalid_vector_T__subscript
lea rcx, [rsp + 0x130]
call fcn.180007360
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x158]
call fcn.18000112c
lea rdx, [0x18009d1a8]
lea rcx, [rsp + 0x158]
call fcn.180058fc4
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180036e2a
call fcn.180058b34
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180058b34
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037888
xor eax, eax
jmp 0x180036e82
cmp rsi, r15
je 0x180036e73
cmp rsi, r14
je 0x180036e73
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037888
xor eax, eax
mov rcx, qword [rsp + 0x31c0]
xor rcx, rsp
call fcn.180059760
mov rbx, qword [rsp + 0x3228]
add rsp, 0x31d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret