Function at 0x407290
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Read file on windows
Resume thread
Suspend thread
Terminate process
Use process replacement

Disassembly:
sub esp, 0xa00
mov eax, dword [0x4740f4]
xor eax, esp
mov dword [esp + 0x9fc], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa10]
push edi
mov edi, dword [esp + 0xa18]
push edi
push esi
push str.InjectSuspended:_exe__s__dir__s__n
mov dword [esp + 0x38], 0x9090feeb
call fcn.00410ba0
push 0x44
lea eax, [esp + 0x48]
push 0
push eax
call fcn.00440150
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x3c]
push edx
push edi
push 0
push 4
push 0
push 0
push 0
push esi
push 0
mov dword [esp + 0x60], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.USER32.dll_MessageBoxExA]
test eax, eax
jne 0x40735d
call ebp
push eax
push esi
lea eax, [esp + 0x510]
push str.CreateProcess___s__error_d
push eax
call fcn.00440071
add esp, 0x10
push 0
push 0x30
push str.Injection
lea ecx, [esp + 0x514]
push ecx
push 0
call edi
cmp dword [0x4755a8], 0
je 0x40735d
lea edx, [esp + 0x508]
push edx
push 0x45d228
call fcn.00410ba0
add esp, 8
mov eax, dword [esp + 0x24]
push eax
push 0
push 0xc38
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp dword [0x4755a8], 0
mov dword [esp + 0x10], eax
je 0x407392
push eax
push str.Target_handle_x_n
call fcn.00410ba0
add esp, 8
push 0x45d210
push esi
call fcn.0044158d
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4073fb
call ebp
push eax
push esi
lea ecx, [esp + 0x510]
push str.fopen__s_error_d
push ecx
call fcn.00440071
add esp, 0x10
push 0
push 0x30
push str.Injection
lea edx, [esp + 0x514]
push edx
push 0
call edi
cmp dword [0x4755a8], 0
je 0x4078ff
lea eax, [esp + 0x508]
push eax
push 0x45d228
call fcn.00410ba0
add esp, 8
jmp 0x4078ff
push ebx
push 0x10
lea ecx, [esp + 0x84]
push 4
push ecx
call fcn.00441953
add esp, 0x10
cmp eax, 0x10
je 0x407469
call ebp
push eax
lea edx, [esp + 0x50c]
push str.fread_error_d
push edx
call fcn.00440071
add esp, 0xc
push 0
push 0x30
push str.Injection
lea eax, [esp + 0x514]
push eax
push 0
call edi
cmp dword [0x4755a8], 0
je 0x4078ff
lea ecx, [esp + 0x508]
push ecx
push 0x45d228
call fcn.00410ba0
add esp, 8
jmp 0x4078ff
mov edx, dword [esp + 0xb8]
push edx
push str.NT_Header_offset_X_n
call fcn.00410ba0
mov eax, dword [esp + 0xc0]
push 0
push eax
push ebx
call fcn.0044162e
push ebx
push 0x70
lea ecx, [esp + 0x98]
push 4
push ecx
call fcn.00441953
add esp, 0x24
cmp eax, 0x70
je 0x4074f9
call ebp
push eax
lea edx, [esp + 0x50c]
push str.fread_error_d
push edx
call fcn.00440071
add esp, 0xc
push 0
push 0x30
push str.Injection
lea eax, [esp + 0x514]
push eax
push 0
call edi
cmp dword [0x4755a8], 0
je 0x4078ff
lea ecx, [esp + 0x508]
push ecx
push 0x45d228
call fcn.00410ba0
add esp, 8
jmp 0x4078ff
mov edx, dword [esp + 0xb0]
mov eax, dword [esp + 0xa4]
push edx
push eax
push str.AddressOfEntryPoint_X_ImageBase_X_n
call fcn.00410ba0
mov ecx, dword [esp + 0xb0]
mov edx, dword [esp + 0xbc]
add esp, 0xc
cmp dword [0x4755a8], 0
lea esi, [ecx + edx]
je 0x40753e
push esi
push str.Thread_start_address_x_n
call fcn.00410ba0
add esp, 8
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x34]
push eax
push 0x40
push 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x407574
call ebp
push eax
lea ecx, [esp + 0x50c]
push str.VirtualProtectEx_error_d
push ecx
call fcn.00440071
add esp, 0xc
jmp 0x4073bf
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x38]
push edx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x4075e0
call ebp
push eax
push str.ReadProcessMemory_error_d
lea eax, [esp + 0x510]
push eax
call fcn.00440071
add esp, 0xc
push 0
push 0x30
push str.Injection
lea ecx, [esp + 0x514]
push ecx
push 0
call edi
cmp dword [0x4755a8], 0
je 0x4078ff
lea edx, [esp + 0x508]
push edx
push 0x45d228
call fcn.00410ba0
add esp, 8
jmp 0x4078ff
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x34]
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40764c
call ebp
push eax
push str.WriteProcessMemory_error_d
lea edx, [esp + 0x510]
push edx
call fcn.00440071
add esp, 0xc
push 0
push 0x30
push str.Injection
lea eax, [esp + 0x514]
push eax
push 0
call edi
cmp dword [0x4755a8], 0
je 0x4078ff
lea ecx, [esp + 0x508]
push ecx
push 0x45d228
call fcn.00410ba0
add esp, 8
jmp 0x4078ff
push 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x407664
call ebp
push eax
push str.FlushInstructionCache_error_d
jmp 0x407600
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x407696
push 0xbbf
call ebp
push eax
lea eax, [esp + 0x510]
push str.ResumeThread_error_d_at:_d
push eax
call fcn.00440071
add esp, 0x10
jmp 0x4075a4
xor ebx, ebx
mov dword [esp + 0x2f4], ebx
nop
cmp dword [esp + 0x2f4], esi
je 0x407795
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x23c]
push eax
push ecx
mov dword [esp + 0x244], 0x10001
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4076f5
mov edx, dword [esp + 0x2f4]
push edx
push ebx
push str.wait_cycle__d_eip_x_n
call fcn.00410ba0
inc ebx
add esp, 0xc
cmp ebx, 0x50
jb 0x4076a0
jmp 0x407740
call ebp
push eax
lea eax, [esp + 0x50c]
push str.GetThreadContext_error_d
push eax
call fcn.00440071
add esp, 0xc
push 0
push 0x30
push str.Injection
lea ecx, [esp + 0x514]
push ecx
push 0
call edi
cmp dword [0x4755a8], 0
je 0x407740
lea edx, [esp + 0x508]
push edx
push 0x45d228
call fcn.00410ba0
add esp, 8
mov eax, dword [esp + 0x2f4]
cmp eax, esi
je 0x407795
push esi
push eax
lea eax, [esp + 0x510]
push str.thread_blocked_eip_x_addr_x
push eax
call fcn.00440071
add esp, 0x10
push 0
push 0x30
push str.Injection
lea ecx, [esp + 0x514]
push ecx
push 0
call edi
cmp dword [0x4755a8], 0
je 0x407795
lea edx, [esp + 0x508]
push edx
push 0x45d228
call fcn.00410ba0
add esp, 8
push 0
lea eax, [esp + 0x90c]
push eax
push 0x104
push 0x45d0a0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x908]
push ecx
push edx
call sub.dxwnd.dll_Ordinal_7
add esp, 8
test eax, eax
jne 0x40781d
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x908]
push eax
push ecx
lea edx, [esp + 0x510]
push str.Injection_error:_pid_x_dll_s
push edx
call fcn.00440071
add esp, 0x10
push 0
push 0x30
push str.Injection
lea eax, [esp + 0x514]
push eax
push 0
call edi
cmp dword [0x4755a8], 0
je 0x40781d
lea ecx, [esp + 0x508]
push ecx
push 0x45d228
call fcn.00410ba0
add esp, 8
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x40783a
call ebp
push eax
push str.SuspendThread_error_d
jmp 0x407594
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x38]
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4078aa
call ebp
push eax
lea edx, [esp + 0x50c]
push str.WriteProcessMemory_error_d
push edx
call fcn.00440071
add esp, 0xc
push 0
push 0x30
push str.Injection
lea eax, [esp + 0x514]
push eax
push 0
call edi
cmp dword [0x4755a8], 0
je 0x4078a1
lea ecx, [esp + 0x508]
push ecx
push 0x45d228
call fcn.00410ba0
add esp, 8
push 0
push 0
call fcn.004401ca
push 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x4078c5
call ebp
push eax
push str.FlushInstructionCache_error_d
jmp 0x407600
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x4078f7
push 0xc00
call ebp
push eax
lea eax, [esp + 0x510]
push str.ResumeThread_error_d_at:_d
push eax
call fcn.00440071
add esp, 0x10
jmp 0x4075a4
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40790e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], 0
je 0x407943
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x407943
cmp dword [0x4755a8], eax
je 0x407943
call ebp
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push str.failed_to_kill_hproc_x_err_d_n
call fcn.00410ba0
add esp, 0xc
mov ecx, dword [esp + 0xa0c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043fd57
add esp, 0xa00
ret