Function at 0x180036e8c
Capabilities:
Delete file
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x31d0
call fcn.18006de30
sub rsp, rax
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov qword [rsp + 0x3228], rbx
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x31c0], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
call fcn.180036060
mov ecx, 8
call fcn.1800590f8
xor r14d, r14d
cmp rax, r14
je 0x180036ef8
lea rcx, [rsp + 0xc0]
mov qword [rax], rcx
jmp 0x180036efb
mov rax, r14
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], r14
mov rdx, rdi
lea rcx, [rsp + 0xc0]
call fcn.1800386d4
nop
mov rcx, qword [rsp + 0xe0]
sub rcx, qword [rsp + 0xd8]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edx, r14d
jg 0x180036f70
lea rcx, [rsp + 0xc0]
call fcn.180038180
xor eax, eax
jmp 0x18003777a
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x7c], 5
mov dword [rsp + 0x80], 3
mov dword [rsp + 0x84], 7
or r15, 0xffffffffffffffff
mov rdi, r15
mov qword [rsp + 0xf0], r15
mov ebx, r14d
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, dword [rbp]
mov edx, 0x80000000
mov rcx, r12
call qword [0x1800a7890]
mov rsi, rax
cmp rdi, r15
je 0x180036fed
cmp rdi, r14
je 0x180036fed
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, rsi
mov qword [rsp + 0xf0], rsi
cmp rsi, r14
je 0x180037002
cmp rsi, r15
jne 0x18003700d
inc ebx
add rbp, 4
cmp ebx, 4
jb 0x180036fad
cmp rsi, r14
je 0x180037757
cmp rsi, r15
je 0x180037757
mov byte [rsp + 0x1c0], r14b
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x1c1]
call fcn.180059f80
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x1c0]
call fcn.180034acc
cmp eax, r14d
jne 0x180037072
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180038180
xor eax, eax
jmp 0x18003777a
mov ecx, 8
call fcn.1800590f8
cmp rax, r14
je 0x18003708b
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
jmp 0x18003708e
mov rax, r14
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x40], r14b
lea r8, [rsp + 0x40]
mov ebx, 0x40
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180039008
nop
cmp dword [rsp + 0xa78], 0x63636573
sete al
cmp al, r14b
je 0x180037109
mov rdi, qword [rsp + 0x60]
cmp rdi, qword [rsp + 0x68]
jbe 0x1800370d4
call fcn.1800590d8
mov rax, qword [rsp + 0x48]
cmp rax, r14
jne 0x1800370e8
call fcn.1800590d8
mov r11, r14
jmp 0x1800370eb
mov r11, qword [rax]
cmp rdi, qword [r11 + 0x20]
jb 0x1800370f6
call fcn.1800590d8
mov rcx, rdi
lea rdx, [rsp + 0xa7c]
mov r8, rbx
call fcn.1800599f0
mov ebx, r14d
cmp dword [rsp + 0x360], r14d
jbe 0x180037713
mov ebp, r14d
mov r12d, sendto
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov eax, ebp
lea rdx, [rsp + rax + 0x364]
mov r8d, 0xa
lea rcx, [rsp + 0x88]
call fcn.180007324
nop
mov r12d, ebx
mov rax, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
sub rax, rdi
cmp rax, r12
jbe 0x1800376b2
cmp rdi, qword [rsp + 0x68]
jbe 0x18003717e
call fcn.1800590d8
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdi
mov r8, r12
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x78]
call fcn.180038aa0
mov rdi, rax
mov rcx, qword [rax]
cmp rcx, r14
jne 0x1800371c2
call fcn.1800590d8
mov rcx, qword [rdi]
cmp rcx, r14
jne 0x1800371c2
mov rax, r14
jmp 0x1800371c5
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
cmp qword [rdi + 8], rax
jb 0x1800371d4
call fcn.1800590d8
mov rax, qword [rdi + 8]
mov dil, byte [rax]
mov r12d, sendto
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xf8]
call fcn.180007214
mov byte [rsp + 0x120], dil
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xc0]
call fcn.180038390
mov dil, al
cmp qword [rsp + 0x118], 0x10
jb 0x18003724c
mov rcx, qword [rsp + 0x100]
call fcn.1800018ec
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x110], r14
mov byte [rsp + 0x100], r14b
cmp qword [rsp + 0xa8], 0x10
jb 0x18003727c
mov rcx, qword [rsp + 0x90]
call fcn.1800018ec
cmp dil, r14b
jne 0x180037298
inc ebx
add ebp, 0xa
cmp ebx, dword [rsp + 0x360]
jb 0x180037123
jmp 0x180037713
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x5e4]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x5e4]
lea rcx, [rsp + 0x88]
call fcn.180007324
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x198]
call fcn.180034a98
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x18003730a
mov rcx, qword [rsp + 0x90]
call fcn.1800018ec
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r14
mov byte [rsp + 0x90], r14b
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r13
call qword [0x1800a7890]
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, r14
je 0x180037627
cmp rax, r15
je 0x180037627
xor r9d, r9d
xor r8d, r8d
mov ebp, 0x1000
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xb0], r14d
xor eax, eax
mov dword [rsp + 0xb4], eax
lea r8, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae r8, qword [rsp + 0x1a0]
mov edx, ebp
lea rcx, [rsp + 0x21c0]
call fcn.180035f64
mov byte [rsp + 0x11c0], r14b
xor edx, edx
lea r8d, [rbp - 1]
lea rcx, [rsp + 0x11c1]
call fcn.180059f80
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
je 0x18003757e
mov r15d, 0x3ffff
mov rbx, qword [rsp + 0xb0]
cmp dword [rsp + 0x44], r14d
jbe 0x18003757e
lea r9, [rsp + 0x11c0]
mov r10d, pe_nt_image_headers64
mov rax, rbx
cqo
mov ecx, 0xfff
and rdx, rcx
add rax, rdx
and rax, rcx
sub rax, rdx
mov r8, rax
cqo
and rdx, r15
add rax, rdx
and rax, r15
sub rax, rdx
shl eax, 4
add rax, qword [0x1800a71e8]
mov rcx, qword [rax]
xor qword [r9], rcx
mov rax, qword [rax + 8]
xor qword [r9 + 8], rax
mov rax, qword [rsp + r8 + 0x21c0]
xor qword [r9], rax
mov rax, qword [rsp + r8 + 0x21c8]
xor qword [r9 + 8], rax
add rbx, 0x10
add r9, 0x10
sub r10, 1
jne 0x180037424
mov dword [rsp + 0xb0], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xb0]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r14d
je 0x1800374f4
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x11c0]
call fcn.180059f80
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x11c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
jne 0x18003740b
jmp 0x18003757e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x18003751f
mov rcx, qword [rsp + 0x1a0]
call fcn.1800018ec
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180037546
call fcn.1800018ec
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.1800018ec
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180038180
xor eax, eax
jmp 0x18003777a
xor r9d, r9d
lea r8, [rsp + 0x66c]
mov edx, dword [rsp + 0x668]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x1800375c5
mov rcx, qword [rsp + 0x1a0]
call fcn.1800018ec
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x1800375ec
call fcn.1800018ec
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.1800018ec
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180038180
mov eax, 1
jmp 0x18003777a
cmp rax, r15
je 0x18003763b
cmp rax, r14
je 0x18003763b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x180037653
mov rcx, qword [rsp + 0x1a0]
call fcn.1800018ec
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1b0], r14
mov byte [rsp + 0x1a0], r14b
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x18003767a
call fcn.1800018ec
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.1800018ec
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180038180
xor eax, eax
jmp 0x18003777a
mov qword [rsp + 0x150], sendto
mov qword [rsp + 0x148], r14
mov byte [rsp + 0x138], r14b
mov r8d, 0x1b
lea rdx, str.invalid_vector_T__subscript
lea rcx, [rsp + 0x130]
call fcn.180007324
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x158]
call fcn.18000115c
lea rdx, [0x18009d168]
lea rcx, [rsp + 0x158]
call fcn.180059194
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x180037722
call fcn.1800018ec
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.1800018ec
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180038180
xor eax, eax
jmp 0x18003777a
cmp rsi, r15
je 0x18003776b
cmp rsi, r14
je 0x18003776b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.180038180
xor eax, eax
mov rcx, qword [rsp + 0x31c0]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0x3228]
add rsp, 0x31d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret