Function at 0x44ea1d
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Enumerate pe sections
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x44cc
call fcn.004535d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4370], eax
mov byte [ebp - 0x4368], 4
mov byte [ebp - 0x4367], 8
mov byte [ebp - 0x4366], 0
mov byte [ebp - 0x4365], 0
mov byte [ebp - 0x4364], 0xc8
mov byte [ebp - 0x4363], 0
mov byte [ebp - 0x4362], 0
mov byte [ebp - 0x4361], 0
mov byte [ebp - 0x4360], 0x18
mov byte [ebp - 0x435f], 0x61
mov byte [ebp - 0x435e], 0xe
mov byte [ebp - 0x435d], 0
mov byte [ebp - 0x435c], 0x22
mov byte [ebp - 0x435b], 0
mov byte [ebp - 0x435a], 0
mov byte [ebp - 0x4359], 0
mov byte [ebp - 0x4358], 0x90
mov byte [ebp - 0x4357], 0x66
mov byte [ebp - 0x4356], 0xe
mov byte [ebp - 0x4355], 0
mov byte [ebp - 0x4354], 0xe8
mov byte [ebp - 0x4353], 2
mov byte [ebp - 0x4352], 0
mov byte [ebp - 0x4351], 0
mov byte [ebp - 0x4350], 0
mov byte [ebp - 0x434f], 0
mov byte [ebp - 0x434e], 0
mov byte [ebp - 0x434d], 0
mov byte [ebp - 0x434c], 0
mov byte [ebp - 0x434b], 0
mov byte [ebp - 0x434a], 0
mov byte [ebp - 0x4349], 0
push 0x4338
push 0x45e930
lea ecx, [ebp - 0x4344]
push ecx
call fcn.00453180
add esp, 0xc
push 0x4338
lea edx, [ebp - 0x4368]
push edx
push 0x64
lea eax, [ebp - 0x4344]
push eax
call fcn.00450a30
add esp, 0x10
mov byte [ebp - 0x43f4], 0x14
mov byte [ebp - 0x43f3], 0x28
mov byte [ebp - 0x43f2], 0x30
mov byte [ebp - 0x43f1], 0x60
mov byte [ebp - 0x43f0], 0xc8
mov byte [ebp - 0x43ef], 0x30
mov byte [ebp - 0x43ee], 0
mov byte [ebp - 0x43ed], 0
mov byte [ebp - 0x43ec], 0x18
mov byte [ebp - 0x43eb], 0x61
mov byte [ebp - 0x43ea], 0xe
mov byte [ebp - 0x43e9], 0
mov byte [ebp - 0x43e8], 0x22
mov byte [ebp - 0x43e7], 0
mov byte [ebp - 0x43e6], 0
mov byte [ebp - 0x43e5], 0
mov byte [ebp - 0x43e4], 0x90
mov byte [ebp - 0x43e3], 0x66
mov byte [ebp - 0x43e2], 0xe
mov byte [ebp - 0x43e1], 0
mov byte [ebp - 0x43e0], 0xe8
mov byte [ebp - 0x43df], 2
mov byte [ebp - 0x43de], 0
mov byte [ebp - 0x43dd], 0
mov byte [ebp - 0x43dc], 8
mov byte [ebp - 0x43db], 0
mov byte [ebp - 0x43da], 0
mov byte [ebp - 0x43d9], 0
mov byte [ebp - 0x43d8], 0x80
mov byte [ebp - 0x43d7], 0x60
mov byte [ebp - 0x43d6], 0x30
mov byte [ebp - 0x43d5], 0
mov byte [ebp - 0x4414], 0x14
mov byte [ebp - 0x4413], 0x28
mov byte [ebp - 0x4412], 0x30
mov byte [ebp - 0x4411], 0x60
mov byte [ebp - 0x4410], 0xc8
mov byte [ebp - 0x440f], 0x30
mov byte [ebp - 0x440e], 0
mov byte [ebp - 0x440d], 0
mov byte [ebp - 0x440c], 0x18
mov byte [ebp - 0x440b], 0x61
mov byte [ebp - 0x440a], 0xe
mov byte [ebp - 0x4409], 0
mov byte [ebp - 0x4408], 0x22
mov byte [ebp - 0x4407], 0
mov byte [ebp - 0x4406], 0
mov byte [ebp - 0x4405], 0
mov byte [ebp - 0x4404], 0x90
mov byte [ebp - 0x4403], 0x66
mov byte [ebp - 0x4402], 0xe
mov byte [ebp - 0x4401], 0
mov byte [ebp - 0x4400], 0xe8
mov byte [ebp - 0x43ff], 2
mov byte [ebp - 0x43fe], 0
mov byte [ebp - 0x43fd], 0
mov byte [ebp - 0x43fc], 0
mov byte [ebp - 0x43fb], 0
mov byte [ebp - 0x43fa], 0
mov byte [ebp - 0x43f9], 0
mov byte [ebp - 0x43f8], 0x80
mov byte [ebp - 0x43f7], 0x60
mov byte [ebp - 0x43f6], 0x30
mov byte [ebp - 0x43f5], 0
push 0x20
lea ecx, [ebp - 0x4326]
push ecx
lea edx, [ebp - 0x43f4]
push edx
call fcn.00453180
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4418], eax
cmp dword [ebp - 0x4418], 0xfa000
jle 0x44ed40
mov dword [ebp - 0x4418], 0xfa000
mov ecx, dword [ebp - 0x4418]
push ecx
lea edx, [ebp - 0x43f4]
push edx
push 0x64
mov eax, dword [ebp + 8]
push eax
call fcn.00450cfe
add esp, 0x10
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 0x4418]
mov dword [ebp - 0x43d4], ecx
cmp dword [ebp - 0x43d4], 0x9c4000
jbe 0x44ed81
mov dword [ebp - 0x43d4], 0x9c4000
cmp dword [ebp - 0x43d4], 0
jbe 0x44edb5
mov edx, dword [ebp - 0x43d4]
push edx
lea eax, [ebp - 0x4414]
push eax
mov cx, word [ebp - 0x4328]
push ecx
mov edx, dword [ebp - 0x4370]
add edx, dword [ebp - 0x4418]
push edx
call fcn.00450a30
add esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x43c4], eax
mov ecx, dword [ebp - 0x43c4]
mov edx, dword [ebp - 0x43c4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x43c0], edx
push 0xf8
mov eax, dword [ebp - 0x43c0]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x44edf8
mov ecx, dword [ebp - 0x43c0]
cmp dword [ecx], 0x4550
je 0x44edff
xor eax, eax
jmp 0x44f607
mov edx, dword [ebp - 0x43c0]
xor eax, eax
mov ax, word [edx + 0x14]
mov ecx, dword [ebp - 0x43c0]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x436c], edx
mov dword [ebp - 0xc], 0x28
mov eax, dword [ebp - 0x436c]
sub eax, dword [ebp - 0x43c4]
mov ecx, dword [ebp - 0x43c0]
xor edx, edx
mov dx, word [ecx + 6]
mov ecx, dword [ebp - 0xc]
imul ecx, edx
add eax, ecx
mov dword [ebp - 0x43c8], eax
mov edx, dword [ebp - 0x43c8]
mov dword [ebp - 0x43ac], edx
mov dword [ebp - 0x4348], 0
mov word [ebp - 0x43b4], 0
jmp 0x44ee7b
mov ax, word [ebp - 0x43b4]
add ax, 1
mov word [ebp - 0x43b4], ax
mov ecx, dword [ebp - 0x43b4]
and ecx, 0xffff
mov edx, dword [ebp - 0x43c0]
xor eax, eax
mov ax, word [edx + 6]
cmp ecx, eax
jae 0x44ef4a
mov ecx, dword [ebp - 0x43b4]
and ecx, 0xffff
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x43b4]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x436c]
mov ecx, dword [eax + ecx + 0xc]
mov eax, dword [ebp - 0x436c]
add ecx, dword [eax + edx + 0x10]
cmp dword [ebp - 0x43ac], ecx
jae 0x44ef0d
mov ecx, dword [ebp - 0x43b4]
and ecx, 0xffff
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x43b4]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x436c]
mov ecx, dword [eax + ecx + 0xc]
mov eax, dword [ebp - 0x436c]
add ecx, dword [eax + edx + 0x10]
mov dword [ebp - 0x43ac], ecx
mov ecx, dword [ebp - 0x43b4]
and ecx, 0xffff
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x43c0]
mov eax, dword [ebp - 0x436c]
mov edx, dword [edx + 0x88]
cmp edx, dword [eax + ecx + 0xc]
jne 0x44ef45
mov eax, dword [ebp - 0x43b4]
and eax, 0xffff
mov dword [ebp - 0x4348], eax
jmp 0x44ee69
lea ecx, [ebp - 0x43a8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x43ac]
xor edx, edx
div dword [ebp - 0x43a4]
mov dword [ebp - 0x43b0], eax
mov eax, dword [ebp - 0x43ac]
xor edx, edx
div dword [ebp - 0x43a4]
test edx, edx
je 0x44ef8c
mov edx, dword [ebp - 0x43b0]
add edx, 1
mov dword [ebp - 0x43b0], edx
mov eax, dword [ebp - 0x43b0]
imul eax, dword [ebp - 0x43a4]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x40
push 0x1000
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x44efd7
push 0x10
push 0x44760c
push 0x447614
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x44f607
mov ecx, dword [ebp - 0x43c8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00453690
add esp, 0xc
mov dword [ebp - 0x43bc], 0
mov dword [ebp - 0x4378], 0
mov dword [ebp - 4], 0
mov word [ebp - 0x43b4], 0
jmp 0x44f026
mov cx, word [ebp - 0x43b4]
add cx, 1
mov word [ebp - 0x43b4], cx
mov edx, dword [ebp - 0x43b4]
and edx, 0xffff
mov eax, dword [ebp - 0x43c0]
xor ecx, ecx
mov cx, word [eax + 6]
cmp edx, ecx
jge 0x44f118
mov edx, dword [ebp - 0x43b4]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x436c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + edx + 0xc]
mov dword [ebp - 0x43bc], ecx
mov edx, dword [ebp - 0x43b4]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x436c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx + 0x14]
mov dword [ebp - 0x4378], ecx
mov edx, dword [ebp - 0x43b4]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x436c]
mov ecx, dword [eax + edx + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x4378]
push eax
mov ecx, dword [ebp - 0x43bc]
push ecx
call fcn.00453690
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x4326]
push eax
mov cx, word [ebp - 0x4328]
push ecx
mov edx, dword [ebp - 0x43bc]
push edx
call fcn.00450a30
add esp, 0x10
mov eax, dword [ebp - 0x4341]
and eax, 0xff
test eax, eax
je 0x44f113
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x4326]
push edx
mov ax, word [ebp - 0x4328]
push eax
mov ecx, dword [ebp - 0x4378]
push ecx
call fcn.00450a30
add esp, 0x10
jmp 0x44f014
mov edx, dword [ebp - 0x4341]
and edx, 0xff
test edx, edx
je 0x44f17d
mov eax, dword [ebp - 0x433c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0044f635
add esp, 0xc
test eax, eax
jne 0x44f172
push 0x8000
push 0
mov eax, dword [ebp - 0x43c4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10
push 0x44762c
push 0x447634
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x44f607
push 0x45e930
call dword [0x462e9c]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x43c4], ecx
mov edx, dword [ebp - 0x43c4]
mov eax, dword [ebp - 0x43c4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x43c0], eax
mov ecx, dword [ebp - 0x43c0]
add ecx, 0xf8
mov dword [ebp - 0x436c], ecx
mov edx, dword [ebp - 0x43c4]
mov dword [0x462c80], edx
cmp dword [ebp - 0x4348], 0
je 0x44f21e
call fcn.0044f65d
cmp eax, 1
jne 0x44f21e
mov eax, dword [ebp - 0x4348]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x436c]
mov edx, dword [ecx + eax + 0xc]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0x4348]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x436c]
mov dword [ecx + eax + 0xc], edx
mov edx, dword [ebp - 0x4348]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x436c]
mov ecx, dword [eax + edx + 0x14]
add ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x4348]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x436c]
mov dword [eax + edx + 0x14], ecx
mov ecx, dword [ebp - 0x43c0]
mov edx, dword [ecx + 0x80]
mov dword [ebp - 0x43d0], edx
cmp dword [ebp - 0x43d0], 0
jne 0x44f268
push 0x8000
push 0
mov eax, dword [ebp - 0x43c4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10
push 0x447644
inc esp
add byte [eax + 0x4c], ch
jbe 0x44f29c
add byte [edx], ch
mov ecx, dword [ebp - 0x43c0]
mov edx, dword [ecx + 0x28]
mov eax, dword [ebp - 0x43c0]
add edx, dword [eax + 0x34]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov edx, dword [ebp - 0x43c0]
mov eax, dword [edx + 0x80]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44f2a2
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x43c4]
mov dword [ebp - 8], ecx
jmp 0x44f2d1
mov eax, 1
test eax, eax
je 0x44f556
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0
jne 0x44f2f5
mov edx, dword [ebp - 8]
cmp dword [edx + 0xc], 0
jne 0x44f2f5
jmp 0x44f556
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
add ecx, dword [0x462c80]
mov dword [ebp - 0x437c], ecx
mov edx, dword [ebp - 0x437c]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4380], eax
cmp dword [ebp - 0x4380], 0
jne 0x44f336
mov eax, dword [ebp - 0x437c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x4380], eax
cmp dword [ebp - 0x4380], 0
jne 0x44f344
jmp 0x44f602
mov ecx, dword [ebp - 0x4341]
and ecx, 0xff
test ecx, ecx
je 0x44f42b
push 0x447688
mov edx, dword [ebp - 0x437c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x44f42b
mov dword [ebp - 0x44b4], 0x94
lea eax, [ebp - 0x44b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x44a4], 1
jne 0x44f397
jmp 0x44f42b
push 0x447698
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x44b8], eax
cmp dword [ebp - 0x44b8], 0
je 0x44f41e
push 0x4476a4
mov ecx, dword [ebp - 0x44b8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x462eac], eax
push 0xc
lea edx, [ebp - 0x44c8]
push edx
mov eax, dword [ebp - 0x4380]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x462eac]
test eax, eax
je 0x44f41e
lea ecx, [ebp - 0x44bc]
push ecx
push 0x40
mov edx, dword [ebp - 0x44c4]
push edx
mov eax, dword [ebp - 0x44c8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x44f41e
mov cl, byte [ebp - 0x4340]
push ecx
mov edx, dword [ebp - 0x4380]
push edx
call dword [0x462e84]
mov eax, dword [ebp - 0x44b8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x44f446
mov edx, dword [ebp - 8]
mov eax, dword [edx]
add eax, dword [ebp - 0x43c4]
mov dword [ebp - 0x4420], eax
jmp 0x44f458
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
add edx, dword [ebp - 0x43c4]
mov dword [ebp - 0x4420], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
add ecx, dword [ebp - 0x43c4]
mov dword [ebp - 0x441c], ecx
mov edx, dword [ebp - 0x4420]
cmp dword [edx], 0
je 0x44f548
mov dword [ebp - 0x44cc], 0x80000000
mov eax, dword [ebp - 0x4420]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x44cc]
test ecx, ecx
je 0x44f4ba
mov edx, dword [ebp - 0x4420]
mov eax, dword [edx]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x4380]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x441c]
mov dword [edx], eax
jmp 0x44f4ed
mov eax, dword [ebp - 0x4420]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x43c4]
mov dword [ebp - 0x43b8], ecx
mov edx, dword [ebp - 0x43b8]
add edx, 2
push edx
mov eax, dword [ebp - 0x4380]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x441c]
mov dword [ecx], eax
cmp dword [ebp - 0x441c], 0
jne 0x44f525
push 0x8000
push 0
mov edx, dword [ebp - 0x43c4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10
push 0x4476bc
push 0x4476c4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x44f607
mov eax, dword [ebp - 0x441c]
add eax, 4
mov dword [ebp - 0x441c], eax
mov ecx, dword [ebp - 0x4420]
add ecx, 4
mov dword [ebp - 0x4420], ecx
jmp 0x44f46a
mov edx, dword [ebp - 8]
add edx, 0x14
mov dword [ebp - 8], edx
jmp 0x44f2d1
mov eax, dword [ebp - 0x43c4]
push eax
mov ecx, dword [ebp - 0x43c0]
push ecx
call fcn.0044d370
add esp, 8
mov edx, dword [ebp - 0x4330]
and edx, 0xff
test edx, edx
je 0x44f5ac
mov eax, dword [ebp - 0x43c0]
mov ecx, dword [eax + 0x80]
add ecx, dword [ebp - 0x43c4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x43c0]
mov eax, dword [edx + 0x84]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00453110
add esp, 0xc
mov edx, dword [ebp - 0x43c0]
mov eax, dword [edx + 0xa0]
add eax, dword [ebp - 0x43c4]
mov dword [ebp - 0x4384], eax
mov ecx, dword [ebp - 0x432f]
and ecx, 0xff
test ecx, ecx
je 0x44f5f2
mov edx, dword [ebp - 0x43c0]
mov eax, dword [edx + 0xa4]
push eax
push 0
mov ecx, dword [ebp - 0x4384]
push ecx
call fcn.00453110
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [0x462c78], edx
mov eax, 1
jmp 0x44f607
jmp 0x44f548