Function at 0x18000b2b8
Capabilities:
Check if file exists
Create thread
Delete file
Encode data using xor
Get common file path
Get file attributes
Print debug messages
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rax - 0x218]
sub rsp, 0x300
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rdi, rcx
mov qword [rcx + 0x20], rdx
lea rcx, [0x18003df5c]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r13d, 0x104
lea rdx, [rdi + 0x31]
mov r8d, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rdi + 0x31]
call fcn.18001e8d8
lea rcx, [0x180050870]
call fcn.1800065dc
lea rdx, str.tst008
lea rcx, [0x180050870]
call fcn.18000622c
xor edx, edx
lea rcx, [rsp + 0x61]
lea r8d, [rdx + 0x63]
xor r12b, r12b
mov rsi, rax
mov byte [rsp + 0x60], r12b
call fcn.180019880
lea ebx, [r13 - 1]
lea rcx, [rbp + 0xe1]
mov r8d, ebx
xor edx, edx
mov byte [rbp + 0xe0], r12b
call fcn.180019880
lea rcx, [rbp - 0x2f]
mov r8d, ebx
xor edx, edx
mov byte [rbp - 0x30], r12b
call fcn.180019880
lea rcx, [rbp - 0x30]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x1800531d8]
cmp eax, 2
je 0x18000b3a9
lea rdx, str._srvlic.dll
cmp eax, 3
jne 0x18000b3b0
lea rdx, str.mstracer.dll
lea rcx, [rbp - 0x30]
call fcn.180019f40
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18000b3d2
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0xe0]
xor edx, edx
call fcn.18000b7b4
lea rdx, [0x18003f44c]
lea rcx, [rbp + 0xe0]
call fcn.18001b560
mov rbx, rax
test rax, rax
je 0x18000b43c
mov edx, 0xffffff9c
mov rcx, rax
lea r8d, [rdx + 0x66]
call fcn.18001eac8
mov edx, 1
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x63]
mov r9, rbx
call fcn.18001e510
mov rcx, rbx
call fcn.18001a170
xor r11d, r11d
xor byte [rsp + r11 + 0x60], 0x87
inc r11
cmp r11, 0x64
jl 0x18000b42d
cmp byte [rsp + 0x60], 0x11
je 0x18000b501
lea rcx, [rsp + 0x60]
call fcn.18001b8d0
test rax, rax
je 0x18000b501
lea rcx, [rsp + 0x60]
call fcn.180006c98
lea rdx, [0x18003f448]
lea rcx, [rsp + 0x60]
call fcn.18001c168
mov rbx, rax
test rax, rax
je 0x18000b4b0
add rbx, 3
xor edx, edx
mov al, byte [rbx]
cmp al, 0x2c
je 0x18000b4a5
mov r8, rdi
mov rcx, rbx
sub r8, rbx
mov byte [r8 + rcx + 0x2128], al
inc rcx
inc edx
mov al, byte [rcx]
cmp al, 0x2c
jne 0x18000b492
movsxd rax, edx
mov byte [rax + rdi + 0x2128], 0
lea rcx, [rdi + 0x2128]
call fcn.18001b8d0
lea rdx, str.NAME:
lea rcx, [rbx + rax]
call fcn.18001c168
test rax, rax
je 0x18000b501
add rax, 5
xor edx, edx
mov cl, byte [rax]
test cl, cl
je 0x18000b4f6
mov r8, rdi
sub r8, rax
mov byte [r8 + rax + 0x2150], cl
inc rax
inc edx
mov cl, byte [rax]
test cl, cl
jne 0x18000b4e3
movsxd rax, edx
mov byte [rax + rdi + 0x2150], 0
test rsi, rsi
je 0x18000b592
lea rdx, str.000000000000
mov rcx, rsi
call fcn.18001e5e0
test eax, eax
je 0x18000b592
mov rcx, rsi
call fcn.18001b8d0
cmp rax, 0xc
jne 0x18000b581
xor eax, eax
mov byte [rsp + 0x44], 0
mov rbx, rsi
lea r13d, [rax + 6]
mov dword [rsp + 0x45], eax
lea r12, [rdi + 0x2114]
movsx r9d, byte [rbx + 1]
movsx r8d, byte [rbx]
lea rdx, str.0x_c_c
lea rcx, [rsp + 0x44]
call fcn.18001e530
lea rdx, [0x18003f424]
lea rcx, [rsp + 0x44]
mov r8, r12
call fcn.18001e9dc
inc r12
add rbx, 2
dec r13
jne 0x18000b544
mov r12b, 1
mov rcx, rsi
call fcn.18001a1d8
test r12b, r12b
jne 0x18000b640
lea rcx, [rdi + 0x13c]
call fcn.18000d0b0
xor eax, eax
lea rdx, [rdi + 0x2114]
lea rcx, [rdi + 0x13c]
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
call fcn.18000cfe4
test al, al
je 0x18000b617
movzx ecx, byte [rdi + 0x2118]
movzx edx, byte [rdi + 0x2117]
movzx eax, byte [rdi + 0x2119]
movzx r10d, byte [rdi + 0x2116]
movzx r9d, byte [rdi + 0x2115]
movzx r8d, byte [rdi + 0x2114]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea rdx, str._02X_02X_02X_02X_02X_02X
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x18000b628
lea rdx, str.000000000000
lea rcx, [rsp + 0x50]
call fcn.180019fe0
lea r8, [rsp + 0x50]
lea rdx, str.tst008
lea rcx, [0x180050870]
call fcn.180005e18
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x2120], rax
test rax, rax
je 0x18000b6b1
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
lea r8, [0x180008b4c]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x18000a220]
xor r9d, r9d
mov qword [rdi + 0x10], rax
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.180019850
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret