Function at 0x180066884
Capabilities:
Delete file
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x3110
call fcn.180082cd0
sub rsp, rax
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x3100], rax
mov rdi, r8
mov r12, rdx
mov rbx, rcx
call fcn.180065fcc
mov ecx, 8
call fcn.18006ea94
xor ebp, ebp
cmp rax, rbp
je 0x1800668e3
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
jmp 0x1800668e6
mov rax, rbp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbp
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.180068804
nop
mov rcx, qword [rsp + 0x78]
sub rcx, qword [rsp + 0x70]
movabs rsi, 0x2aaaaaaaaaaaaaab
mov rax, rsi
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edx, ebp
jg 0x180066948
lea rcx, [rsp + 0x58]
call fcn.18004d450
xor eax, eax
jmp 0x180066e82
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 7]
mov rcx, rbx
call qword [0x1800bfe40]
mov rbx, rax
mov qword [rsp + 0x98], rax
cmp rax, rbp
je 0x180066e61
cmp rax, 0xffffffffffffffff
je 0x180066e61
mov dword [rsp + 0x44], ebp
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, 0xfff
lea r13d, [r14 + 1]
cmp eax, ebp
jne 0x1800669d1
cmp dword [rsp + 0x44], ebp
jne 0x1800669d6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x58]
call fcn.18004d450
xor eax, eax
jmp 0x180066e82
cmp eax, r13d
jae 0x1800669e0
cmp dword [rsp + 0x44], ebp
jbe 0x180066a8f
mov byte [rsp + 0x100], bpl
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x101]
call fcn.1800729a0
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, r13d
lea rdx, [rsp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebp
jne 0x180066a3b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x58]
call fcn.18004d450
xor eax, eax
jmp 0x180066e82
movabs rax, 0x706c646f70bfbbef
cmp qword [rsp + 0x100], rax
jne 0x180066a7e
cmp dword [rsp + 0x108], 2
jl 0x180066a7e
cmp dword [rsp + 0x108], 0xa
jg 0x180066a7e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x58]
call fcn.18004d450
xor eax, eax
jmp 0x180066e82
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r12
call qword [0x1800bfe40]
mov rdi, rax
mov qword [rsp + 0xa8], rax
cmp rax, rbp
je 0x180066e34
cmp rax, 0xffffffffffffffff
je 0x180066e34
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov r11, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
sub r11, rcx
mov rax, rsi
imul r11
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x180066b1f
call fcn.18006e940
mov rcx, qword [rsp + 0x70]
mov rdx, rcx
lea rcx, [rsp + 0xd8]
call fcn.180066100
nop
lea r8, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 0x10
cmovae r8, qword [rsp + 0xe0]
mov edx, r13d
lea rcx, [rsp + 0x100]
call fcn.180065ed0
mov byte [rsp + 0x1100], bpl
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x1101]
call fcn.1800729a0
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x48], ebp
xor eax, eax
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, r13d
lea rdx, [rsp + 0x1100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebp
je 0x180066d08
mov rsi, qword [rsp + 0x48]
mov eax, dword [rsp + 0x40]
cmp eax, ebp
jbe 0x180066d08
mov r8d, eax
cmp eax, r13d
je 0x180066bd6
and r8d, 0xfffffe00
test eax, 0x1ff
je 0x180066bd6
add r8d, 0x200
cmp r8d, ebp
jbe 0x180066c54
lea r10, [rsp + 0x1100]
lea r11d, [r8 - 1]
shr r11d, 4
inc r11d
mov rax, rsi
cqo
and rdx, r14
add rax, rdx
and rax, r14
sub rax, rdx
mov r9, rax
cqo
and edx, 0x3ffff
add rax, rdx
and eax, 0x3ffff
sub rax, rdx
shl eax, 4
mov ecx, eax
add rcx, qword [0x1800bfae0]
mov rax, qword [rcx]
xor qword [r10], rax
mov rax, qword [rcx + 8]
xor qword [r10 + 8], rax
mov rax, qword [rsp + r9 + 0x100]
xor qword [r10], rax
mov rax, qword [rsp + r9 + 0x108]
xor qword [r10 + 8], rax
add rsi, 0x10
add r10, 0x10
sub r11, 1
jne 0x180066bee
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x1100]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebp
je 0x180066cb1
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x1100]
call fcn.1800729a0
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, r13d
lea rdx, [rsp + 0x1100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebp
jne 0x180066bad
jmp 0x180066d08
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0xf8], 0x10
jb 0x180066cdc
mov rcx, qword [rsp + 0xe0]
call fcn.18006e998
mov esi, 0xf
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0xf0], rbp
mov byte [rsp + 0xe0], bpl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180066e26
mov dword [rsp + 0x50], ebp
lea rdx, [rsp + 0x8c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x88], eax
lea rdx, [rsp + 0x94]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x90], eax
mov esi, 0xf
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xc8], rbp
mov byte [rsp + 0xb8], bpl
lea r8d, [rsi - 0xc]
lea rdx, [0x18009afec]
lea rcx, [rsp + 0xb0]
call fcn.180006440
lea r11, [rsp + 0xd8]
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x2100]
call fcn.180066288
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x50]
mov r8d, r13d
lea rdx, [rsp + 0x2100]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r12d, eax
cmp qword [rsp + 0xf8], 0x10
jb 0x180066df7
mov rcx, qword [rsp + 0xe0]
call fcn.18006e998
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0xf0], rbp
mov byte [rsp + 0xe0], bpl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ebp, r12d
lea rcx, [rsp + 0x58]
call fcn.18004d450
mov eax, ebp
jmp 0x180066e82
cmp rax, 0xffffffffffffffff
je 0x180066e49
cmp rax, rbp
je 0x180066e49
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x58]
call fcn.18004d450
xor eax, eax
jmp 0x180066e82
cmp rax, 0xffffffffffffffff
je 0x180066e76
cmp rax, rbp
je 0x180066e76
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x58]
call fcn.18004d450
xor eax, eax
mov rcx, qword [rsp + 0x3100]
xor rcx, rsp
call fcn.18006e130
add rsp, 0x3110
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret