Function at 0x180034ad0
Capabilities:
Delete file
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x31d0
call fcn.180069af0
sub rsp, rax
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov qword [rsp + 0x3228], rbx
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x31c0], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
call fcn.180033ca4
mov ecx, 8
call fcn.180054d48
xor r14d, r14d
cmp rax, r14
je 0x180034b3c
lea rcx, [rsp + 0xc0]
mov qword [rax], rcx
jmp 0x180034b3f
mov rax, r14
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], r14
mov rdx, rdi
lea rcx, [rsp + 0xc0]
call fcn.180036238
nop
mov rcx, qword [rsp + 0xe0]
sub rcx, qword [rsp + 0xd8]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edx, r14d
jg 0x180034bb4
lea rcx, [rsp + 0xc0]
call fcn.180035cec
xor eax, eax
jmp 0x1800353be
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x7c], 5
mov dword [rsp + 0x80], 3
mov dword [rsp + 0x84], 7
or r15, 0xffffffffffffffff
mov rdi, r15
mov qword [rsp + 0xf0], r15
mov ebx, r14d
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, dword [rbp]
mov edx, 0x80000000
mov rcx, r12
call qword [0x1800a0740]
mov rsi, rax
cmp rdi, r15
je 0x180034c31
cmp rdi, r14
je 0x180034c31
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, rsi
mov qword [rsp + 0xf0], rsi
cmp rsi, r14
je 0x180034c46
cmp rsi, r15
jne 0x180034c51
inc ebx
add rbp, 4
cmp ebx, 4
jb 0x180034bf1
cmp rsi, r14
je 0x18003539b
cmp rsi, r15
je 0x18003539b
mov byte [rsp + 0x1c0], r14b
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x1c1]
call fcn.180055bd0
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x1c0]
call fcn.1800326ec
cmp eax, r14d
jne 0x180034cb6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180035cec
xor eax, eax
jmp 0x1800353be
mov ecx, 8
call fcn.180054d48
cmp rax, r14
je 0x180034ccf
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
jmp 0x180034cd2
mov rax, r14
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x40], r14b
lea r8, [rsp + 0x40]
mov ebx, 0x40
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180036ab4
nop
cmp dword [rsp + 0xa78], 0x63636573
sete al
cmp al, r14b
je 0x180034d4d
mov rdi, qword [rsp + 0x60]
cmp rdi, qword [rsp + 0x68]
jbe 0x180034d18
call fcn.180054d28
mov rax, qword [rsp + 0x48]
cmp rax, r14
jne 0x180034d2c
call fcn.180054d28
mov r11, r14
jmp 0x180034d2f
mov r11, qword [rax]
cmp rdi, qword [r11 + 0x20]
jb 0x180034d3a
call fcn.180054d28
mov rcx, rdi
lea rdx, [rsp + 0xa7c]
mov r8, rbx
call fcn.180055640
mov ebx, r14d
cmp dword [rsp + 0x360], r14d
jbe 0x180035357
mov ebp, r14d
mov r12d, sendto
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov eax, ebp
lea rdx, [rsp + rax + 0x364]
mov r8d, 0xa
lea rcx, [rsp + 0x88]
call fcn.180006ec0
nop
mov r12d, ebx
mov rax, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
sub rax, rdi
cmp rax, r12
jbe 0x1800352f6
cmp rdi, qword [rsp + 0x68]
jbe 0x180034dc2
call fcn.180054d28
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdi
mov r8, r12
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x78]
call fcn.180036604
mov rdi, rax
mov rcx, qword [rax]
cmp rcx, r14
jne 0x180034e06
call fcn.180054d28
mov rcx, qword [rdi]
cmp rcx, r14
jne 0x180034e06
mov rax, r14
jmp 0x180034e09
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
cmp qword [rdi + 8], rax
jb 0x180034e18
call fcn.180054d28
mov rax, qword [rdi + 8]
mov dil, byte [rax]
mov r12d, sendto
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xf8]
call fcn.180006db0
mov byte [rsp + 0x120], dil
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xc0]
call fcn.180035efc
mov dil, al
cmp qword [rsp + 0x118], 0x10
jb 0x180034e90
mov rcx, qword [rsp + 0x100]
call fcn.180054958
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
cmp qword [rsp + 0xa8], 0x10
jb 0x180034ec0
mov rcx, qword [rsp + 0x90]
call fcn.180054958
cmp dil, r14b
jne 0x180034edc
inc ebx
add ebp, 0xa
cmp ebx, dword [rsp + 0x360]
jb 0x180034d67
jmp 0x180035357
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x5e4]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x5e4]
lea rcx, [rsp + 0x88]
call fcn.180006ec0
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x198]
call fcn.1800326b8
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x180034f4e
mov rcx, qword [rsp + 0x90]
call fcn.180054958
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r13
call qword [0x1800a0740]
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, r14
je 0x18003526b
cmp rax, r15
je 0x18003526b
xor r9d, r9d
xor r8d, r8d
mov ebp, 0x1000
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xb0], r14d
xor eax, eax
mov dword [rsp + 0xb4], eax
lea r8, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae r8, qword [rsp + 0x1a0]
mov edx, ebp
lea rcx, [rsp + 0x21c0]
call fcn.180033ba8
mov byte [rsp + 0x11c0], r14b
xor edx, edx
lea r8d, [rbp - 1]
lea rcx, [rsp + 0x11c1]
call fcn.180055bd0
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
je 0x1800351c2
mov r15d, 0x3ffff
mov rbx, qword [rsp + 0xb0]
cmp dword [rsp + 0x44], r14d
jbe 0x1800351c2
lea r9, [rsp + 0x11c0]
mov r10d, 0x100
mov rax, rbx
cqo
mov ecx, 0xfff
and rdx, rcx
add rax, rdx
and rax, rcx
sub rax, rdx
mov r8, rax
cqo
and rdx, r15
add rax, rdx
and rax, r15
sub rax, rdx
shl eax, 4
add rax, qword [0x1800a00e8]
mov rcx, qword [rax]
xor qword [r9], rcx
mov rax, qword [rax + 8]
xor qword [r9 + 8], rax
mov rax, qword [rsp + r8 + 0x21c0]
xor qword [r9], rax
mov rax, qword [rsp + r8 + 0x21c8]
xor qword [r9 + 8], rax
add rbx, 0x10
add r9, 0x10
sub r10, 1
jne 0x180035068
mov dword [rsp + 0xb0], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xb0]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r14d
je 0x180035138
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x11c0]
call fcn.180055bd0
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
jne 0x18003504f
jmp 0x1800351c2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x180035163
mov rcx, qword [rsp + 0x1a0]
call fcn.180054958
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x18003518a
call fcn.180054958
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180054958
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180035cec
xor eax, eax
jmp 0x1800353be
xor r9d, r9d
lea r8, [rsp + 0x66c]
mov edx, dword [rsp + 0x668]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x180035209
mov rcx, qword [rsp + 0x1a0]
call fcn.180054958
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180035230
call fcn.180054958
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180054958
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180035cec
mov eax, 1
jmp 0x1800353be
cmp rax, r15
je 0x18003527f
cmp rax, r14
je 0x18003527f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x180035297
mov rcx, qword [rsp + 0x1a0]
call fcn.180054958
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x1800352be
call fcn.180054958
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180054958
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180035cec
xor eax, eax
jmp 0x1800353be
mov qword [rsp + 0x150], sendto
mov qword [rsp + 0x148], r14
mov byte [rsp + 0x138], r14b
mov r8d, 0x1b
lea rdx, str.invalid_vector_T__subscript
lea rcx, [rsp + 0x130]
call fcn.180006ec0
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x158]
call fcn.180001130
lea rdx, [0x180096950]
lea rcx, [rsp + 0x158]
call fcn.180054de4
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180035366
call fcn.180054958
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180054958
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180035cec
xor eax, eax
jmp 0x1800353be
cmp rsi, r15
je 0x1800353af
cmp rsi, r14
je 0x1800353af
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180035cec
xor eax, eax
mov rcx, qword [rsp + 0x31c0]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0x3228]
add rsp, 0x31d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret