Function at 0x10002210
Capabilities:
64-bit execution via heavens gate
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get common file path
Hash data with crc32
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12b4
call fcn.10003ec0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x12b0], ebx
cmp dword [ebx + 0x10], 0
jne 0x10002a04
test byte [ebx + 0xc], 1
je 0x10002395
cmp dword [ebx + 0x14], 6
jb 0x10002395
cmp dword [ebx + 0x18], 1
jb 0x10002395
push 0x104
lea eax, [ebp - 0x178]
mov dword [ebp - 0x127c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.ZwQuerySystemInformation
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10002499
lea eax, [ebp - 0x127c]
push eax
push 0
push 0
push 0xb
call esi
mov eax, dword [ebp - 0x127c]
test eax, eax
je 0x10002499
push eax
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
add esp, 8
mov edi, eax
lea eax, [ebp - 0x127c]
mov dword [ebp - 0x1298], edi
push eax
push dword [ebp - 0x127c]
push edi
push 0xb
call esi
test eax, eax
jne 0x10002499
mov eax, dword [ebp - 0x127c]
mov esi, edi
xor edi, edi
add eax, 0xffffffeb
je 0x10002315
push 0x15
push str.SystemRoot_system32_
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x10002315
mov eax, dword [ebp - 0x127c]
inc edi
add eax, 0xffffffeb
inc esi
cmp edi, eax
jb 0x100022f1
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov esi, eax
lea edx, [ebp - 0x178]
lea eax, [ebx + 0x34]
mov ecx, edx
sub eax, ecx
nop dword [eax + eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [eax + edx - 1], cl
test cl, cl
jne 0x10002330
lea ecx, [ebx + 0x34]
lea edi, [ecx - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10002343
mov ax, word [0x100048c4]
mov edx, esi
mov word [edi], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x10002358
sub esi, edx
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x10002362
mov edi, ecx
mov ecx, esi
push dword [ebp - 0x1298]
mov dword [ebp - 0x128c], esi
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x128c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
test byte [ebx + 0xc], 2
mov edi, 0x5a4d
je 0x100024f5
push 4
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100024f5
mov eax, dword [ebx + 8]
test eax, eax
je 0x10002555
cmp word [eax], di
jne 0x10002555
push eax
call dword [sym.imp.imagehlp.dll_ImageNtHeader]
mov dword [ebp - 0x1298], eax
test eax, eax
je 0x10002555
cmp dword [eax], 0x4550
jne 0x10002555
movzx ecx, word [eax + 0x14]
mov esi, dword [ebx + 0x138]
add ecx, 0x24
cmp esi, dword [ebx + 0x13c]
je 0x10002407
mov dword [ebx + 0x13c], esi
xor edx, edx
xor esi, esi
mov dword [ebp - 0x128c], edx
cmp si, word [eax + 6]
jae 0x100024f5
add ecx, eax
mov dword [ebp - 0x127c], ecx
mov eax, dword [ecx + 0x18]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x100024ce
mov esi, dword [ebx + 8]
xor edx, edx
add esi, dword [ecx]
mov edi, dword [ecx - 4]
or ecx, 0xffffffff
mov dword [ebp - 0x12a8], esi
mov dword [ebp - 0x12a4], edi
test edi, edi
je 0x1000246b
movzx eax, byte [edx + esi]
inc edx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10004190]
cmp edx, edi
jb 0x10002453
mov eax, dword [ebx + 0x13c]
not ecx
mov dword [ebp - 0x12a0], ecx
cmp eax, dword [ebx + 0x140]
je 0x100024af
movq xmm0, qword [ebp - 0x12a8]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [ebx + 0x13c], 0xc
jmp 0x100024c2
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000311c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x12a8]
push ecx
push eax
lea ecx, [ebx + 0x138]
call fcn.10002f60
mov edx, dword [ebp - 0x128c]
mov ecx, dword [ebp - 0x127c]
mov eax, dword [ebp - 0x1298]
inc edx
add ecx, 0x28
mov dword [ebp - 0x128c], edx
mov dword [ebp - 0x127c], ecx
movzx eax, word [eax + 6]
cmp edx, eax
jb 0x10002423
mov edi, 0x5a4d
test byte [ebx + 0xc], 4
je 0x10002a04
cmp dword [ebx + 0x1c], 0
je 0x1000256b
push 0x10006410
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.100016b0
push edx
push eax
call fcn.10001f80
add esp, 8
mov dword [ebx + 0x148], eax
or eax, edx
mov dword [ebx + 0x14c], edx
je 0x10002599
call fcn.100016b0
sub dword [ebx + 0x148], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sbb dword [ebx + 0x14c], edx
jmp 0x100025c3
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000311c
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ZwQueryInformationProcess
push str.ntdll.dll
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x148], eax
or eax, 0
mov dword [ebx + 0x14c], 0
jne 0x100025af
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000311c
mov esp, ebp
pop ebp
ret
push str.ntdll.dll
call esi
sub dword [ebx + 0x148], eax
sbb dword [ebx + 0x14c], 0
cmp dword [ebx + 0x1c], 0
je 0x100026d8
call fcn.100016b0
lea ecx, [ebp - 0x1278]
mov dword [ebp - 0x1298], ecx
test eax, eax
jne 0x100025e6
test edx, edx
je 0x10002647
mov dword [ebp - 0x1290], eax
