Function at 0x7257f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Inspect section memory permissions
Parse pe header

Disassembly:
mov eax, 0x1040
call fcn.00727710
push ebx
mov ebx, dword [esp + 0x1048]
push ebp
push esi
test ebx, ebx
push edi
jne 0x725819
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1040
ret
mov esi, dword [sym.imp.kernel32.dll_IsBadReadPtr]
push 0x40
push ebx
call esi
cmp eax, 1
je 0x725d14
cmp word [ebx], 0x5a4d
jne 0x725d14
mov ebp, dword [ebx + 0x3c]
push 0xf8
add ebp, ebx
push ebp
call esi
cmp eax, 1
je 0x725d04
cmp dword [ebp], 0x4550
jne 0x725d04
cmp word [ebp + 0x14], 0xe0
jne 0x725cf4
cmp word [ebp + 0x18], 0x10b
jne 0x725cf4
mov cx, word [ebp + 6]
cmp cx, 1
jae 0x72588d
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0x1040
ret
mov eax, ecx
lea esi, [ebp + 0xf8]
and eax, 0xffff
mov dword [esp + 0x20], 0
lea edx, [eax + eax*4]
shl edx, 3
sub edx, ebx
add edx, esi
mov esi, edx
mov dword [esp + 0x28], edx
test cx, cx
mov dword [esp + 0x18], esi
jbe 0x725938
mov dword [esp + 0x1c], 0
lea edi, [ebp + 0x104]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 4]
mov ecx, dword [edi]
add ecx, eax
mov eax, dword [esp + 0x18]
cmp eax, ecx
jae 0x7258e0
mov dword [esp + 0x18], ecx
mov esi, 0x7c0624
lea ecx, [edi - 0xc]
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x72590c
test dl, dl
je 0x725908
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x72590c
add ecx, 2
add esi, 2
test dl, dl
jne 0x7258e8
xor ecx, ecx
jmp 0x725911
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x72591d
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
inc edx
add edi, 0x28
dec eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
jne 0x7258cd
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x30]
mov eax, esi
xor edx, edx
div ecx
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, esi
div ecx
test edx, edx
je 0x72595f
inc dword [esp + 0x18]
imul ecx, dword [esp + 0x18]
push 0x40
push 0x1000
push ecx
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov edi, dword [esp + 0x1058]
test eax, eax
mov dword [edi], eax
jne 0x725991
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x1040
ret
mov ecx, dword [esp + 0x28]
push ecx
push ebx
push eax
call fcn.00727000
xor esi, esi
add esp, 0xc
cmp word [ebp + 6], si
jbe 0x7259dd
mov eax, esi
and eax, 0xffff
lea edx, [eax + eax*4]
lea eax, [ebp + 0xf8]
mov ecx, dword [eax + edx*8 + 0x10]
lea eax, [eax + edx*8]
push ecx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, ebx
push edx
mov edx, dword [edi]
add eax, edx
push eax
call fcn.00727000
add esp, 0xc
inc esi
cmp si, word [ebp + 6]
jb 0x7259a8
mov edi, dword [edi]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x10], edi
mov esi, dword [edi + 0x3c]
add esi, edi
test ebp, ebp
mov dword [esp + 0x1c], esi
je 0x725a1d
call fcn.00726100
cmp eax, 1
jne 0x725a1d
lea ecx, [ebp + ebp*4]
mov edx, dword [esi + ecx*8 + 0x104]
lea eax, [esi + ecx*8 + 0xf8]
add edx, ebx
mov dword [eax + 0xc], edx
mov ecx, dword [eax + 0x14]
add ecx, ebx
mov dword [eax + 0x14], ecx
mov ebp, dword [esi + 0x80]
test ebp, ebp
jne 0x725a44
push 0x8000
push ebp
push edi
call dword [sym.imp.kernel32.dll_VirtualFree]
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
add esp, 0x1040
ret
add ebp, edi
mov dword [esp + 0x14], 0xd
mov eax, dword [ebp + 4]
test eax, eax
jne 0x725a60
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x725b20
mov esi, dword [ebp + 0xc]
mov edi, dword [esp + 0x10]
add esi, edi
push esi
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x725a7f
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, eax
mov ecx, dword [esp + 0x14]
inc ecx
test ebx, ebx
mov dword [esp + 0x14], ecx
je 0x725ae1
mov edi, dword [ebp]
mov eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
add edi, eax
add esi, eax
mov eax, dword [edi]
test eax, eax
je 0x725ad1
test eax, 0x80000000
je 0x725aae
and eax, 0xffff
jmp 0x725ab6
mov edx, dword [esp + 0x10]
lea eax, [eax + edx + 2]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetProcAddress]
test esi, esi
mov dword [esi], eax
je 0x725afe
mov eax, dword [edi + 4]
add edi, 4
add esi, 4
test eax, eax
jne 0x725aa0
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
add ebp, 0x14
jmp 0x725a4e
push 0x8000
push 0
push edi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1040
ret
mov ecx, dword [esp + 0x10]
push 0x8000
push 0
push ecx
call dword [sym.imp.kernel32.dll_VirtualFree]
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x1040
ret
mov edx, dword [esi + 0xa0]
test edx, edx
je 0x725b92
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x725b92
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ebp, dword [edx + 4]
mov eax, edx
lea esi, [edx + 8]
add eax, ebp
cmp esi, eax
jae 0x725b86
xor eax, eax
mov ax, word [esi]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x725b74
mov ebp, dword [edx]
and eax, 0xfff
add eax, ebp
mov ebp, dword [ebx + 0x34]
add eax, edi
mov ecx, edi
sub ecx, ebp
add dword [eax], ecx
jmp 0x725b78
test ecx, ecx
jne 0x725bc7
mov ebp, dword [edx + 4]
mov eax, edx
add esi, 2
add eax, ebp
cmp esi, eax
jb 0x725b49
add edx, dword [edx + 4]
cmp dword [edx], 0
jne 0x725b3b
mov esi, dword [esp + 0x1c]
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x50]
mov ebp, dword [esp + 0x30]
rep stosd dword es:[edi], eax
mov cx, word [esi + 6]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
lea ebx, [esi + 0x108]
cmp ax, cx
jne 0x725be5
mov eax, dword [esp + 0x28]
xor esi, esi
mov ecx, 0x60000000
jmp 0x725bed
push 0x8000
push 0
push edi
call dword [sym.imp.kernel32.dll_VirtualFree]
pop edi
pop esi
pop ebp
mov eax, 0xc
pop ebx
add esp, 0x1040
ret
mov esi, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx + 0x14]
lea eax, [eax + esi - 1]
xor edx, edx
div ebp
xor edx, edx
mov edi, eax
mov eax, esi
div ebp
cmp eax, edi
ja 0x725c37
mov edx, ecx
mov esi, ecx
and edx, 0x20000000
and esi, 0x40000000
and ecx, 0x80000000
test edx, edx
je 0x725c20
or byte [esp + eax + 0x50], 1
test esi, esi
je 0x725c29
or byte [esp + eax + 0x50], 2
test ecx, ecx
je 0x725c32
or byte [esp + eax + 0x50], 4
inc eax
cmp eax, edi
jbe 0x725c17
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 0x28
cmp ax, cx
mov dword [esp + 0x20], eax
jbe 0x725bb8
mov edi, dword [esp + 0x10]
mov ebp, dword [sym.imp.kernel32.dll_VirtualProtect]
mov ebx, dword [esp + 0x18]
xor esi, esi
xor eax, eax
mov al, byte [esp + esi + 0x50]
sub eax, 2
je 0x725c8b
dec eax
je 0x725c84
sub eax, 3
je 0x725c7d
mov dword [esp + 0x24], 0x40
jmp 0x725ca6
mov eax, 4
jmp 0x725c90
mov eax, 0x20
jmp 0x725c90
mov eax, 2
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x24]
push ecx
push eax
push edx
push edi
mov dword [esp + 0x34], eax
call ebp
test eax, eax
je 0x725cd2
mov edx, dword [esp + 0x30]
add edi, edx
inc esi
cmp esi, ebx
jbe 0x725c60
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push 0
push 1
mov edx, dword [ecx + 0x28]
push eax
add edx, eax
call edx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1040
ret
mov eax, dword [esp + 0x10]
push 0x8000
push 0
push eax
call dword [sym.imp.kernel32.dll_VirtualFree]
pop edi
pop esi
pop ebp
mov eax, 0xd
pop ebx
add esp, 0x1040
ret
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x1040
ret
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x1040
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x1040
ret