Function at 0x4077e0
Capabilities:
Allocate or change rwx memory
Create process on windows
Delete file
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b6d0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x998
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8d4], edx
mov dword [ebp - 0x99c], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebx + 0x14]
push 0x410
mov dword [ebp - 0x9a8], eax
lea eax, [ebp - 0x460]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x460]
call fcn.00409630
test al, al
jne 0x407877
mov eax, 0x10300001
jmp 0x40802d
mov ecx, 0x104
lea esi, [ebp - 0x460]
lea edi, [ebp - 0x870]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x208
lea eax, [ebp - 0x870]
cmp word [eax], 0
je 0x4078a3
add eax, 2
sub ecx, 1
jne 0x407895
mov esi, 0x208
mov edi, ecx
mov eax, esi
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x4078fe
mov edx, esi
lea ecx, [ebp - 0x870]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x4078f1
mov esi, str.SWHEX86.txt
mov eax, 0x7ffffffe
sub esi, ecx
test eax, eax
je 0x4078ec
movzx edi, word [esi + ecx]
test di, di
je 0x4078ec
mov word [ecx], di
dec eax
add ecx, 2
sub edx, 1
jne 0x4078d3
mov esi, 0x208
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x870]
call fcn.004094a0
test al, al
je 0x40791a
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xb0
lea eax, [ebp - 0x998]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x870]
push eax
lea ecx, [ebp - 0x998]
call fcn.00408c20
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x998]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x98c], 2
je 0x40798a
lea ecx, [ebp - 0x994]
call fcn.00409010
test eax, eax
jne 0x407980
push eax
mov eax, dword [ebp - 0x998]
lea ecx, [ebp - 0x998]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool_]
mov esi, 0x10300002
jmp 0x407f80
push 0x40
push 0x3000
push 0x1000
push 0
push dword [ebp - 0x99c]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov dword [ebp - 0x8cc], edi
test edi, edi
jne 0x4079ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9a0]
mov dword [ecx], eax
lea ecx, [ebp - 0x994]
call fcn.00409010
test eax, eax
jne 0x4079e5
push eax
mov eax, dword [ebp - 0x998]
lea ecx, [ebp - 0x998]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool_]
mov esi, 0x10300003
jmp 0x407f80
mov ecx, dword [ebp - 0x99c]
lea eax, [ebp - 0x8d8]
push eax
push str.CallNextHookEx
mov edx, str.user32.dll
mov dword [ebp - 0x8d8], 0
call fcn.00401a90
mov eax, dword [ebp - 0x8d8]
add esp, 8
test eax, eax
jne 0x407a3f
push 0x8000
push eax
push edi
push dword [ebp - 0x99c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300004
jmp 0x407f80
mov ecx, dword [ebp - 0x9a4]
sub eax, edi
push 0
sub eax, 0x1b
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x8d4]
push 0x35
mov dword [ebp - 0x35], eax
lea eax, [ebp - 0x4c]
push eax
push edi
push dword [ebp - 0x99c]
mov dword [ebp - 0x44], 0xffec8b55
mov dword [ebp - 0x40], 0x75ff1075
mov dword [ebp - 0x3c], 0x875ff0c
mov word [ebp - 0x38], 0x6a
mov byte [ebp - 0x36], 0xe8
mov dword [ebp - 0x31], 0x535000eb
mov byte [ebp - 0x2d], 0xbb
mov dword [ebp - 0x28], 0x141c43c6
mov dword [ebp - 0x24], 0x53ff33ff
mov dword [ebp - 0x20], 0x5b038904
mov dword [ebp - 0x1c], 0xcc25d58
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x407aeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9a0]
push 0x8000
push 0
push edi
push dword [ebp - 0x99c]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300005
jmp 0x407f80
push 0x409320
lea eax, [edi + 8]
push eax
push 0x409460
push dword [ebp - 0x99c]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 0x409480
lea ecx, [ebp - 0x998]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push ecx
mov ecx, eax
call fcn.004090a0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, [ebp - 0x994]
call fcn.00409010
test eax, eax
jne 0x407b69
push eax
mov eax, dword [ebp - 0x998]
lea ecx, [ebp - 0x998]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool_]
mov ecx, 0x208
lea eax, [ebp - 0x460]
cmp word [eax], 0
je 0x407b82
add eax, 2
sub ecx, 1
jne 0x407b74
mov eax, esi
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x407bdc
lea ecx, [ebp - 0x460]
lea ecx, [ecx + edx*2]
sub esi, edx
je 0x407bcf
mov edi, str.LSI_SWHEX___x86.exe
mov eax, 0x7ffffffe
sub edi, ecx
nop dword [eax + eax]
test eax, eax
je 0x407bc9
movzx edx, word [edi + ecx]
test dx, dx
je 0x407bc9
mov word [ecx], dx
dec eax
add ecx, 2
sub esi, 1
jne 0x407bb0
mov edi, dword [ebp - 0x8cc]
test esi, esi
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
xor eax, eax
movlpd qword [ebp - 0x8c4], xmm0
mov word [ebp - 0x886], ax
mov word [ebp - 0x898], ax
mov eax, dword [ebx + 0x10]
movlpd qword [ebp - 0x8bc], xmm0
movlpd qword [ebp - 0x8b4], xmm0
movlpd qword [ebp - 0x8ac], xmm0
movlpd qword [ebp - 0x8a4], xmm0
movlpd qword [ebp - 0x896], xmm0
movlpd qword [ebp - 0x88e], xmm0
mov dword [ebp - 0x8c8], 0x44
mov dword [ebp - 0x89c], 1
movups xmmword [ebp - 0x8e8], xmm0
cmp eax, 0xffffffff
je 0x407e3d
lea ecx, [ebp - 0x8d0]
mov dword [ebp - 0x8d0], 0
push ecx
push eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x407c9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9a0]
push 0x8000
push 0
push edi
push dword [ebp - 0x99c]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300006
jmp 0x407f80
lea eax, [ebp - 0x8cc]
mov dword [ebp - 0x8cc], 0
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x8d0]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x407d00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9a0]
push dword [ebp - 0x8d0]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push edi
push dword [ebp - 0x99c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300007
jmp 0x407f80
lea eax, [ebp - 0x87c]
mov dword [ebp - 0x87c], 0
push eax
push 4
lea eax, [ebp - 0x8d4]
mov dword [ebp - 0x8d4], 0
push eax
push 0x13
push dword [ebp - 0x8cc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x407d78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9a0]
push dword [ebp - 0x8cc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ecx], eax
call esi
push dword [ebp - 0x8d0]
call esi
push 0x8000
push 0
push edi
push dword [ebp - 0x99c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300008
jmp 0x407f80
mov eax, dword [ebp - 0x8d4]
lea ecx, [ebp - 0x8e8]
push ecx
lea ecx, [ebp - 0x8c8]
mov dword [ebp - 0x9a4], eax
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x460]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x407de6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9a0]
push dword [ebp - 0x9a4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ecx], eax
call esi
push dword [ebp - 0x8cc]
call esi
push dword [ebp - 0x8d0]
call esi
jmp 0x407e7b
push dword [ebp - 0x9a4]
call esi
push dword [ebp - 0x8cc]
call esi
push dword [ebp - 0x8d0]
call esi
push 0x7d0
push dword [ebp - 0x8e8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407e99
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9a0]
push 0
push dword [ebp - 0x8e8]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, 0x1030000a
jmp 0x407f80
lea eax, [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x8c8]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x407dfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9a0]
mov dword [ecx], eax
push 0x8000
push 0
push edi
push dword [ebp - 0x99c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300009
jmp 0x407f80
lea eax, [ebp - 0x878]
mov dword [ebp - 0x878], 0
push eax
push dword [ebp - 0x8e8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x8e8]
call esi
push dword [ebp - 0x8e4]
call esi
cmp dword [ebp - 0x878], 0
je 0x407eee
push 0x8000
push 0
push edi
push dword [ebp - 0x99c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, dword [ebp - 0x878]
jmp 0x407f80
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, dword [ebp - 0x99c]
mov dword [ebp - 0x87c], eax
lea eax, [edi + 0x1c]
mov dword [ebp - 0x9a4], edx
mov byte [ebp - 0x871], 0
push 0
push 1
lea ecx, [ebp - 0x871]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x87c]
sbb edx, dword [ebp - 0x9a4]
test edx, edx
ja 0x407f7b
jb 0x407f4a
cmp eax, 0x7d0
ja 0x407f7b
cmp byte [ebp - 0x871], 0
lea eax, [edi + 0x1c]
je 0x407f10
push 0
push 4
push dword [ebp - 0x9a8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor esi, esi
jmp 0x407f80
mov esi, 0x1030000b
mov eax, dword [ebp - 0x998]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x998]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x99c], eax
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x948], 0
mov dword [ebp - method.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
je 0x407ff3
mov eax, dword [ebp - 0x988]
lea ecx, [ebp - 0x958]
cmp dword [eax], ecx
jne 0x407ff3
mov edx, dword [ebp - 0x940]
mov ecx, dword [ebp - 0x944]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x978]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [ebp - 0x968]
mov dword [eax], edx
cmp byte [ebp - 0x94c], 0
je 0x408007
lea ecx, [ebp - 0x994]
call fcn.00409010
lea ecx, [ebp - 0x994]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x990]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x930]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret