Function at 0x402790
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Print debug messages
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xcf]
push 0x7f
push 0
push eax
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x210], 0
mov byte [ebp - 0xd0], 0
call fcn.00434f70
push 0x44
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.00434f70
add esp, 0x18
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x20c], xmm0
push 0x465188
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x402882
push 0x58
push eax
push 0x4653e8
mov byte [0x465188], al
call fcn.00434f70
add esp, 0xc
mov dword [0x4653e8], 0x58
mov dword [0x46541c], 0x1804
mov dword [0x4653f4], 0x449a74
mov dword [0x4653ec], esi
push 0x4653e8
mov dword [0x465404], 0x465188
mov dword [0x465408], 0x208
mov dword [0x465414], 0x449a98
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
test eax, eax
je 0x402b25
lea ecx, [ebp - 0x1ec]
call fcn.0041a360
push 0x465188
mov dword [ebp - 4], 0
call fcn.0041ae60
add esp, 4
lea ecx, [ebp - 0x1ec]
push 1
push 0x465188
call fcn.0041a4c0
test eax, eax
jne 0x4028cf
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push str.Couldnt_map_file_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402b13
push dword [ebp - 0x1e8]
call fcn.00403470
add esp, 4
test eax, eax
jne 0x4028f9
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push str.Invalid_PE_file_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402b13
push dword [ebp - 0x1e8]
call dword [sym.imp.imagehlp.dll_ImageNtHeader]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x40291f
cmp dword [edi + 0x34], 0x400000
mov eax, 0x400000
jb 0x402922
mov eax, dword [edi + 0x34]
mov edi, dword [edi + 0x28]
lea ecx, [ebp - 0x1ec]
add edi, eax
call fcn.0041a410
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x254], 0x44
push eax
lea eax, [ebp - 0x254]
push eax
push 0
push 0
push 0x24
push 0
push 0
push 0
push 0
push 0x465188
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40297f
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push str.Couldnt_create_process_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402b13
lea eax, [ebp - 0x1f4]
push eax
push 0x40
push 1
push edi
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x1f8], 0
push eax
push 1
lea eax, [ebp - 0x1ed]
push eax
push edi
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x402af2
cmp dword [ebp - 0x1f8], 1
jne 0x402af2
movzx eax, byte [ebp - 0x1ed]
push eax
lea eax, [ebp - 0xd0]
mov byte [ebp - 0xd0], 0
push str.Type__bpint_3__in_SoftICE_and_click_OK._nDont_forget_type__eb_eip_0x_2.2X__after_debugger_pop_up.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xd0]
push 0x41
push str.Get_ready_for_Break__Enter
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
je 0x402b05
push 0x3f
lea eax, [ebp - 0x4f]
mov byte [ebp - 0x50], 0
push 0
push eax
call fcn.00434f70
movzx eax, byte [ebp - 0x1ed]
push eax
lea eax, [ebp - 0x50]
push str._Type__eb_eip__0.2X__________n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov dword [ebp - 0x1fc], 0
lea eax, [ebp - 0x1fc]
mov byte [ebp - 0x1ed], 0xcc
push eax
push 1
lea eax, [ebp - 0x1ed]
push eax
push edi
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x402ae4
cmp dword [ebp - 0x1fc], 1
jne 0x402ae4
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x1f4]
push 1
push edi
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._n__PE_Tools___n
call esi
push str.__________________________n
call esi
lea eax, [ebp - 0x50]
push eax
call esi
push str.__________________________n
call esi
push str._n_n
call esi
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 4], 0xffffffff
call fcn.0041a3a0
mov eax, 1
jmp 0x402b27
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push str.Cant_write_process_memory_
jmp 0x402afe
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push str.Cant_read_process_memory_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 4], 0xffffffff
call fcn.0041a3a0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret