Function at 0x450940
Capabilities:
64-bit execution via heavens gate
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get common file path
Hash data with crc32
Parse pe header
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x11c4
call fcn.00456720
mov eax, dword [0x46b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x119c], esi
cmp dword [esi + 0x10], 0
jne 0x45117e
test byte [esi + 0xc], 1
je 0x450ae3
cmp dword [esi + 0x14], 6
jb 0x450ae3
cmp dword [esi + 0x18], 1
jb 0x450ae3
push 0x104
lea eax, [ebp - 0x110]
mov dword [ebp - 0x117c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.ZwQuerySystemInformation
push 0x4656b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x450bf4
lea eax, [ebp - 0x117c]
push eax
push 0
push 0
push 0xb
call edi
mov eax, dword [ebp - 0x117c]
test eax, eax
je 0x450bf4
push eax
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
add esp, 8
mov dword [ebp - 0x118c], eax
lea ecx, [ebp - 0x117c]
push ecx
push dword [ebp - 0x117c]
push eax
push 0xb
call edi
test eax, eax
jne 0x450bf4
mov eax, dword [ebp - 0x117c]
mov edi, dword [ebp - 0x118c]
add eax, 0xffffffeb
je 0x450a5f
xor esi, esi
push 0x15
push str.SystemRoot_system32_
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x450a59
mov eax, dword [ebp - 0x117c]
inc esi
add eax, 0xffffffeb
inc edi
cmp esi, eax
jb 0x450a35
mov esi, dword [ebp - 0x119c]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
lea ecx, [ebp - 0x110]
mov edx, eax
lea edi, [esi + 0x34]
mov eax, ecx
sub edi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x450a75
lea edi, [esi + 0x33]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x450a85
mov ax, word [0x4657a8]
mov ecx, edx
mov word [edi], ax
mov dword [ebp - 0x1194], ecx
mov al, byte [edx]
inc edx
test al, al
jne 0x450aa0
sub edx, ecx
sub esi, 0xffffffcd
nop dword [eax]
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x450ab0
push dword [ebp - 0x118c]
mov ecx, edx
mov edi, esi
mov esi, dword [ebp - 0x1194]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [ebp - 0x119c]
add esp, 4
test byte [esi + 0xc], 2
mov edi, 0x5a4d
je 0x450c4d
push 4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x450c4d
mov eax, dword [esi + 8]
test eax, eax
je 0x450cb0
cmp word [eax], di
jne 0x450cb0
push eax
call dword [sym.imp.imagehlp.dll_ImageNtHeader]
mov dword [ebp - 0x1194], eax
test eax, eax
je 0x450cb0
cmp dword [eax], 0x4550
jne 0x450cb0
movzx ecx, word [eax + 0x14]
mov edi, dword [esi + 0x138]
add ecx, 0x24
cmp edi, dword [esi + 0x13c]
je 0x450b55
mov dword [esi + 0x13c], edi
xor edx, edx
xor edi, edi
mov dword [ebp - 0x118c], edx
cmp di, word [eax + 6]
jae 0x450c4d
add ecx, eax
mov dword [ebp - 0x117c], ecx
mov eax, dword [ecx + 0x18]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x450c2b
mov edi, dword [esi + 8]
xor edx, edx
add edi, dword [ecx]
mov eax, dword [ecx - 4]
or ecx, 0xffffffff
mov dword [ebp - 0x11bc], edi
mov dword [ebp - 0x11b8], eax
test eax, eax
je 0x450bc6
mov esi, dword [ebp - 0x117c]
movzx eax, byte [edx + edi]
inc edx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45da30]
cmp edx, dword [esi - 4]
jb 0x450ba7
mov esi, dword [ebp - 0x119c]
mov eax, dword [esi + 0x13c]
not ecx
mov dword [ebp - 0x11b4], ecx
