Function at 0x464990
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for software breakpoints
Contain obfuscated stackstrings
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 5
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4649e2
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [esi], 0xcc
jne 0x464a60
lea eax, [ebp - 0x11c]
push eax
push 0x40
push 1
push esi
call edi
test eax, eax
je 0x464a60
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x464a4e
push 0
push 0
push 3
push 0
push 1
push closesocket
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x464a4e
push 0
lea ecx, [ebp - 0x128]
push ecx
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x11c]
push 1
push esi
call edi
mov eax, dword [ebx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov byte [ebp - 0x115], 0x90
mov dword [ebp - 0x11c], eax
cmp byte [eax], 0xcc
jne 0x464abe
lea ecx, [ebp - 0x114]
push ecx
push 0x40
push 1
push eax
call edi
test eax, eax
je 0x464abe
push 0
push 1
lea eax, [ebp - 0x115]
push eax
push dword [ebp - 0x11c]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x114]
push 1
push dword [ebp - 0x11c]
call edi
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], 0x6c64746e
push eax
mov dword [ebp - 0x134], 0x6c642e6c
mov word [ebp - 0x130], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x114], eax
xorps xmm0, xmm0
movq qword [ebp - 0x138], xmm0
mov word [ebp - 0x130], 0
test eax, eax
je 0x464b79
mov ecx, 0x3a
xor edx, edx
nop dword [eax]
mov al, byte [edx + str.yHNz_K]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x170], al
and ecx, 0x800000ff
jns 0x464b30
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x464b10
lea eax, [ebp - 0x170]
mov byte [ebp - 0x161], 0
push eax
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
movaps xmmword [ebp - 0x170], xmm0
test eax, eax
je 0x464b79
call eax
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x464b79
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x464b96
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x114], 0
xor eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 2]
and eax, 0xff
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x464bd2
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x114], 0
xor eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
and eax, 0x70
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x464c0c
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x114], 0
call esi
lea ecx, [ebp - 0x114]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 0x114], 0
je 0x464c42
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x144]
mov dword [ebp - 0x144], 0x6c64746e
push eax
mov dword [ebp - 0x140], 0x6c642e6c
mov word [ebp - 0x13c], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov word [ebp - 0x13c], 0
xorps xmm0, xmm0
movq qword [ebp - 0x144], xmm0
cmp esi, 0xffffffff
je 0x464d06
test esi, esi
je 0x464d06
mov ecx, 0x17
xor edx, edx
mov al, byte [edx + 0x6e63cc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x170], al
and ecx, 0x800000ff
jns 0x464cb2
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x16
jl 0x464c92
lea eax, [ebp - 0x170]
mov byte [ebp - 0x15a], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x160], 0
mov word [ebp - 0x15c], 0
xorps xmm0, xmm0
movaps xmmword [ebp - 0x170], xmm0
mov byte [ebp - 0x15a], 0
test esi, esi
je 0x464d06
push 0
push 0
push 0x11
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
call fcn.004647e0
call fcn.00464870
call fcn.00464900
call fcn.004643e0
call fcn.00464580
lea ecx, [ebp - 0x148]
call fcn.00461a90
test al, al
je 0x464d40
mov dword [0], 1
nop dword [eax + eax]
lea ecx, [ebp - 0x16c]
call fcn.00461a90
test al, al
je 0x464d60
mov dword [0], 1
nop dword [eax]
lea ecx, [ebp - 0x16c]
call fcn.00461a90
test al, al
je 0x464d79
mov dword [0], 1
lea ecx, [ebp - 0x16c]
call fcn.00461a90
test al, al
je 0x464d92
mov dword [0], 1
lea ecx, [ebp - 0x148]
call fcn.00461a90
test al, al
je 0x464dab
mov dword [0], 1
call fcn.004627b0
call fcn.00461e90
call fcn.00462190
call fcn.00462370
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x464e94
mov ecx, dword [eax + 0x3c]
add ecx, eax
push 4
mov dword [ebp - 0x12c], ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 0x12c]
add esp, 4
mov dword [ebp - 0x114], 0
movzx eax, word [ecx + 0x14]
lea esi, [ecx + 0x18]
add esi, eax
xor eax, eax
cmp ax, word [ecx + 6]
jae 0x464e5e
lea eax, [ebp - 0x120]
push eax
push 0x40
push 0x28
push esi
call edi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov byte [esi], al
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x120]
mov byte [esi + 1], 0
push 0x28
push esi
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
call edi
mov eax, dword [ebp - 0x12c]
add esi, 0x28
mov ecx, dword [ebp - 0x114]
inc ecx
mov dword [ebp - 0x114], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jb 0x464e06
lea eax, [ebp - 0x124]
push eax
push 0x40
push 4
lea eax, [ebp - 0x12c]
push eax
call edi
lea eax, [ebp - 0x124]
mov dword [ebp - 0x12c], 0
push eax
push dword [ebp - 0x124]
lea eax, [ebp - 0x12c]
push 4
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00622073
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret