Function at 0x140024010
Capabilities:
Delete file
Encode data using xor
Get file size
Hash data with md5
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x240]
call fcn.14002a400
mov r8d, 0x104
lea rdx, [rbp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
xor r12d, r12d
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r12b
lea rax, [rbp + 0x240]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x1400240b0
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x60]
call fcn.1400019d0
nop
mov r8d, 8
lea rdx, str.001.dat
lea rcx, [rbp - 0x60]
call fcn.1400028c0
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
lea rax, [rbp + 0x240]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140024111
mov r8, rdi
lea rdx, [rbp + 0x240]
lea rcx, [rsp + 0x78]
call fcn.1400019d0
nop
mov r8d, 8
lea rdx, str.002.dat
lea rcx, [rsp + 0x78]
call fcn.1400028c0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbx
call fcn.140021ba0
mov esi, r12d
mov dword [rsp + 0x70], r12d
mov r14, r12
mov qword [rsp + 0x40], r12
lea r15, [rbp + 0x194]
mov qword [rsp + 0x48], r15
mov rax, qword [rbx]
mov rcx, qword [r14 + rax]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 5
lea rcx, [rbp - 0x40]
test rax, rax
je 0x1400241a5
call fcn.1400012e0
jmp 0x1400241c9
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
xor r8d, r8d
lea rdx, [0x140061cb8]
call fcn.1400019d0
nop
mov rax, qword [rbx]
mov rax, qword [r14 + rax]
mov ecx, dword [rax + 0x78]
mov dword [r15 - 4], ecx
mov dword [r15], r12d
movsxd rax, esi
lea rcx, [rax + rax*2]
lea rdi, [rbp + 0x198]
lea rdi, [rdi + rcx*8]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea edx, [rax + 0x15]
lea rcx, [rbp - 8]
call fcn.1400140a0
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x58], rax
mov rbx, qword [rbp - 8]
mov qword [rsp + 0x50], rbx
cmp rax, 0xffffffffffffffff
je 0x1400244e6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x1400244d7
mov ecx, esi
call fcn.140028434
mov rdi, rax
mov qword [rsp + 0x60], rax
mov dword [rbp - 0x68], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x68]
mov r8d, esi
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400242da
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x20], 0x67452301
mov dword [rbp + 0x24], 0xefcdab89
mov dword [rbp + 0x28], 0x98badcfe
mov dword [rbp + 0x2c], 0x10325476
mov r8d, esi
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.1400158c0
lea rcx, [rbp + 0x20]
call fcn.1400159c0
movups xmm0, xmmword [rbp + 0x78]
movups xmmword [r15 + 4], xmm0
mov eax, esi
and eax, 0xf
mov ecx, 0x10
sub ecx, eax
add ecx, 0x10
add ecx, esi
call fcn.140028434
mov r13, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
call fcn.14001a8b0
mov r15, qword [rbp - 0x20]
lea r12, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae r12, rbx
test r13, r13
je 0x140024337
test r15, r15
je 0x14002432f
movups xmm0, xmmword [r15]
movups xmmword [r13], xmm0
jmp 0x140024347
xorps xmm0, xmm0
movups xmmword [r13], xmm0
call fcn.14003315c
mov dword [rax], 0x16
call fcn.14002e458
lea rbx, [r13 + 0x10]
mov r9, rsi
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14001c8a0
movzx ecx, sil
and cl, 0xf
movsx eax, cl
mov edi, 0x10
sub edi, eax
movsx rax, cl
mov r8d, 0x10
sub r8, rax
lea rcx, [r13 + 0x10]
add rcx, rsi
mov edx, edi
call fcn.14002a400
add edi, esi
lea esi, [rdi + 0x10]
mov rdx, r12
lea rcx, [rbp + 0x90]
call fcn.140001bf0
movups xmm0, xmmword [r15]
movaps xmmword [rbp + 0x180], xmm0
lea r8, [rbp + 0x180]
test rdi, rdi
je 0x1400243fd
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
mov rax, rbx
sub r8, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400243d0
lea rdx, [rbp + 0x90]
mov rcx, rbx
call fcn.140002300
mov r8, rbx
add rbx, 0x10
sub rdi, 1
jne 0x1400243c0
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002447c
lea r9d, [r12 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp - 0x64], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x64]
mov r8d, esi
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x48]
mov dword [r15], esi
jmp 0x140024481
mov r15, qword [rsp + 0x48]
mov rcx, r13
call fcn.140027b2c
mov rcx, qword [rsp + 0x60]
call fcn.140027b2c
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400244cd
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400244c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246a9
call fcn.140027b2c
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x70]
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140024551
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov r8d, 0xa8
lea rdx, [rbp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x10]
cmp rax, 0x10
jb 0x14002458d
lea rdx, [rax + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140024584
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246af
mov rcx, rbx
call fcn.140027b2c
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400245c8
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400245c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246b5
call fcn.140027b2c
inc esi
mov dword [rsp + 0x70], esi
add r14, 0x10
mov qword [rsp + 0x40], r14
add r15, 0x18
mov qword [rsp + 0x48], r15
cmp esi, 7
jge 0x1400245ef
mov rbx, qword [rsp + 0x68]
jmp 0x140024180
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14002462b
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024626
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246bb
call fcn.140027b2c
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140024673
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002466e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246a3
call fcn.140027b2c
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140027ae0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002e478
nop
call fcn.14002e478
nop
call fcn.14002e478
nop
call fcn.14002e478
nop
call fcn.14002e478
int3