Function at 0x180036af8
Capabilities:
Delete file
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x31d0
call fcn.18006e000
sub rsp, rax
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov qword [rsp + 0x3228], rbx
mov rax, qword [0x1800a1658]
xor rax, rsp
mov qword [rsp + 0x31c0], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
call fcn.180035c20
mov ecx, 8
call fcn.1800592c8
xor r14d, r14d
cmp rax, r14
je 0x180036b64
lea rcx, [rsp + 0xc0]
mov qword [rax], rcx
jmp 0x180036b67
mov rax, r14
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], r14
mov rdx, rdi
lea rcx, [rsp + 0xc0]
call fcn.18003836c
nop
mov rcx, qword [rsp + 0xe0]
sub rcx, qword [rsp + 0xd8]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edx, r14d
jg 0x180036bdc
lea rcx, [rsp + 0xc0]
call fcn.180037e20
xor eax, eax
jmp 0x1800373e6
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x7c], 5
mov dword [rsp + 0x80], 3
mov dword [rsp + 0x84], 7
or r15, 0xffffffffffffffff
mov rdi, r15
mov qword [rsp + 0xf0], r15
mov ebx, r14d
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, dword [rbp]
mov edx, 0x80000000
mov rcx, r12
call qword [0x1800a7880]
mov rsi, rax
cmp rdi, r15
je 0x180036c59
cmp rdi, r14
je 0x180036c59
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, rsi
mov qword [rsp + 0xf0], rsi
cmp rsi, r14
je 0x180036c6e
cmp rsi, r15
jne 0x180036c79
inc ebx
add rbp, 4
cmp ebx, 4
jb 0x180036c19
cmp rsi, r14
je 0x1800373c3
cmp rsi, r15
je 0x1800373c3
mov byte [rsp + 0x1c0], r14b
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x1c1]
call fcn.18005a150
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x1c0]
call fcn.1800345c4
cmp eax, r14d
jne 0x180036cde
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037e20
xor eax, eax
jmp 0x1800373e6
mov ecx, 8
call fcn.1800592c8
cmp rax, r14
je 0x180036cf7
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
jmp 0x180036cfa
mov rax, r14
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x40], r14b
lea r8, [rsp + 0x40]
mov ebx, 0x40
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1800391b0
nop
cmp dword [rsp + 0xa78], 0x63636573
sete al
cmp al, r14b
je 0x180036d75
mov rdi, qword [rsp + 0x60]
cmp rdi, qword [rsp + 0x68]
jbe 0x180036d40
call fcn.1800592a8
mov rax, qword [rsp + 0x48]
cmp rax, r14
jne 0x180036d54
call fcn.1800592a8
mov r11, r14
jmp 0x180036d57
mov r11, qword [rax]
cmp rdi, qword [r11 + 0x20]
jb 0x180036d62
call fcn.1800592a8
mov rcx, rdi
lea rdx, [rsp + 0xa7c]
mov r8, rbx
call fcn.180059bc0
mov ebx, r14d
cmp dword [rsp + 0x360], r14d
jbe 0x18003737f
mov ebp, r14d
mov r12d, sendto
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov eax, ebp
lea rdx, [rsp + rax + 0x364]
mov r8d, 0xa
lea rcx, [rsp + 0x88]
call fcn.180007288
nop
mov r12d, ebx
mov rax, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
sub rax, rdi
cmp rax, r12
jbe 0x18003731e
cmp rdi, qword [rsp + 0x68]
jbe 0x180036dea
call fcn.1800592a8
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdi
mov r8, r12
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x78]
call fcn.18003872c
mov rdi, rax
mov rcx, qword [rax]
cmp rcx, r14
jne 0x180036e2e
call fcn.1800592a8
mov rcx, qword [rdi]
cmp rcx, r14
jne 0x180036e2e
mov rax, r14
jmp 0x180036e31
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
cmp qword [rdi + 8], rax
jb 0x180036e40
call fcn.1800592a8
mov rax, qword [rdi + 8]
mov dil, byte [rax]
mov r12d, sendto
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xf8]
call fcn.180007178
mov byte [rsp + 0x120], dil
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xc0]
call fcn.180038030
mov dil, al
cmp qword [rsp + 0x118], 0x10
jb 0x180036eb8
mov rcx, qword [rsp + 0x100]
call fcn.180058ed8
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
cmp qword [rsp + 0xa8], 0x10
jb 0x180036ee8
mov rcx, qword [rsp + 0x90]
call fcn.180058ed8
cmp dil, r14b
jne 0x180036f04
inc ebx
add ebp, 0xa
cmp ebx, dword [rsp + 0x360]
jb 0x180036d8f
jmp 0x18003737f
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x5e4]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x5e4]
lea rcx, [rsp + 0x88]
call fcn.180007288
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x198]
call fcn.180034590
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x180036f76
mov rcx, qword [rsp + 0x90]
call fcn.180058ed8
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r13
call qword [0x1800a7880]
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, r14
je 0x180037293
cmp rax, r15
je 0x180037293
xor r9d, r9d
xor r8d, r8d
mov ebp, 0x1000
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xb0], r14d
xor eax, eax
mov dword [rsp + 0xb4], eax
lea r8, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae r8, qword [rsp + 0x1a0]
mov edx, ebp
lea rcx, [rsp + 0x21c0]
call fcn.180035b24
mov byte [rsp + 0x11c0], r14b
xor edx, edx
lea r8d, [rbp - 1]
lea rcx, [rsp + 0x11c1]
call fcn.18005a150
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
je 0x1800371ea
mov r15d, 0x3ffff
mov rbx, qword [rsp + 0xb0]
cmp dword [rsp + 0x44], r14d
jbe 0x1800371ea
lea r9, [rsp + 0x11c0]
mov r10d, 0x100
mov rax, rbx
cqo
mov ecx, 0xfff
and rdx, rcx
add rax, rdx
and rax, rcx
sub rax, rdx
mov r8, rax
cqo
and rdx, r15
add rax, rdx
and rax, r15
sub rax, rdx
shl eax, 4
add rax, qword [0x1800a7520]
mov rcx, qword [rax]
xor qword [r9], rcx
mov rax, qword [rax + 8]
xor qword [r9 + 8], rax
mov rax, qword [rsp + r8 + 0x21c0]
xor qword [r9], rax
mov rax, qword [rsp + r8 + 0x21c8]
xor qword [r9 + 8], rax
add rbx, 0x10
add r9, 0x10
sub r10, 1
jne 0x180037090
mov dword [rsp + 0xb0], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xb0]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r14d
je 0x180037160
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x11c0]
call fcn.18005a150
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
jne 0x180037077
jmp 0x1800371ea
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x18003718b
mov rcx, qword [rsp + 0x1a0]
call fcn.180058ed8
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x1800371b2
call fcn.180058ed8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180058ed8
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037e20
xor eax, eax
jmp 0x1800373e6
xor r9d, r9d
lea r8, [rsp + 0x66c]
mov edx, dword [rsp + 0x668]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x180037231
mov rcx, qword [rsp + 0x1a0]
call fcn.180058ed8
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180037258
call fcn.180058ed8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180058ed8
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037e20
mov eax, 1
jmp 0x1800373e6
cmp rax, r15
je 0x1800372a7
cmp rax, r14
je 0x1800372a7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x1800372bf
mov rcx, qword [rsp + 0x1a0]
call fcn.180058ed8
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x1800372e6
call fcn.180058ed8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180058ed8
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037e20
xor eax, eax
jmp 0x1800373e6
mov qword [rsp + 0x150], sendto
mov qword [rsp + 0x148], r14
mov byte [rsp + 0x138], r14b
mov r8d, 0x1b
lea rdx, str.invalid_vector_T__subscript
lea rcx, [rsp + 0x130]
call fcn.180007288
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x158]
call fcn.180001118
lea rdx, [0x18009d198]
lea rcx, [rsp + 0x158]
call fcn.180059364
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x18003738e
call fcn.180058ed8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180058ed8
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037e20
xor eax, eax
jmp 0x1800373e6
cmp rsi, r15
je 0x1800373d7
cmp rsi, r14
je 0x1800373d7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180037e20
xor eax, eax
mov rcx, qword [rsp + 0x31c0]
xor rcx, rsp
call fcn.180059b00
mov rbx, qword [rsp + 0x3228]
add rsp, 0x31d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret