Function at 0x50000a000
Capabilities:
Create thread
Encrypt data using speck
Terminate process

Disassembly:
push rbp
add bpl, cl
push rbx
rol bp, cl
push rdi
push r13
xor rbp, 0xaa7993
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
neg r8b
sub r8b, 0x89
shr r8b, 0x15
mov qword [rsp + 0x28], 0
and r8d, r8d
sub r8b, 0xa2
lea r8, [0x500001910]
sub r9d, r9d
clc
cmc
mov dword [rsp + 0x20], 0
sub edx, edx
test r11b, r14b
clc
xor ecx, ecx
jmp 0x50000a05b
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.500002460
sub edi, edi
movzx r9, bp
mov dword [rbp - 0x49], 0x70858b48
cwd
mov dword [rbp - 0x45], 0x48fffffa
movsx r9w, r11b
movabs r13, 0x200000000
movsx r9, cx
mov dword [rbp - 0x41], 0xf9b88589
cmovo cx, r11w
cdq
nop dword [rax]
movsx cx, al
cdq
jmp 0x50000a0a9
xorps xmm0, xmm0
movsx r9w, bpl
jmp 0x50000a0b8
lea r8, [rbp - 0x29]
cwd
cqo
movsx r9, r8w
mov r9d, 0x30
movzx dx, cl
movsx edx, r10w
mov rdx, rdi
movzx rcx, r12w
movups xmmword [rbp - 0x29], xmm0
movzx rcx, r8w
movups xmmword [rbp - 0x19], xmm0
movsx cx, r14b
movsx rcx, r13w
movzx rcx, r14w
lea rcx, [r9 - 0x31]
jmp 0x50000a0fb
movups xmmword [rbp - 9], xmm0
jmp 0x50000a104
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rbx, qword [rbp - 0x29]
sar r11b, cl
dec r11
mov r11, qword [rbp - 0x11]
cmp r11d, r8d
test rbx, rbx
jmp 0x50000a123
je 0x50000a1f7
cmp dword [rbp - 9], 0x1000
jmp 0x50000a135
jne 0x50000a1f7
cmp dword [rbp - 5], 0x40
jne 0x50000a1f7
lea r10, [r11 - 0xc]
sub r8d, r8d
cmp ebx, 0x1317be0f
test r10, r10
jmp 0x50000a15a
je 0x50000a1f7
lea rax, [rbp - 0x49]
sal rcx, 0x97
rol r9b, 7
mov r9, rbx
sub r9, rax
nop dword [rax + rax]
bsr eax, esi
clc
xor edx, edx
rcr al, 0x19
add rax, 0xffffffffd7ab7f21
lea rax, [rbp - 0x49]
sub cx, 0x2004
lea rax, [rax + rdx]
lea rcx, [r9 + rax]
test r9, 0x5a1ecf1b
movzx eax, byte [rax]
stc
test cx, 0x1706
cmp byte [rcx + r8], al
jmp 0x50000a1b4
jne 0x50000a1dc
cmp rdx, 0xb
jmp 0x50000a1c3
je 0x50000a245
inc rdx
clc
cmp rdx, 0xc
jmp 0x50000a1d6
jb 0x50000a18a
inc rbx
inc r8
test spl, 0x2b
test r10, r11
cmp r8, r10
jmp 0x50000a1f1
jb 0x50000a17e
lea rdi, [rdi + r11]
cmp rdi, r13
jb 0x50000a0a9
sub r9d, r9d
shrd r8, r13, 0x35
rcl edx, cl
lea r8, str.error
btc dx, ax
lea rdx, str.newwriteposition
xor ecx, ecx
jmp 0x50000a227
call qword [sym.imp.USER32.dll_MessageBoxW]
sub ecx, ecx
jmp 0x50000a234
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test rbx, rbx
jmp 0x50000a24d
je 0x50000a204
xorps xmm0, xmm0
lea rdx, [rbp + 7]
bswap ecx
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rbp + 7], xmm0
jmp 0x50000a26e
movups xmmword [rbp + 0x17], xmm0
jmp 0x50000a277
movups xmmword [rbp + 0x27], xmm0
jmp 0x50000a280
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp qword [rbp + 0x1f], 0x5000
jmp 0x50000a293
jbe 0x50000a2bf
mov rax, qword [rbx - 0x17]
movsxd rdx, r11d
mov dword [rax], 0x1b8
adc cx, r10w
bsf r8w, dx
mov word [rax + 4], 0xc300
rol r8b, cl
sub cl, r13b
xadd dx, dx
mov dword [rbp - 0x49], 0x4b85940f
add ecx, r12d
bswap r8d
xor ebx, ebx
cwd
xchg cx, r8w
mov dword [rbp - 0x45], 0xffffff8
mov dl, cl
movsx rdx, r14w
mov dword [rbp - 0x41], 0xf84b85b6
movzx dx, spl
mov dword [rbp - 0x3d], 0xc085ffff
not cx
nop dword [rax]
movzx dx, dl
xorps xmm0, xmm0
movsx r8w, bl
lea r8, [rbp - 0x29]
movzx dx, r11b
mov r9d, 0x30
mov cl, dil
movzx edx, r12w
not ch
mov rdx, rbx
mov cl, 0x96
movups xmmword [rbp - 0x29], xmm0
movzx cx, dl
movsx cx, r11b
movzx ecx, r12w
movups xmmword [rbp - 0x19], xmm0
movsx ecx, r12w
lea rcx, [r9 - 0x31]
movups xmmword [rbp - 9], xmm0
jmp 0x50000a349
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r10, qword [rbp - 0x29]
mov rdi, qword [rbp - 0x11]
cmp r10d, 0x3db76a12
cmp ebx, r13d
jmp 0x50000a366
test r10, r10
jmp 0x50000a36e
je 0x50000a429
cmp dword [rbp - 9], 0x1000
jmp 0x50000a380
jne 0x50000a429
cmp dword [rbp - 5], 0x40
jmp 0x50000a38f
jne 0x50000a429
lea r11, [rdi - 0x10]
jmp 0x50000a39e
sub r8d, r8d
test r11, r11
je 0x50000a429
lea rax, [rbp - 0x49]
mov r9, r10
sub r9, rax
clc
movsxd rcx, r10d
nop dword [rax + rax]
cwde
xor edx, edx
not cl
cmc
add cl, r11b
lea rax, [rbp - 0x49]
lea rax, [rax + rdx]
rcr ecx, 0x3c
add cl, 0x8d
lea rcx, [r9 + rax]
jmp 0x50000a3e0
movzx eax, byte [rax]
test r9b, r12b
cmp sil, 0x91
cmp byte [rcx + r8], al
jmp 0x50000a3f3
jne 0x50000a41a
cmp rdx, 0xf
jmp 0x50000a402
je 0x50000a471
inc rdx
cmp rdx, 0x10
jmp 0x50000a414
jb 0x50000a3c9
inc r10
inc r8
cmp r8, r11
jb 0x50000a3c1
add rbx, rdi
cmp rbx, r13
jb 0x50000a2fe
xor r9d, r9d
rcr r8d, cl
rol r8b, 0x3d
lea r8, str.error
lea rdx, str.buleandred
cmp r13b, sil
clc
xor ecx, ecx
jmp 0x50000a458
call qword [sym.imp.USER32.dll_MessageBoxW]
sub ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test r10, r10
jmp 0x50000a479
je 0x50000a435
cmp byte [r10 + 0x1a], 0x80
lea rax, [r10 + 0x1f]
jmp 0x50000a48d
je 0x50000a499
lea rax, [r10 + 0x1c]
cqo
mov r9d, 2
cwd
setae dl
cqo
mov dword [rax], 0xa
cqo
movzx rdx, r14w
not dl
lea rdx, [r10 + 0x10]
bswap r8
mov qword [0x5000082a8], rax
not r8d
movzx r8d, r8w
lea r8, [rbp + 0x67]
mov ecx, r11d
movzx rcx, r15w
mov word [rbp + 0x67], 0x9090
movsxd rcx, r8d
mov qword [rsp + 0x20], 0
not rcx
movsx cx, sil
lea rcx, [r9 - 3]
jmp 0x50000a4f7
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.500002110
call fcn.5000026b0
call fcn.500001b80
mov qword [rsp + 0xe8], rsi
shl r9b, cl
rcr edx, cl
btc r9, rdi
xor ebx, ebx
movzx r9w, dil
mov qword [rsp + 0xf0], r12
movsxd r9, r9d
mov dword [rbp - 0x49], 0xa8bd894c
mov r9b, r10b
mov dword [rbp - 0x45], 0x48fffffd
jmp 0x50000a545
mov dword [rbp - 0x41], 0xfda0bd89
movsx r9, r12w
bswap r8d
jmp 0x50000a558
mov word [rbp - 0x3d], 0xffff
bswap r9w
cdq
nop dword [rax]
not dh
jmp 0x50000a571
nop word [rax + rax]
movsx dx, sil
cqo
xorps xmm0, xmm0
jmp 0x50000a58a
lea r8, [rbp - 0x29]
cdq
cmovg cx, r13w
setnp dh
mov r9d, 0x30
movsx rcx, r15w
mov edx, 0xb2d7284
cwd
mov rdx, rbx
movsx cx, bpl
movzx ecx, r8w
mov cl, r15b
movups xmmword [rbp - 0x29], xmm0
movsx ecx, sp
movsxd rcx, esp
movups xmmword [rbp - 0x19], xmm0
xchg cl, cl
movzx ecx, r8w
jmp 0x50000a5d0
lea rcx, [r9 - 0x31]
jmp 0x50000a5d9
movups xmmword [rbp - 9], xmm0
jmp 0x50000a5e2
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r10, qword [rbp - 0x29]
xadd edi, edi
mov rdi, qword [rbp - 0x11]
cmp r11w, r10w
test bh, 0x92
cmc
test r10, r10
je 0x50000a6cf
cmp dword [rbp - 9], 0x1000
jmp 0x50000a610
jne 0x50000a6cf
cmp dword [rbp - 5], 0x40
jmp 0x50000a61f
jne 0x50000a6cf
lea r11, [rdi - 0xe]
jmp 0x50000a62e
xor r8d, r8d
test r11, r11
je 0x50000a6cf
lea rax, [rbp - 0x49]
cmovp r9, rbx
mov r9, r10
sar cx, 0xba
sub r9, rax
nop dword [rax + rax]
sub edx, edx
btc ax, 0x35
test dl, r11b
add cx, r11w
lea rax, [rbp - 0x49]
bsr rcx, r10
lea rax, [rax + rdx]
shr rcx, 0x3c
movzx ecx, cx
lea rcx, [r9 + rax]
test spl, 0x3b
cmp r13b, 0x90
stc
movzx eax, byte [rax]
cmp byte [rcx + r8], al
jmp 0x50000a68e
jne 0x50000a6b5
cmp rdx, 0xd
jmp 0x50000a69d
je 0x50000a6f8
inc rdx
cmp rdx, 0xe
jmp 0x50000a6af
jb 0x50000a662
inc r10
inc r8
cmc
cmp si, 0xc58b
cmp r8, r11
jmp 0x50000a6c9
jb 0x50000a654
add rbx, rdi
cmc
cmp r10w, r15w
cmp rbx, r13
jb 0x50000a582
sub ecx, ecx
jmp 0x50000a6e7
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test r10, r10
jmp 0x50000a700
je 0x50000a6e0
mov eax, dword [r10 + 0x1d]
sub ebx, ebx
movsx cx, r8b
mov dword [rbp - 0x49], 0x80ec8148
movsx dx, sil
movzx r9w, bl
movsx r9, r15w
mov dword [rbp - 0x45], 0x48000000
jmp 0x50000a73a
mov dword [rbp - 0x41], 0xc033f18b
lea rax, [rax*8 + 0x20]
mov dl, r10b
xchg r8, rdx
mov dword [rbp - 0x3d], 0x80458948
mov qword [0x500008260], rax
sete r9b
movsx cx, bl
movsx r9, sp
mov dword [rbp - 0x39], 0x48884589
movsxd rcx, edx
movzx cx, r8b
cwd
mov dword [rbp - 0x35], 0x89904589
cdq
mov word [rbp - 0x31], 0x9845
mov r8, 0x6982018d
movsx ecx, r8w
nop
cmovns cx, r11w
movsx r9, bp
movzx dx, r13b
xorps xmm0, xmm0
lea r8, [rbp - 0x29]
mov r9d, 0x30
mov rdx, rbx
movups xmmword [rbp - 0x29], xmm0
movsx ecx, dx
movzx rcx, bp
movsx cx, r10b
movups xmmword [rbp - 0x19], xmm0
movsx ecx, bp
lea rcx, [r9 - 0x31]
jmp 0x50000a7d2
movups xmmword [rbp - 9], xmm0
jmp 0x50000a7db
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r10, qword [rbp - 0x29]
inc dil
mov rdi, qword [rbp - 0x11]
jmp 0x50000a7f1
test r10, r10
je 0x50000a8b3
cmp dword [rbp - 9], 0x1000
jne 0x50000a8b3
cmp dword [rbp - 5], 0x40
jmp 0x50000a810
jne 0x50000a8b3
lea r11, [rdi - 0x1a]
cmp spl, 0x3a
xor r8d, r8d
cmc
test r11, r11
jmp 0x50000a82a
je 0x50000a8b3
lea rax, [rbp - 0x49]
and ecx, r8d
dec rcx
mov r9, r10
shrd cx, ax, 0xb6
xor cl, dil
sub r9, rax
nop dword [rax + rax]
inc cl
bt cx, 0x91
xor edx, edx
lea rax, [rbp - 0x49]
add rax, rdx
lea rcx, [r9 + rax]
movzx eax, byte [rax]
cmp byte [rcx + r8], al
jmp 0x50000a870
jne 0x50000a898
cmp rdx, 0x19
jmp 0x50000a87f
je 0x50000a8ce
inc rdx
clc
cmp rdx, 0x1a
jmp 0x50000a892
jb 0x50000a859
inc r10
jmp 0x50000a8a0
inc r8
cmc
clc
cmp r8, r11
jmp 0x50000a8ad
jb 0x50000a857
add rbx, rdi
jmp 0x50000a8bb
cmp rbx, r13
jmp 0x50000a8c3
jb 0x50000a7a2
jmp 0x50000a6e0
test r10, r10
jmp 0x50000a8d6
je 0x50000a6e0
movzx eax, byte [r10 + 0x2e]
clc
stc
cmp al, 0x46
jne 0x50000a8f5
movzx eax, byte [r10 + 0x2f]
jmp 0x50000a90d
cmp al, 0x86
jmp 0x50000a8fc
jne 0x50000a921
mov eax, dword [r10 + 0x2f]
sub rdx, 0x1d1ec121
mov dword [0x5000080dc], eax
rcl ch, 0x9e
shl rcx, 0x2a
mov qword [0x500008268], rax
mov dword [rbp - 0x49], 0xb84d8b48
xor ebx, ebx
not r8b
mov dword [rbp - 0x45], 0x48088948
mov dword [rbp - 0x41], 0x89c04d63
movsx r8w, spl
xchg r9b, r9b
cqo
mov dword [rbp - 0x3d], 0x8b480848
movzx edx, r11w
movzx r8w, bpl
movsxd r8, r10d
mov dword [rbp - 0x39], 0xc18348cd
xchg r9w, cx
movsx r9d, si
bswap cx
mov dword [rbp - 0x35], 0xd68b48c8
mov dword [rbp - 0x31], 0x20ec8348
nop dword [rax]
xchg r9d, ecx
movsx r9, cx
nop word [rax + rax]
movzx r8, r12w
mov r8w, bx
xorps xmm0, xmm0
movzx r8w, bpl
lea r8, [rbp - 0x29]
mov r9d, 0x30
mov rdx, rbx
mov cl, r11b
movups xmmword [rbp - 0x29], xmm0
not cx
movsx cx, r14b
xchg cl, ch
movups xmmword [rbp - 0x19], xmm0
lea rcx, [r9 - 0x31]
movups xmmword [rbp - 9], xmm0
jmp 0x50000a9cc
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r10, qword [rbp - 0x29]
dec dil
shl dil, cl
mov rdi, qword [rbp - 0x11]
jmp 0x50000a9e5
test r10, r10
jmp 0x50000a9ed
je 0x50000aad1
cmp dword [rbp - 9], 0x1000
jmp 0x50000a9ff
jne 0x50000aad1
cmp dword [rbp - 5], 0x40
jne 0x50000aad1
lea r11, [rdi - 0x1c]
sub r8d, r8d
cmp sil, spl
stc
test r15d, r10d
test r11, r11
jmp 0x50000aa25
je 0x50000aad1
lea rax, [rbp - 0x49]
sar r9b, cl
bts r9w, r8w
rcr ch, cl
mov r9, r10
sub r9, rax
ror ah, cl
setno al
mov ecx, r11d
nop dword [rax + rax]
adc ah, 1
xor edx, edx
lahf
movsx ax, r15b
lea rax, [rbp - 0x49]
add rax, rdx
xchg cl, cl
sbb cx, 0x8f27
movzx ecx, di
lea rcx, [r9 + rax]
cmp r14b, 0x82
jmp 0x50000aa7c
movzx eax, byte [rax]
test r13b, bpl
cmp byte [rcx + r8], al
jmp 0x50000aa8b
jne 0x50000aaad
cmp rdx, 0x1b
je 0x50000aae8
inc rdx
cmp rdx, 0x1c
jmp 0x50000aaa7
jb 0x50000aa5a
inc r10
jmp 0x50000aab5
inc r8
cmp sil, 0x35
test r11, 0x21b39137
cmp r8, r11
jmp 0x50000aacb
jb 0x50000aa52
lea rbx, [rbx + rdi]
cmp rbx, r13
jmp 0x50000aadd
jb 0x50000a995
jmp 0x50000a6e0
test r10, r10
jmp 0x50000aaf0
je 0x50000a6e0
mov eax, dword [r10 - 4]
sub ebx, ebx
movzx rdx, bx
movzx edx, ax
cdq
mov qword [0x500008220], rax
movsxd r8, edx
mov dword [rbp - 0x49], 0xff708589
mov dword [rbp - 0x45], 0x3f83ffff
cwd
movsxd r9, esi
mov r8b, sil
mov dword [rbp - 0x41], 0x478b4800
movzx r9w, sil
mov byte [rbp - 0x3d], 0x38
xorps xmm0, xmm0
cmovae rdx, rbx
lea r8, [rbp - 0x29]
movzx r9w, sil
sets cl
not r9
mov r9d, 0x30
movsx rdx, si
bswap ecx
jmp 0x50000ab5b
mov rdx, rbx
movsx ecx, r9w
movzx cx, bl
movsx cx, r10b
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movsxd rcx, ebp
setg cl
mov ecx, r8d
lea rcx, [r9 - 0x31]
jmp 0x50000ab85
movups xmmword [rbp - 9], xmm0
jmp 0x50000ab8e
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9, qword [rbp - 0x29]
movsxd rdi, r13d
jmp 0x50000aba3
mov rdi, qword [rbp - 0x11]
test r15b, 0x22
test r9, r9
jmp 0x50000abb3
je 0x50000ac86
cmp dword [rbp - 9], 0x1000
jmp 0x50000abc5
jne 0x50000ac86
cmp dword [rbp - 5], 0x40
jmp 0x50000abd4
jne 0x50000ac86
lea r11, [rdi - 0xd]
test r8, r11
clc
xor r10d, r10d
test r11, r11
je 0x50000ac86
lea r8, [rbp - 0x49]
sub r8, r9
movzx rdx, di
nop word [rax + rax]
bt edx, edx
bts dx, di
test r15, 0xffffffffc6b1cd36
sub eax, eax
lea rdx, [rax + r9]
bt cx, 0xb1
movzx ecx, byte [r8 + rdx]
test spl, bl
jmp 0x50000ac2a
cmp byte [rdx], cl
jmp 0x50000ac31
jne 0x50000ac5b
cmp rax, 0xc
jmp 0x50000ac40
je 0x50000aca1
inc rax
cmp r9, rdx
cmp rax, 0xd
jmp 0x50000ac55
jb 0x50000ac14
inc r9
jmp 0x50000ac63
dec r8
jmp 0x50000ac6b
inc r10
test sp, 0x94ad
stc
cmp r11w, ax
cmp r10, r11
jmp 0x50000ac80
jb 0x50000ac12
add rbx, rdi
jmp 0x50000ac8e
cmp rbx, r13
jmp 0x50000ac96
jb 0x50000ab34
jmp 0x50000a6e0
test r9, r9
jmp 0x50000aca9
je 0x50000a6e0
mov eax, dword [r9 + 0xe]
mov cl, 0xb
cwd
movabs rsi, 0x140000000
mov dword [rbp - 0x49], 0x6667b848
sets r9b
mov rbx, rsi
cwd
movzx rcx, r10w
movzx dx, r9b
mov dword [rbp - 0x45], 0x66666666
mov cl, 0x82
jmp 0x50000ace8
movabs r12, 0x150000000
cmova r8w, bp
movsx r8w, cl
movzx edx, r8w
mov dword [rbp - 0x41], 0x8b486666
movsxd r8, ebp
lea rax, [rax*8 + 0x20]
movsx rcx, ax
mov word [rbp - 0x3d], 0x48d9
bswap edx
mov qword [0x500008228], rax
movsx edx, r15w
movzx edx, r9w
mov dx, 0xff8f
mov byte [rbp - 0x3b], 0x2b
movzx r8d, sp
nop
xorps xmm0, xmm0
movsx r8, r10w
bswap cx
lea r8, [rbp - 0x29]
mov r9d, 0x30
movsxd rdx, r8d
mov rdx, rbx
movsx rcx, r11w
movups xmmword [rbp - 0x29], xmm0
mov cl, bpl
setg ch
movsx cx, dl
movups xmmword [rbp - 0x19], xmm0
movzx rcx, r12w
lea rcx, [r9 - 0x31]
jmp 0x50000ad77
movups xmmword [rbp - 9], xmm0
jmp 0x50000ad80
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9, qword [rbp - 0x29]
mov rdi, qword [rbp - 0x11]
test r9, r9
jmp 0x50000ad96
je 0x50000ae4a
cmp dword [rbp - 9], 0x1000
jmp 0x50000ada8
jne 0x50000ae4a
cmp dword [rbp - 5], 0x20
jne 0x50000ae4a
lea r11, [rdi - 0xf]
xor r10d, r10d
cmc
clc
test r11, r11
jmp 0x50000adc9
je 0x50000ae4a
lea r8, [rbp - 0x49]
shrd rax, r8, 0x8c
sub r8, r9
movzx cx, sil
sal ch, cl
nop word [rax + rax]
sub edx, edx
movsx rax, dx
dec ch
lea rcx, [rdx + r9]
movzx eax, byte [r8 + rcx]
cmp byte [rcx], al
jne 0x50000ae28
cmp rdx, 0xe
jmp 0x50000ae0f
je 0x50000ae60
inc rdx
clc
cmp rdx, 0xf
jmp 0x50000ae22
inc r9
jmp 0x50000ae30
dec r8
jmp 0x50000ae38
inc r10
stc
clc
cmp sil, 4
cmp r10, r11
jb 0x50000aded
add rbx, rdi
cmp rbx, r12
jmp 0x50000ae55
jb 0x50000ad3a
jmp 0x50000a6e0
test r9, r9
jmp 0x50000ae68