cmp eax, dword [esi + 0x140]
je 0x450c0c
movq xmm0, qword [ebp - 0x11bc]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [esi + 0x13c], 0xc
jmp 0x450c1f
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455723
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x11bc]
push ecx
push eax
lea ecx, [esi + 0x138]
call fcn.004516d0
mov edx, dword [ebp - 0x118c]
mov ecx, dword [ebp - 0x117c]
mov eax, dword [ebp - 0x1194]
inc edx
add ecx, 0x28
mov dword [ebp - 0x118c], edx
mov dword [ebp - 0x117c], ecx
movzx eax, word [eax + 6]
cmp edx, eax
jb 0x450b71
test byte [esi + 0xc], 4
je 0x45117e
cmp dword [esi + 0x1c], 0
je 0x450cc8
push 0x52d9a4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0044ff00
push edx
push eax
call fcn.004507d0
add esp, 8
mov dword [esi + 0x148], eax
or eax, edx
mov dword [esi + 0x14c], edx
je 0x450cf6
call fcn.0044ff00
sub dword [esi + 0x148], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sbb dword [esi + 0x14c], edx
jmp 0x450d22
mov eax, 2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455723
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ZwQueryInformationProcess
push 0x4656b8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x148], eax
or eax, 0
mov dword [esi + 0x14c], 0
jne 0x450d0e
mov eax, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455723
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x4656b8
call edi
sub dword [esi + 0x148], eax
sbb dword [esi + 0x14c], 0
cmp dword [esi + 0x1c], 0
je 0x450e40
call fcn.0044ff00
lea ecx, [ebp - 0x1178]
mov dword [ebp - 0x1194], ecx
test eax, eax
jne 0x450d45
test edx, edx
je 0x450da6
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x118c], edx
push 0x33
call 0x450d58
add dword [esp], 5
retf
mov ecx, 0x5a4d
cmp word [ebp - 0x1178], cx
jne 0x451193
lea ecx, [ebp - 0x1178]
add ecx, dword [ebp - 0x113c]
cmp dword [ecx], 0x4550
jne 0x451193
movzx eax, word [ecx + 0x14]
xor edx, edx
movzx edi, word [ecx + 6]
add eax, 0x18
add eax, ecx
mov dword [ebp - 0x118c], edi
test edi, edi
je 0x450ec3
nop dword [eax]
mov edi, dword [eax + 0xc]
xor ecx, ecx
cmp ecx, dword [esi + 0x14c]
mov ecx, dword [ebp - 0x118c]
ja 0x450e33
jb 0x450e0d
cmp edi, dword [esi + 0x148]
ja 0x450e33
mov ecx, dword [eax + 8]
add ecx, edi
cmp dword [esi + 0x14c], 0
jb 0x450ec3
ja 0x450e2d
cmp dword [esi + 0x148], ecx
jbe 0x450ec3
mov ecx, dword [ebp - 0x118c]
inc edx
add eax, 0x28
cmp edx, ecx
jb 0x450df0
jmp 0x450ec3
push 0x4656b8
call edi
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x451193
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x451193
movzx eax, word [ecx + 0x14]
xor edx, edx
movzx edi, word [ecx + 6]
add eax, 0x18
add eax, ecx
mov dword [ebp - 0x118c], edi
test edi, edi
je 0x450ec3
nop
mov edi, dword [eax + 0xc]
xor ecx, ecx
cmp ecx, dword [esi + 0x14c]
mov ecx, dword [ebp - 0x118c]
ja 0x450ebb
jb 0x450e9d
cmp edi, dword [esi + 0x148]
ja 0x450ebb
mov ecx, dword [eax + 8]
add ecx, edi
cmp dword [esi + 0x14c], 0
jb 0x450ec3
ja 0x450eb5
cmp dword [esi + 0x148], ecx
jbe 0x450ec3
mov ecx, dword [ebp - 0x118c]
inc edx
add eax, 0x28
cmp edx, ecx
jb 0x450e80
mov edi, dword [eax + 0x14]
sub edi, dword [eax + 0xc]
add edi, dword [esi + 0x148]
test edi, edi
je 0x451193
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x110]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x450f06
cmp dword [esi + 0x24], 0
mov eax, dword [str._ntdll.dll]
mov dword [ecx], eax
mov eax, dword [0x4657cc]
mov dword [ecx + 4], eax
mov ax, word [0x4657d0]
mov word [ecx + 8], ax
mov al, byte [0x4657d2]
mov byte [ecx + 0xa], al
je 0x450f5b
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x450f5b
lea ecx, [ebp - 0x117c]
push ecx
call eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1194], eax
cmp eax, 0xffffffff
jne 0x450f9d
mov eax, 3
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455723
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 1
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [ebp - 0x1194]
lea eax, [ebp - 0x11c4]
push 0
push eax
push 0x64
lea eax, [ebp - 0x178]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebp - 0x178]
push dword [esi + 0x1c]
lea edx, [ebp - 0x1190]
mov ecx, edi
call fcn.0044fa70
add esp, 4
cmp eax, 5
jne 0x450ff2
cmp byte [edi], 0xb8
je 0x450ff6
add edi, eax
jmp 0x450fd5
cmp dword [esi + 0x24], 0
mov eax, dword [edi + 1]
mov dword [esi + 0x150], eax
je 0x451029
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x451029
lea ecx, [ebp - 0x117c]
push ecx
call eax
push 0x40
push 0x1000
push dword [esi + 0x28]
mov byte [ebp - 0x11c0], 0xb8
push 0
push 0xffffffffffffffff
mov dword [ebp - 0x11bb], 0x3e8
mov dword [ebp - 0x11b7], 0x14c200
mov dword [ebp - 0x11b3], 0x340fd48b
mov byte [ebp - 0x11af], 0xc3
mov byte [ebp - 0x1190], 0xb8
mov dword [ebp - 0x118b], 0xfd18b4c
mov byte [ebp - 0x1187], 5
mov byte [ebp - 0x1195], 0xc3
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x4510a7
mov eax, 5
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455723
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov eax, dword [esi + 0x2c]
xor edi, edi
add esp, 4
mov dword [ebp - 0x1194], eax
mov eax, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cmp dword [esi + 0x28], edi
jbe 0x4510e6
nop dword [eax]
call eax
mov ecx, dword [ebp - 0x1194]
mov byte [edi + ecx], al
inc edi
mov eax, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cmp edi, dword [esi + 0x28]
jb 0x4510d0
call eax
mov ecx, dword [esi + 0x28]
xor edx, edx
sub ecx, 0x1d
div ecx
mov eax, dword [esi + 0x150]
mov ecx, dword [esi + 0x2c]
add ecx, edx
mov dword [ebp - 0x11bf], eax
movups xmm0, xmmword [ebp - 0x11c0]
mov dword [esi + 0x154], ecx
xor edx, edx
mov dword [ebp - 0x118f], eax
movzx eax, word [ebp - 0x11b0]
movups xmmword [ecx], xmm0
mov word [ecx + 0x10], ax
add ecx, 0x12
movq xmm0, qword [ebp - 0x1190]
movzx eax, word [ebp - 0x1188]
mov dword [esi + 0x158], ecx
movq qword [ecx], xmm0
mov word [ecx + 8], ax
mov al, byte [ebp - 0x1195]
mov byte [ecx + 0xa], al
or ecx, 0xffffffff
cmp dword [esi + 0x28], edx
jbe 0x451179
mov edi, dword [esi + 0x2c]
nop word [eax + eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45da30]
cmp edx, dword [esi + 0x28]
jb 0x451160
not ecx
mov dword [esi + 0x30], ecx
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455723
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 4]
mov eax, 6
pop edi
xor ecx, ebp
pop esi
call fcn.00455723
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret