Function at 0x469327
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Enumerate pe sections
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4420
call fcn.0049e690
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4368], eax
mov byte [ebp - 0x4360], 4
mov byte [ebp - 0x435f], 8
mov byte [ebp - 0x435e], 0
mov byte [ebp - 0x435d], 0
mov byte [ebp - 0x435c], 0xc8
mov byte [ebp - 0x435b], 0
mov byte [ebp - 0x435a], 0
mov byte [ebp - 0x4359], 0
mov byte [ebp - 0x4358], 0x18
mov byte [ebp - 0x4357], 0x61
mov byte [ebp - 0x4356], 0xe
mov byte [ebp - 0x4355], 0
mov byte [ebp - 0x4354], 0x22
mov byte [ebp - 0x4353], 0
mov byte [ebp - 0x4352], 0
mov byte [ebp - 0x4351], 0
mov byte [ebp - 0x4350], 0x90
mov byte [ebp - 0x434f], 0x66
mov byte [ebp - 0x434e], 0xe
mov byte [ebp - 0x434d], 0
mov byte [ebp - 0x434c], 0xe8
mov byte [ebp - 0x434b], 2
mov byte [ebp - 0x434a], 0
mov byte [ebp - 0x4349], 0
mov byte [ebp - 0x4348], 0
mov byte [ebp - 0x4347], 0
mov byte [ebp - 0x4346], 0
mov byte [ebp - 0x4345], 0
mov byte [ebp - 0x4344], 0
mov byte [ebp - 0x4343], 0
mov byte [ebp - 0x4342], 0
mov byte [ebp - 0x4341], 0
push 0x4330
push 0x49eb60
lea ecx, [ebp - 0x433c]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0x4330
lea edx, [ebp - 0x4360]
push edx
push 0x64
lea eax, [ebp - 0x433c]
push eax
call fcn.0046b3de
add esp, 0x10
mov byte [ebp - 0x43ec], 0x14
mov byte [ebp - 0x43eb], 0x28
mov byte [ebp - 0x43ea], 0x30
mov byte [ebp - 0x43e9], 0x60
mov byte [ebp - 0x43e8], 0xc8
mov byte [ebp - 0x43e7], 0x30
mov byte [ebp - 0x43e6], 0
mov byte [ebp - 0x43e5], 0
mov byte [ebp - 0x43e4], 0x18
mov byte [ebp - 0x43e3], 0x61
mov byte [ebp - 0x43e2], 0xe
mov byte [ebp - 0x43e1], 0
mov byte [ebp - 0x43e0], 0x22
mov byte [ebp - 0x43df], 0
mov byte [ebp - 0x43de], 0
mov byte [ebp - 0x43dd], 0
mov byte [ebp - 0x43dc], 0x90
mov byte [ebp - 0x43db], 0x66
mov byte [ebp - 0x43da], 0xe
mov byte [ebp - 0x43d9], 0
mov byte [ebp - 0x43d8], 0xe8
mov byte [ebp - 0x43d7], 2
mov byte [ebp - 0x43d6], 0
mov byte [ebp - 0x43d5], 0
mov byte [ebp - 0x43d4], 8
mov byte [ebp - 0x43d3], 0
mov byte [ebp - 0x43d2], 0
mov byte [ebp - 0x43d1], 0
mov byte [ebp - 0x43d0], 0x80
mov byte [ebp - 0x43cf], 0x60
mov byte [ebp - 0x43ce], 0x30
mov byte [ebp - 0x43cd], 0
mov byte [ebp - 0x440c], 0x14
mov byte [ebp - 0x440b], 0x28
mov byte [ebp - 0x440a], 0x30
mov byte [ebp - 0x4409], 0x60
mov byte [ebp - 0x4408], 0xc8
mov byte [ebp - 0x4407], 0x30
mov byte [ebp - 0x4406], 0
mov byte [ebp - 0x4405], 0
mov byte [ebp - 0x4404], 0x18
mov byte [ebp - 0x4403], 0x61
mov byte [ebp - 0x4402], 0xe
mov byte [ebp - 0x4401], 0
mov byte [ebp - 0x4400], 0x22
mov byte [ebp - 0x43ff], 0
mov byte [ebp - 0x43fe], 0
mov byte [ebp - 0x43fd], 0
mov byte [ebp - 0x43fc], 0x90
mov byte [ebp - 0x43fb], 0x66
mov byte [ebp - 0x43fa], 0xe
mov byte [ebp - 0x43f9], 0
mov byte [ebp - 0x43f8], 0xe8
mov byte [ebp - 0x43f7], 2
mov byte [ebp - 0x43f6], 0
mov byte [ebp - 0x43f5], 0
mov byte [ebp - 0x43f4], 0
mov byte [ebp - 0x43f3], 0
mov byte [ebp - 0x43f2], 0
mov byte [ebp - 0x43f1], 0
mov byte [ebp - 0x43f0], 0x80
mov byte [ebp - 0x43ef], 0x60
mov byte [ebp - 0x43ee], 0x30
mov byte [ebp - 0x43ed], 0
push 0x20
lea ecx, [ebp - 0x431e]
push ecx
lea edx, [ebp - 0x43ec]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x432b]
and eax, 0xff
test eax, eax
je 0x469658
mov ecx, dword [ebp + 0x1c]
push ecx
push 8
push 0x64
lea edx, [ebp - 0x440c]
push edx
lea eax, [ebp - 0x43ec]
push eax
call fcn.0046b290
add esp, 0x14
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x4410], ecx
cmp dword [ebp - 0x4410], 0xfa000
jle 0x469677
mov dword [ebp - 0x4410], 0xfa000
mov edx, dword [ebp - 0x4410]
push edx
lea eax, [ebp - 0x43ec]
push eax
push 0x64
mov ecx, dword [ebp + 8]
push ecx
call fcn.0046b73b
add esp, 0x10
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 0x4410]
mov dword [ebp - 0x43cc], edx
cmp dword [ebp - 0x43cc], 0x9c4000
jbe 0x4696b8
mov dword [ebp - 0x43cc], 0x9c4000
cmp dword [ebp - 0x43cc], 0
jbe 0x4696ec
mov eax, dword [ebp - 0x43cc]
push eax
lea ecx, [ebp - 0x440c]
push ecx
mov dx, word [ebp - 0x4320]
push edx
mov eax, dword [ebp - 0x4368]
add eax, dword [ebp - 0x4410]
push eax
call fcn.0046b3de
add esp, 0x10
mov edx, dword [ebp - 0x432a]
and edx, 0xff
test edx, edx
je 0x46979a
mov eax, dword [ebp - 0x4330]
mov dword [ebp - 0x4414], eax
mov ecx, dword [ebp + 0x1c]
push ecx
push 0x80
push 0x64
mov edx, dword [ebp - 0x4368]
add edx, dword [ebp - 0x4414]
push edx
mov eax, dword [ebp - 0x4368]
add eax, dword [ebp - 0x4414]
push eax
call fcn.0046b2f1
add esp, 0x14
mov ecx, dword [ebp - 0x40f4]
and ecx, 0xff
cmp ecx, 0xa
jl 0x46975b
mov edx, dword [ebp - 0x40f4]
and edx, 0xff
cmp edx, 0x20
jl 0x46977f
mov eax, dword [ebp - 0x40f4]
and eax, 0xff
cmp eax, 0x28
je 0x46977f
mov ecx, dword [ebp - 0x40f4]
and ecx, 0xff
cmp ecx, 0x8c
jne 0x46979a
mov edx, dword [ebp + 0x1c]
push edx
push 0x20
mov eax, dword [ebp - 0x4368]
add eax, dword [ebp - 0x4414]
push eax
call fcn.0046b352
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x43bc], ecx
mov edx, dword [ebp - 0x43bc]
mov eax, dword [ebp - 0x43bc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x43b8], eax
push 0xf8
mov ecx, dword [ebp - 0x43b8]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x4697dd
mov edx, dword [ebp - 0x43b8]
cmp dword [edx], 0x4550
je 0x4697e4
xor eax, eax
jmp 0x469e6a
mov eax, dword [ebp - 0x43b8]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp - 0x43b8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x4364], eax
mov dword [ebp - 0xc], 0x28
mov ecx, dword [ebp - 0x4364]
sub ecx, dword [ebp - 0x43bc]
mov edx, dword [ebp - 0x43b8]
xor eax, eax
mov ax, word [edx + 6]
mov edx, dword [ebp - 0xc]
imul edx, eax
add ecx, edx
mov dword [ebp - 0x43c0], ecx
mov eax, dword [ebp - 0x43c0]
mov dword [ebp - 0x43a4], eax
mov dword [ebp - 0x4340], 0
mov word [ebp - 0x43ac], 0
jmp 0x469860
mov cx, word [ebp - 0x43ac]
add cx, 1
mov word [ebp - 0x43ac], cx
mov edx, dword [ebp - 0x43ac]
and edx, 0xffff
mov eax, dword [ebp - 0x43b8]
xor ecx, ecx
mov cx, word [eax + 6]
cmp edx, ecx
jae 0x46992e
mov edx, dword [ebp - 0x43ac]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x43ac]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x4364]
mov edx, dword [ecx + edx + 0xc]
mov ecx, dword [ebp - 0x4364]
add edx, dword [ecx + eax + 0x10]
cmp dword [ebp - 0x43a4], edx
jae 0x4698f0
mov edx, dword [ebp - 0x43ac]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x43ac]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x4364]
mov edx, dword [ecx + edx + 0xc]
mov ecx, dword [ebp - 0x4364]
add edx, dword [ecx + eax + 0x10]
mov dword [ebp - 0x43a4], edx
mov edx, dword [ebp - 0x43ac]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x43b8]
mov ecx, dword [ebp - 0x4364]
mov eax, dword [eax + 0x88]
cmp eax, dword [ecx + edx + 0xc]
jne 0x469929
mov ecx, dword [ebp - 0x43ac]
and ecx, 0xffff
mov dword [ebp - 0x4340], ecx
jmp 0x46984e
lea edx, [ebp - 0x43a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x43a4]
xor edx, edx
div dword [ebp - 0x439c]
mov dword [ebp - 0x43a8], eax
mov eax, dword [ebp - 0x43a4]
xor edx, edx
div dword [ebp - 0x439c]
test edx, edx
je 0x469970
mov eax, dword [ebp - 0x43a8]
add eax, 1
mov dword [ebp - 0x43a8], eax
mov ecx, dword [ebp - 0x43a8]
imul ecx, dword [ebp - 0x439c]
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
push 0x40
push 0x1000
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x4699bb
push 0x10
push 0x45084c
push 0x450854
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x469e6a
mov edx, dword [ebp - 0x43c0]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_memmove
add esp, 0xc
mov dword [ebp - 0x43b4], 0
mov dword [ebp - 0x4370], 0
mov dword [ebp - 4], 0
mov word [ebp - 0x43ac], 0
jmp 0x469a0a
mov dx, word [ebp - 0x43ac]
add dx, 1
mov word [ebp - 0x43ac], dx
mov eax, dword [ebp - 0x43ac]
and eax, 0xffff
mov ecx, dword [ebp - 0x43b8]
xor edx, edx
mov dx, word [ecx + 6]
cmp eax, edx
jge 0x469ac7
mov eax, dword [ebp - 0x43ac]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x4364]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x43b4], edx
mov eax, dword [ebp - 0x43ac]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x4364]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x14]
mov dword [ebp - 0x4370], edx
mov eax, dword [ebp - 0x43ac]
and eax, 0xffff
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x4364]
mov edx, dword [ecx + eax + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x4370]
push ecx
mov edx, dword [ebp - 0x43b4]
push edx
call sub.MSVCRT.dll_memmove
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x431e]
push ecx
mov dx, word [ebp - 0x4320]
push edx
mov eax, dword [ebp - 0x43b4]
push eax
call fcn.0046b3de
add esp, 0x10
jmp 0x4699f8
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x43bc], ecx
mov edx, dword [ebp - 0x43bc]
mov eax, dword [ebp - 0x43bc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x43b8], eax
mov ecx, dword [ebp - 0x43b8]
add ecx, 0xf8
mov dword [ebp - 0x4364], ecx
mov edx, dword [ebp - 0x43bc]
mov dword [0x4a2ea8], edx
cmp dword [ebp - 0x4340], 0
je 0x469b68
call fcn.00469ec0
cmp eax, 1
jne 0x469b68
mov eax, dword [ebp - 0x4340]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x4364]
mov edx, dword [ecx + eax + 0xc]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0x4340]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x4364]
mov dword [ecx + eax + 0xc], edx
mov edx, dword [ebp - 0x4340]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x4364]
mov ecx, dword [eax + edx + 0x14]
add ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x4340]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x4364]
mov dword [eax + edx + 0x14], ecx
mov ecx, dword [ebp - 0x43b8]
mov edx, dword [ecx + 0x80]
mov dword [ebp - 0x43c8], edx
cmp dword [ebp - 0x43c8], 0
jne 0x469bb2
push 0x8000
push 0
mov eax, dword [ebp - 0x43bc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10
push 0x45086c
push 0x450874
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x469e6a
mov ecx, dword [ebp - 0x43b8]
mov edx, dword [ecx + 0x28]
mov eax, dword [ebp - 0x43b8]
add edx, dword [eax + 0x34]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov edx, dword [ebp - 0x43b8]
mov eax, dword [edx + 0x80]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x469bec
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x43bc]
mov dword [ebp - 8], ecx
jmp 0x469c1b
push 0x8000
push 0
mov edx, dword [ebp - 0x43bc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10
push 0x450890
push 0x450898
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x469e6a
mov eax, 1
test eax, eax
je 0x469db9
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0
jne 0x469c3f
mov edx, dword [ebp - 8]
cmp dword [edx + 0xc], 0
jne 0x469c3f
jmp 0x469db9
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
add ecx, dword [0x4a2ea8]
mov dword [ebp - 0x4374], ecx
mov edx, dword [ebp - 0x4374]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4378], eax
cmp dword [ebp - 0x4378], 0
jne 0x469c80
mov eax, dword [ebp - 0x4374]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x4378], eax
cmp dword [ebp - 0x4378], 0
jne 0x469c8e
jmp 0x469e65
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x469ca9
mov edx, dword [ebp - 8]
mov eax, dword [edx]
add eax, dword [ebp - 0x43bc]
mov dword [ebp - 0x441c], eax
jmp 0x469cbb
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
add edx, dword [ebp - 0x43bc]
mov dword [ebp - 0x441c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
add ecx, dword [ebp - 0x43bc]
mov dword [ebp - 0x4418], ecx
mov edx, dword [ebp - 0x441c]
cmp dword [edx], 0
je 0x469dab
mov dword [ebp - 0x4420], 0x80000000
mov eax, dword [ebp - 0x441c]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x4420]
test ecx, ecx
je 0x469d1d
mov edx, dword [ebp - 0x441c]
mov eax, dword [edx]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x4378]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x4418]
mov dword [edx], eax
jmp 0x469d50
mov eax, dword [ebp - 0x441c]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x43bc]
mov dword [ebp - 0x43b0], ecx
mov edx, dword [ebp - 0x43b0]
add edx, 2
push edx
mov eax, dword [ebp - 0x4378]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x4418]
mov dword [ecx], eax
cmp dword [ebp - 0x4418], 0
jne 0x469d88
push 0x8000
push 0
mov edx, dword [ebp - 0x43bc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10
push 0x4508b0
push 0x4508b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x469e6a
mov eax, dword [ebp - 0x4418]
add eax, 4
mov dword [ebp - 0x4418], eax
mov ecx, dword [ebp - 0x441c]
add ecx, 4
mov dword [ebp - 0x441c], ecx
jmp 0x469ccd
mov edx, dword [ebp - 8]
add edx, 0x14
mov dword [ebp - 8], edx
jmp 0x469c1b
mov eax, dword [ebp - 0x43bc]
push eax
mov ecx, dword [ebp - 0x43b8]
push ecx
call fcn.004679b0
add esp, 8
mov edx, dword [ebp - 0x4328]
and edx, 0xff
test edx, edx
je 0x469e0f
mov eax, dword [ebp - 0x43b8]
mov ecx, dword [eax + 0x80]
add ecx, dword [ebp - 0x43bc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x43b8]
mov eax, dword [edx + 0x84]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x43b8]
mov eax, dword [edx + 0xa0]
add eax, dword [ebp - 0x43bc]
mov dword [ebp - 0x437c], eax
mov ecx, dword [ebp - 0x4327]
and ecx, 0xff
test ecx, ecx
je 0x469e55
mov edx, dword [ebp - 0x43b8]
mov eax, dword [edx + 0xa4]
push eax
push 0
mov ecx, dword [ebp - 0x437c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [0x4a2ea0], edx
mov eax, 1
jmp 0x469e6a
jmp 0x469dab
mov esp, ebp
pop ebp
ret