Function at 0x140024ae0
Capabilities:
Delete file
Encode data using xor
Get file size
Hash data with md5
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x240]
call fcn.14002aed0
mov r8d, 0x104
lea rdx, [rbp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
xor r12d, r12d
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r12b
lea rax, [rbp + 0x240]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x140024b80
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x60]
call fcn.1400019f0
nop
mov r8d, 8
lea rdx, str.001.dat
lea rcx, [rbp - 0x60]
call fcn.1400028e0
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
lea rax, [rbp + 0x240]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140024be1
mov r8, rdi
lea rdx, [rbp + 0x240]
lea rcx, [rsp + 0x78]
call fcn.1400019f0
nop
mov r8d, 8
lea rdx, str.002.dat
lea rcx, [rsp + 0x78]
call fcn.1400028e0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbx
call fcn.140022350
mov esi, r12d
mov dword [rsp + 0x70], r12d
mov r14, r12
mov qword [rsp + 0x40], r12
lea r15, [rbp + 0x194]
mov qword [rsp + 0x48], r15
mov rax, qword [rbx]
mov rcx, qword [r14 + rax]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 5
lea rcx, [rbp - 0x40]
test rax, rax
je 0x140024c75
call fcn.140001300
jmp 0x140024c99
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
xor r8d, r8d
lea rdx, [0x140062cc8]
call fcn.1400019f0
nop
mov rax, qword [rbx]
mov rax, qword [r14 + rax]
mov ecx, dword [rax + 0x78]
mov dword [r15 - 4], ecx
mov dword [r15], r12d
movsxd rax, esi
lea rcx, [rax + rax*2]
lea rdi, [rbp + 0x198]
lea rdi, [rdi + rcx*8]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea edx, [rax + 0x15]
lea rcx, [rbp - 8]
call fcn.1400140c0
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x58], rax
mov rbx, qword [rbp - 8]
mov qword [rsp + 0x50], rbx
cmp rax, 0xffffffffffffffff
je 0x140024fb6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x140024fa7
mov ecx, esi
call fcn.140028f04
mov rdi, rax
mov qword [rsp + 0x60], rax
mov dword [rbp - 0x68], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x68]
mov r8d, esi
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140024daa
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x20], 0x67452301
mov dword [rbp + 0x24], 0xefcdab89
mov dword [rbp + 0x28], 0x98badcfe
mov dword [rbp + 0x2c], 0x10325476
mov r8d, esi
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.140015a70
lea rcx, [rbp + 0x20]
call fcn.140015b70
movups xmm0, xmmword [rbp + 0x78]
movups xmmword [r15 + 4], xmm0
mov eax, esi
and eax, 0xf
mov ecx, 0x10
sub ecx, eax
add ecx, 0x10
add ecx, esi
call fcn.140028f04
mov r13, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
call fcn.14001aa60
mov r15, qword [rbp - 0x20]
lea r12, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae r12, rbx
test r13, r13
je 0x140024e07
test r15, r15
je 0x140024dff
movups xmm0, xmmword [r15]
movups xmmword [r13], xmm0
jmp 0x140024e17
xorps xmm0, xmm0
movups xmmword [r13], xmm0
call fcn.140033c2c
mov dword [rax], 0x16
call fcn.14002ef28
lea rbx, [r13 + 0x10]
mov r9, rsi
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14001ca50
movzx ecx, sil
and cl, 0xf
movsx eax, cl
mov edi, 0x10
sub edi, eax
movsx rax, cl
mov r8d, 0x10
sub r8, rax
lea rcx, [r13 + 0x10]
add rcx, rsi
mov edx, edi
call fcn.14002aed0
add edi, esi
lea esi, [rdi + 0x10]
mov rdx, r12
lea rcx, [rbp + 0x90]
call fcn.140001c10
movups xmm0, xmmword [r15]
movaps xmmword [rbp + 0x180], xmm0
lea r8, [rbp + 0x180]
test rdi, rdi
je 0x140024ecd
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
mov rax, rbx
sub r8, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140024ea0
lea rdx, [rbp + 0x90]
mov rcx, rbx
call fcn.140002320
mov r8, rbx
add rbx, 0x10
sub rdi, 1
jne 0x140024e90
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140024f4c
lea r9d, [r12 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp - 0x64], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x64]
mov r8d, esi
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x48]
mov dword [r15], esi
jmp 0x140024f51
mov r15, qword [rsp + 0x48]
mov rcx, r13
call fcn.1400285fc
mov rcx, qword [rsp + 0x60]
call fcn.1400285fc
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140024f9d
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024f98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025179
call fcn.1400285fc
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x70]
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140025021
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov r8d, 0xa8
lea rdx, [rbp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x10]
cmp rax, 0x10
jb 0x14002505d
lea rdx, [rax + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140025054
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002517f
mov rcx, rbx
call fcn.1400285fc
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140025098
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025093
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025185
call fcn.1400285fc
inc esi
mov dword [rsp + 0x70], esi
add r14, 0x10
mov qword [rsp + 0x40], r14
add r15, 0x18
mov qword [rsp + 0x48], r15
cmp esi, 7
jge 0x1400250bf
mov rbx, qword [rsp + 0x68]
jmp 0x140024c50
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1400250fb
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400250f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002518b
call fcn.1400285fc
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140025143
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002513e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025173
call fcn.1400285fc
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400285b0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002ef48
nop
call fcn.14002ef48
nop
call fcn.14002ef48
nop
call fcn.14002ef48
nop
call fcn.14002ef48
int3