Function at 0x474bfe
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Enumerate pe sections
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x241c
call fcn.004afd90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2364], eax
mov byte [ebp - 0x235c], 4
mov byte [ebp - 0x235b], 8
mov byte [ebp - 0x235a], 0
mov byte [ebp - 0x2359], 0
mov byte [ebp - 0x2358], 0xc8
mov byte [ebp - 0x2357], 0
mov byte [ebp - 0x2356], 0
mov byte [ebp - 0x2355], 0
mov byte [ebp - 0x2354], 0x18
mov byte [ebp - 0x2353], 0x61
mov byte [ebp - 0x2352], 0xe
mov byte [ebp - 0x2351], 0
mov byte [ebp - 0x2350], 0x22
mov byte [ebp - 0x234f], 0
mov byte [ebp - 0x234e], 0
mov byte [ebp - 0x234d], 0
mov byte [ebp - 0x234c], 0x90
mov byte [ebp - 0x234b], 0x66
mov byte [ebp - 0x234a], 0xe
mov byte [ebp - 0x2349], 0
mov byte [ebp - 0x2348], 0xe8
mov byte [ebp - 0x2347], 2
mov byte [ebp - 0x2346], 0
mov byte [ebp - 0x2345], 0
mov byte [ebp - 0x2344], 0
mov byte [ebp - 0x2343], 0
mov byte [ebp - 0x2342], 0
mov byte [ebp - 0x2341], 0
mov byte [ebp - 0x2340], 0
mov byte [ebp - 0x233f], 0
mov byte [ebp - 0x233e], 0
mov byte [ebp - 0x233d], 0
push 0x232c
push 0x4b0268
lea ecx, [ebp - 0x2338]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0x232c
lea edx, [ebp - 0x235c]
push edx
push 0x64
lea eax, [ebp - 0x2338]
push eax
call fcn.0047737e
add esp, 0x10
mov byte [ebp - 0x23e8], 0x14
mov byte [ebp - 0x23e7], 0x28
mov byte [ebp - 0x23e6], 0x30
mov byte [ebp - 0x23e5], 0x60
mov byte [ebp - 0x23e4], 0xc8
mov byte [ebp - 0x23e3], 0x30
mov byte [ebp - 0x23e2], 0
mov byte [ebp - 0x23e1], 0
mov byte [ebp - 0x23e0], 0x18
mov byte [ebp - 0x23df], 0x61
mov byte [ebp - 0x23de], 0xe
mov byte [ebp - 0x23dd], 0
mov byte [ebp - 0x23dc], 0x22
mov byte [ebp - 0x23db], 0
mov byte [ebp - 0x23da], 0
mov byte [ebp - 0x23d9], 0
mov byte [ebp - 0x23d8], 0x90
mov byte [ebp - 0x23d7], 0x66
mov byte [ebp - 0x23d6], 0xe
mov byte [ebp - 0x23d5], 0
mov byte [ebp - 0x23d4], 0xe8
mov byte [ebp - 0x23d3], 2
mov byte [ebp - 0x23d2], 0
mov byte [ebp - 0x23d1], 0
mov byte [ebp - 0x23d0], 8
mov byte [ebp - 0x23cf], 0
mov byte [ebp - 0x23ce], 0
mov byte [ebp - 0x23cd], 0
mov byte [ebp - 0x23cc], 0x80
mov byte [ebp - 0x23cb], 0x60
mov byte [ebp - 0x23ca], 0x30
mov byte [ebp - 0x23c9], 0
mov byte [ebp - 0x2408], 0x14
mov byte [ebp - 0x2407], 0x28
mov byte [ebp - 0x2406], 0x30
mov byte [ebp - 0x2405], 0x60
mov byte [ebp - 0x2404], 0xc8
mov byte [ebp - 0x2403], 0x30
mov byte [ebp - 0x2402], 0
mov byte [ebp - 0x2401], 0
mov byte [ebp - 0x2400], 0x18
mov byte [ebp - 0x23ff], 0x61
mov byte [ebp - 0x23fe], 0xe
mov byte [ebp - 0x23fd], 0
mov byte [ebp - 0x23fc], 0x22
mov byte [ebp - 0x23fb], 0
mov byte [ebp - 0x23fa], 0
mov byte [ebp - 0x23f9], 0
mov byte [ebp - 0x23f8], 0x90
mov byte [ebp - 0x23f7], 0x66
mov byte [ebp - 0x23f6], 0xe
mov byte [ebp - 0x23f5], 0
mov byte [ebp - 0x23f4], 0xe8
mov byte [ebp - 0x23f3], 2
mov byte [ebp - 0x23f2], 0
mov byte [ebp - 0x23f1], 0
mov byte [ebp - 0x23f0], 0
mov byte [ebp - 0x23ef], 0
mov byte [ebp - 0x23ee], 0
mov byte [ebp - 0x23ed], 0
mov byte [ebp - 0x23ec], 0x80
mov byte [ebp - 0x23eb], 0x60
mov byte [ebp - 0x23ea], 0x30
mov byte [ebp - 0x23e9], 0
push 0x20
lea ecx, [ebp - 0x231a]
push ecx
lea edx, [ebp - 0x23e8]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x2327]
and eax, 0xff
test eax, eax
je 0x474f2f
mov ecx, dword [ebp + 0x1c]
push ecx
push 8
push 0x64
lea edx, [ebp - 0x2408]
push edx
lea eax, [ebp - 0x23e8]
push eax
call fcn.00477230
add esp, 0x14
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x240c], ecx
cmp dword [ebp - 0x240c], 0xfa000
jle 0x474f4e
mov dword [ebp - 0x240c], 0xfa000
mov edx, dword [ebp - 0x240c]
push edx
lea eax, [ebp - 0x23e8]
push eax
push 0x64
mov ecx, dword [ebp + 8]
push ecx
call fcn.004776f1
add esp, 0x10
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 0x240c]
mov dword [ebp - 0x23c8], edx
cmp dword [ebp - 0x23c8], 0x9c4000
jbe 0x474f8f
mov dword [ebp - 0x23c8], 0x9c4000
cmp dword [ebp - 0x23c8], 0
jbe 0x474fc3
mov eax, dword [ebp - 0x23c8]
push eax
lea ecx, [ebp - 0x2408]
push ecx
mov dx, word [ebp - 0x231c]
push edx
mov eax, dword [ebp - 0x2364]
add eax, dword [ebp - 0x240c]
push eax
call fcn.0047737e
add esp, 0x10
mov edx, dword [ebp - 0x2326]
and edx, 0xff
test edx, edx
je 0x475071
mov eax, dword [ebp - 0x232c]
mov dword [ebp - 0x2410], eax
mov ecx, dword [ebp + 0x1c]
push ecx
push 0x80
push 0x64
mov edx, dword [ebp - 0x2364]
add edx, dword [ebp - 0x2410]
push edx
mov eax, dword [ebp - 0x2364]
add eax, dword [ebp - 0x2410]
push eax
call fcn.00477291
add esp, 0x14
mov ecx, dword [ebp - 0x20f4]
and ecx, 0xff
cmp ecx, 0xa
jl 0x475032
mov edx, dword [ebp - 0x20f4]
and edx, 0xff
cmp edx, 0x20
jl 0x475056
mov eax, dword [ebp - 0x20f4]
and eax, 0xff
cmp eax, 0x28
je 0x475056
mov ecx, dword [ebp - 0x20f4]
and ecx, 0xff
cmp ecx, 0x8c
jne 0x475071
mov edx, dword [ebp + 0x1c]
push edx
push 0x20
mov eax, dword [ebp - 0x2364]
add eax, dword [ebp - 0x2410]
push eax
call fcn.004772f2
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x23b8], ecx
mov edx, dword [ebp - 0x23b8]
mov eax, dword [ebp - 0x23b8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x23b4], eax
push 0xf8
mov ecx, dword [ebp - 0x23b4]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x4750b4
mov edx, dword [ebp - 0x23b4]
cmp dword [edx], 0x4550
je 0x4750bb
xor eax, eax
jmp 0x475741
mov eax, dword [ebp - 0x23b4]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp - 0x23b4]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x2360], eax
mov dword [ebp - 0xc], 0x28
mov ecx, dword [ebp - 0x2360]
sub ecx, dword [ebp - 0x23b8]
mov edx, dword [ebp - 0x23b4]
xor eax, eax
mov ax, word [edx + 6]
mov edx, dword [ebp - 0xc]
imul edx, eax
add ecx, edx
mov dword [ebp - 0x23bc], ecx
mov eax, dword [ebp - 0x23bc]
mov dword [ebp - 0x23a0], eax
mov dword [ebp - 0x233c], 0
mov word [ebp - 0x23a8], 0
jmp 0x475137
mov cx, word [ebp - 0x23a8]
add cx, 1
mov word [ebp - 0x23a8], cx
mov edx, dword [ebp - 0x23a8]
and edx, 0xffff
mov eax, dword [ebp - 0x23b4]
xor ecx, ecx
mov cx, word [eax + 6]
cmp edx, ecx
jae 0x475205
mov edx, dword [ebp - 0x23a8]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x23a8]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2360]
mov edx, dword [ecx + edx + 0xc]
mov ecx, dword [ebp - 0x2360]
add edx, dword [ecx + eax + 0x10]
cmp dword [ebp - 0x23a0], edx
jae 0x4751c7
mov edx, dword [ebp - 0x23a8]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x23a8]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2360]
mov edx, dword [ecx + edx + 0xc]
mov ecx, dword [ebp - 0x2360]
add edx, dword [ecx + eax + 0x10]
mov dword [ebp - 0x23a0], edx
mov edx, dword [ebp - 0x23a8]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x23b4]
mov ecx, dword [ebp - 0x2360]
mov eax, dword [eax + 0x88]
cmp eax, dword [ecx + edx + 0xc]
jne 0x475200
mov ecx, dword [ebp - 0x23a8]
and ecx, 0xffff
mov dword [ebp - 0x233c], ecx
jmp 0x475125
lea edx, [ebp - 0x239c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x23a0]
xor edx, edx
div dword [ebp - 0x2398]
mov dword [ebp - 0x23a4], eax
mov eax, dword [ebp - 0x23a0]
xor edx, edx
div dword [ebp - 0x2398]
test edx, edx
je 0x475247
mov eax, dword [ebp - 0x23a4]
add eax, 1
mov dword [ebp - 0x23a4], eax
mov ecx, dword [ebp - 0x23a4]
imul ecx, dword [ebp - 0x2398]
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
push 0x40
push 0x1000
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x475292
push 0x10
push 0x4507c0
push 0x4507c8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x475741
mov edx, dword [ebp - 0x23bc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_memmove
add esp, 0xc
mov dword [ebp - 0x23b0], 0
mov dword [ebp - 0x236c], 0
mov dword [ebp - 4], 0
mov word [ebp - 0x23a8], 0
jmp 0x4752e1
mov dx, word [ebp - 0x23a8]
add dx, 1
mov word [ebp - 0x23a8], dx
mov eax, dword [ebp - 0x23a8]
and eax, 0xffff
mov ecx, dword [ebp - 0x23b4]
xor edx, edx
mov dx, word [ecx + 6]
cmp eax, edx
jge 0x47539e
mov eax, dword [ebp - 0x23a8]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2360]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x23b0], edx
mov eax, dword [ebp - 0x23a8]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2360]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x14]
mov dword [ebp - 0x236c], edx
mov eax, dword [ebp - 0x23a8]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2360]
mov edx, dword [ecx + eax + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x236c]
push ecx
mov edx, dword [ebp - 0x23b0]
push edx
call sub.MSVCRT.dll_memmove
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x231a]
push ecx
mov dx, word [ebp - 0x231c]
push edx
mov eax, dword [ebp - 0x23b0]
push eax
call fcn.0047737e
add esp, 0x10
jmp 0x4752cf
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x23b8], ecx
mov edx, dword [ebp - 0x23b8]
mov eax, dword [ebp - 0x23b8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x23b4], eax
mov ecx, dword [ebp - 0x23b4]
add ecx, 0xf8
mov dword [ebp - 0x2360], ecx
mov edx, dword [ebp - 0x23b8]
mov dword [0x4b25ac], edx
cmp dword [ebp - 0x233c], 0
je 0x47543f
call fcn.00475797
cmp eax, 1
jne 0x47543f
mov eax, dword [ebp - 0x233c]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2360]
mov edx, dword [ecx + eax + 0xc]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0x233c]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2360]
mov dword [ecx + eax + 0xc], edx
mov edx, dword [ebp - 0x233c]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x2360]
mov ecx, dword [eax + edx + 0x14]
add ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x233c]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x2360]
mov dword [eax + edx + 0x14], ecx
mov ecx, dword [ebp - 0x23b4]
mov edx, dword [ecx + 0x80]
mov dword [ebp - 0x23c4], edx
cmp dword [ebp - 0x23c4], 0
jne 0x475489
push 0x8000
push 0
mov eax, dword [ebp - 0x23b8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10
push 0x4507e0
push 0x4507e8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x475741
mov ecx, dword [ebp - 0x23b4]
mov edx, dword [ecx + 0x28]
mov eax, dword [ebp - 0x23b4]
add edx, dword [eax + 0x34]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov edx, dword [ebp - 0x23b4]
mov eax, dword [edx + 0x80]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4754c3
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x23b8]
mov dword [ebp - 8], ecx
jmp 0x4754f2
push 0x8000
push 0
mov edx, dword [ebp - 0x23b8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10
push 0x450804
push 0x45080c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x475741
mov eax, 1
test eax, eax
je 0x475690
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0
jne 0x475516
mov edx, dword [ebp - 8]
cmp dword [edx + 0xc], 0
jne 0x475516
jmp 0x475690
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
add ecx, dword [0x4b25ac]
mov dword [ebp - 0x2370], ecx
mov edx, dword [ebp - 0x2370]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x2374], eax
cmp dword [ebp - 0x2374], 0
jne 0x475557
mov eax, dword [ebp - 0x2370]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x2374], eax
cmp dword [ebp - 0x2374], 0
jne 0x475565
jmp 0x47573c
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x475580
mov edx, dword [ebp - 8]
mov eax, dword [edx]
add eax, dword [ebp - 0x23b8]
mov dword [ebp - 0x2418], eax
jmp 0x475592
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
add edx, dword [ebp - 0x23b8]
mov dword [ebp - 0x2418], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
add ecx, dword [ebp - 0x23b8]
mov dword [ebp - 0x2414], ecx
mov edx, dword [ebp - 0x2418]
cmp dword [edx], 0
je 0x475682
mov dword [ebp - 0x241c], 0x80000000
mov eax, dword [ebp - 0x2418]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x241c]
test ecx, ecx
je 0x4755f4
mov edx, dword [ebp - 0x2418]
mov eax, dword [edx]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x2374]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x2414]
mov dword [edx], eax
jmp 0x475627
mov eax, dword [ebp - 0x2418]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x23b8]
mov dword [ebp - 0x23ac], ecx
mov edx, dword [ebp - 0x23ac]
add edx, 2
push edx
mov eax, dword [ebp - 0x2374]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x2414]
mov dword [ecx], eax
cmp dword [ebp - 0x2414], 0
jne 0x47565f
push 0x8000
push 0
mov edx, dword [ebp - 0x23b8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10
push 0x450824
push 0x45082c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x475741
mov eax, dword [ebp - 0x2414]
add eax, 4
mov dword [ebp - 0x2414], eax
mov ecx, dword [ebp - 0x2418]
add ecx, 4
mov dword [ebp - 0x2418], ecx
jmp 0x4755a4
mov edx, dword [ebp - 8]
add edx, 0x14
mov dword [ebp - 8], edx
jmp 0x4754f2
mov eax, dword [ebp - 0x23b8]
push eax
mov ecx, dword [ebp - 0x23b4]
push ecx
call fcn.004730a0
add esp, 8
mov edx, dword [ebp - 0x2324]
and edx, 0xff
test edx, edx
je 0x4756e6
mov eax, dword [ebp - 0x23b4]
mov ecx, dword [eax + 0x80]
add ecx, dword [ebp - 0x23b8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x23b4]
mov eax, dword [edx + 0x84]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x23b4]
mov eax, dword [edx + 0xa0]
add eax, dword [ebp - 0x23b8]
mov dword [ebp - 0x2378], eax
mov ecx, dword [ebp - 0x2323]
and ecx, 0xff
test ecx, ecx
je 0x47572c
mov edx, dword [ebp - 0x23b4]
mov eax, dword [edx + 0xa4]
push eax
push 0
mov ecx, dword [ebp - 0x2378]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [0x4b25a4], edx
mov eax, 1
jmp 0x475741
jmp 0x475682
mov esp, ebp
pop ebp
ret