mov dword [ebp - 0x128c], edx
push 0x33
call 0x100025f9
add dword [esp], 5
retf
mov eax, 0x5a4d
cmp word [ebp - 0x1278], ax
jne 0x10002a17
lea ecx, [ebp - 0x1278]
add ecx, dword [ebp - 0x123c]
cmp dword [ecx], 0x4550
jne 0x10002a17
movzx eax, word [ecx + 0x14]
xor edx, edx
movzx esi, word [ecx + 6]
add eax, 0x18
add eax, ecx
mov dword [ebp - 0x128c], esi
test esi, esi
je 0x1000274f
mov ecx, esi
mov esi, dword [eax + 0xc]
xor edi, edi
cmp edi, dword [ebx + 0x14c]
mov edi, dword [ebx + 0x148]
ja 0x100026cb
jb 0x100026a9
cmp esi, edi
ja 0x100026cb
mov ecx, dword [eax + 8]
add ecx, esi
cmp dword [ebx + 0x14c], 0
jb 0x1000274f
ja 0x100026c5
cmp edi, ecx
jbe 0x1000274f
mov ecx, dword [ebp - 0x128c]
inc edx
add eax, 0x28
cmp edx, ecx
jb 0x10002690
jmp 0x1000274f
push str.ntdll.dll
call esi
cmp word [eax], di
jne 0x10002a17
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10002a17
movzx eax, word [ecx + 0x14]
xor edx, edx
movzx esi, word [ecx + 6]
add eax, 0x18
add eax, ecx
mov dword [ebp - 0x128c], esi
test esi, esi
je 0x1000274f
mov ecx, esi
mov esi, dword [eax + 0xc]
xor edi, edi
cmp edi, dword [ebx + 0x14c]
mov edi, dword [ebx + 0x148]
ja 0x10002747
jb 0x1000272d
cmp esi, edi
ja 0x10002747
mov ecx, dword [eax + 8]
add ecx, esi
cmp dword [ebx + 0x14c], 0
jb 0x1000274f
ja 0x10002741
cmp edi, ecx
jbe 0x1000274f
mov ecx, dword [ebp - 0x128c]
inc edx
add eax, 0x28
cmp edx, ecx
jb 0x10002714
mov esi, dword [eax + 0x14]
sub esi, dword [eax + 0xc]
add esi, dword [ebx + 0x148]
test esi, esi
je 0x10002a17
push 0x208
lea eax, [ebp - 0x278]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x278]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x278]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10002794
cmp dword [ebx + 0x24], 0
mov eax, dword [str._ntdll.dll]
mov dword [ecx], eax
mov eax, dword [0x100048e8]
mov dword [ecx + 4], eax
mov eax, dword [0x100048ec]
mov dword [ecx + 8], eax
mov eax, dword [0x100048f0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100048f4]
mov dword [ecx + 0x10], eax
mov ax, word [0x100048f8]
mov word [ecx + 0x14], ax
je 0x100027fb
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100027fb
lea ecx, [ebp - 0x127c]
push ecx
call eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10002837
mov eax, 3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000311c
mov esp, ebp
pop ebp
ret
push 1
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x12b4]
push eax
push 0x64
lea eax, [ebp - 0x70]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebx + 0x1c]
lea esi, [ebp - 0x70]
push edi
lea edx, [ebp - 0x1290]
mov ecx, esi
call fcn.10001260
add esp, 4
cmp eax, 5
jne 0x10002881
cmp byte [esi], 0xb8
je 0x10002885
add esi, eax
jmp 0x10002866
cmp dword [ebx + 0x24], 0
mov eax, dword [esi + 1]
mov dword [ebx + 0x150], eax
je 0x100028b8
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100028b8
lea ecx, [ebp - 0x127c]
push ecx
call eax
push 0x40
push 0x1000
push dword [ebx + 0x28]
mov byte [ebp - 0x12ac], 0xb8
push 0
push 0xffffffffffffffff
mov dword [ebp - 0x12a7], 0x3e8
mov dword [ebp - 0x12a3], 0x14c200
mov dword [ebp - 0x129f], 0x340fd48b
mov byte [ebp - 0x129b], 0xc3
mov byte [ebp - 0x1290], 0xb8
mov dword [ebp - 0x128b], 0xfd18b4c
mov byte [ebp - 0x1287], 5
mov byte [ebp - 0x1291], 0xc3
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebx + 0x2c], eax
test eax, eax
jne 0x10002934
mov eax, 5
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000311c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov eax, dword [ebx + 0x2c]
xor esi, esi
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add esp, 4
mov dword [ebp - 0x12b0], eax
cmp dword [ebx + 0x28], esi
jbe 0x10002971
nop word [eax + eax]
call edi
mov ecx, dword [ebp - 0x12b0]
mov byte [esi + ecx], al
inc esi
cmp esi, dword [ebx + 0x28]
jb 0x10002960
call edi
mov ecx, dword [ebx + 0x28]
xor edx, edx
sub ecx, 0x1d
div ecx
mov eax, dword [ebx + 0x150]
mov ecx, dword [ebx + 0x2c]
add ecx, edx
mov dword [ebp - 0x12ab], eax
movups xmm0, xmmword [ebp - 0x12ac]
mov dword [ebx + 0x154], ecx
xor edx, edx
mov dword [ebp - 0x128f], eax
movzx eax, word [ebp - 0x129c]
movups xmmword [ecx], xmm0
mov word [ecx + 0x10], ax
add ecx, 0x12
movq xmm0, qword [ebp - 0x1290]
movzx eax, word [ebp - 0x1288]
mov dword [ebx + 0x158], ecx
movq qword [ecx], xmm0
mov word [ecx + 8], ax
mov al, byte [ebp - 0x1291]
mov byte [ecx + 0xa], al
or ecx, 0xffffffff
mov edi, dword [ebx + 0x28]
test edi, edi
je 0x100029ff
mov esi, dword [ebx + 0x2c]
movzx eax, byte [edx + esi]
inc edx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10004190]
cmp edx, edi
jb 0x100029e7
not ecx
mov dword [ebx + 0x30], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000311c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 6
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000311c
mov esp, ebp
pop ebp
ret