Function at 0x407a00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x31c
push ebx
push ebp
mov ebp, dword [esp + 0x338]
xor eax, eax
push edi
xor ebx, ebx
push 0x2c8
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x64]
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x68], ebx
call fcn.00433c00
mov ecx, dword [esp + 0x33c]
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ecx
call fcn.00405170
add esp, 0x10
mov edi, eax
cmp dword [0x479878], ebx
jne 0x407a8a
push str.NtCreateThread
push 0x463d3c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x479878], eax
cmp eax, ebx
je 0x407d1a
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push ebx
push ebx
push 4
push 6
push esi
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
mov eax, dword [esp + 0x14]
push 4
push 0x2000
lea ecx, [ebp - 0x1000]
push ecx
push ebx
push esi
mov dword [esp + 0x4c], 0x18
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], 0x40
mov dword [esp + 0x54], ebx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [esp + 0x350]
mov dword [esp + 0x2c], eax
cmp ecx, ebx
je 0x407ae9
mov dword [ecx], eax
cmp eax, ebx
je 0x407d3d
add eax, 0x1000
mov dword [esp + 0x2c], eax
lea eax, [eax + ebp - 0x2000]
mov dword [esp + 0x24], eax
cmp edi, ebx
je 0x407b12
sub eax, 0x1000
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x340]
mov edx, eax
sub edx, ecx
add ecx, 0x1000
sub eax, ecx
mov dword [esp + 0x28], edx
cmp edi, ebx
je 0x407b33
add ecx, 0x1000
push 4
push 0x1000
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp eax, ebx
je 0x407d1a
lea ecx, [esp + 0x50]
push ecx
push 0x104
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x407d1a
lea edx, [esp + 0x18]
push edx
call fcn.00404fc0
add esp, 4
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x60], 0x10007
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov ebp, eax
mov dword [esp + 0x120], ebp
cmp ecx, 0x8c
jb 0x407bb4
lea ebp, [eax - 0x38]
mov dword [esp + 0x120], ebp
mov edx, dword [esp + 0x334]
cmp edx, ebx
je 0x407c30
cmp edi, ebx
je 0x407bd4
mov ebp, dword [esp + 0x338]
sub eax, ebp
lea edi, [eax + 0x1000]
jmp 0x407bf9
mov ecx, dword [esp + 0x338]
add ecx, 0xf
and ecx, 0xfffffff0
sub ebp, ecx
mov dword [esp + 0xc], ebp
mov edi, dword [esp + 0xc]
mov dword [esp + 0x120], ebp
mov ebp, dword [esp + 0x338]
lea eax, [esp + 0xc]
push eax
push ebp
push edx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x407d1a
cmp dword [esp + 0xc], ebp
jne 0x407d1a
mov ecx, dword [esp + 0x18]
cmp ecx, 0x8c
jb 0x407c34
sub dword [esp + 0x120], 0x38
jmp 0x407c34
mov edi, dword [esp + 0xc]
cmp byte [esp + 0x34c], bl
je 0x407c81
cmp ecx, 0x8c
jb 0x407c5e
push str.RtlUserThreadStart
push 0x463d3c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x407c63
call fcn.00407960
mov ecx, dword [esp + 0x32c]
mov dword [esp + 0x114], eax
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x100], edi
jmp 0x407cc7
mov edx, dword [esp + 0x32c]
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0xc]
push ecx
push 8
mov dword [esp + 0x11c], edx
lea edx, [esp + 0x38]
sub eax, 8
push edx
push eax
push esi
mov dword [esp + 0x134], eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x407d1a
cmp dword [esp + 0xc], 8
jne 0x407d1a
cmp dword [esp + 0x114], ebx
je 0x407d1a
cmp byte [esp + 0x344], bl
lea edx, [esp + 0x1c]
setne al
movzx ecx, al
push ecx
push edx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x60]
push ecx
push esi
lea edx, [esp + 0x4c]
push edx
push 0x1f03ff
lea eax, [esp + 0x2c]
push eax
call dword [0x479878]
test eax, eax
js 0x407d1a
mov eax, dword [esp + 0x348]
cmp eax, ebx
je 0x407d41
mov ecx, dword [esp + 0x58]
mov dword [eax], ecx
jmp 0x407d41
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x407d3d
push 0x8000
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [esp + 0x350]
cmp eax, ebx
je 0x407d3d
mov dword [eax], ebx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
pop edi
pop ebp
cmp eax, ebx
pop ebx
je 0x407d53
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 4]
add esp, 0x31c
ret