Function at 0x4027a4
Capabilities:
Create thread
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2354
call fcn.0040c020
push ebx
push esi
push edi
call fcn.0040a42e
test al, al
jne 0x4027c6
call fcn.0040a4ab
test al, al
je 0x4027d3
call fcn.0040a33c
test al, al
je 0x402b75
xor ebx, ebx
push 9
mov esi, 0x423f34
push ebx
push esi
call fcn.0040bc80
push ebx
push 1
push 0x41a8c4
push dword [0x4295b8]
push dword [0x4295b4]
call fcn.0040927f
add esp, 0x20
mov edi, eax
cmp edi, ebx
push 8
je 0x402819
push edi
push esi
call fcn.0040ca50
push edi
call fcn.0040b5d6
add esp, 0x10
jmp 0x402831
push 0x41a8c0
push 3
call fcn.00408cb1
pop ecx
pop ecx
push eax
push esi
call fcn.0040ca50
add esp, 0xc
call fcn.0040102f
lea eax, [ebp - 0x344]
push 0x208
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
call fcn.00402b7e
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x402905
mov esi, 0x1008
push 1
mov ecx, 0x401
xor eax, eax
lea edi, [ebp - 0x1348]
push 1
mov dword [ebp - 0x134c], esi
push 0x41a4c4
rep stosd dword es:[edi], eax
push 0xc
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
lea eax, [ebp - 0x2354]
push esi
push eax
push ebx
push 0x41a4b4
push 0xe
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
call fcn.00408323
add esp, 0x14
cmp eax, ebx
jle 0x402905
push eax
lea eax, [ebp - 0x2354]
push eax
lea eax, [ebp - 0x134c]
push eax
call fcn.0040bce0
add esp, 0xc
lea eax, [ebp - 0x1344]
push eax
lea eax, [ebp - 0x1144]
push eax
push 0x41a788
push 5
call fcn.00408cb1
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.0040ba39
lea eax, [ebp - 0x13c]
push eax
call fcn.0040198c
add esp, 0x14
push 0x41a8bc
push 2
call fcn.00408cb1
push eax
push dword [ebp + 0x10]
call fcn.0040c9d0
add esp, 0x10
test eax, eax
je 0x40292b
call fcn.00402292
jmp 0x402b75
push 0x41a8b4
push 5
call fcn.00408cb1
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.0040c9d0
add esp, 0x10
test eax, eax
je 0x402960
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.00401a90
jmp 0x402b75
push ebx
call fcn.00401e21
mov dword [esp], 0x41a4e8
push 0x10
call fcn.00408cb1
pop ecx
pop ecx
push eax
push ebx
push 4
call dword [sym.imp.KERNEL32.DLL_OpenFileMappingA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x402aa9
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x402a99
mov eax, dword [edi + 0xc]
cmp dword [edi + 4], 0x1194
mov dword [ebp - 0x14], eax
jae 0x402b75
push dword [edi + 8]
mov esi, dword [sym.imp.KERNEL32.DLL_OpenProcess]
push ebx
push 0x100001
call esi
push dword [edi + 8]
mov dword [ebp - 8], eax
push ebx
push 0x100000
call esi
cmp dword [ebp - 8], ebx
mov dword [ebp + 0x10], eax
jne 0x4029e3
cmp eax, ebx
je 0x402a91
push dword [edi + 0x14]
lea esi, [edi + 0x14]
call fcn.0040c895
push dword [esi]
mov dword [ebp - 0xc], eax
push esi
push eax
call fcn.0040bce0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push ebx
push ebx
push 0x12
mov dword [ebp - 4], ebx
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov edi, dword [ebp - 8]
cmp edi, ebx
je 0x402a7a
push 0xbb8
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x402a42
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
je 0x402a91
push edi
call esi
cmp dword [ebp + 0x10], ebx
je 0x402a4f
push dword [ebp + 0x10]
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x5dc
call edi
push 1
push dword [ebp - 0xc]
call fcn.00401fc5
pop ecx
pop ecx
push 0x3e8
call edi
push dword [ebp - 0xc]
call fcn.0040c7ac
pop ecx
jmp 0x402a9f
cmp dword [ebp + 0x10], ebx
je 0x402a4f
push 0xbb8
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x402a4a
or eax, 0xffffffff
jmp 0x402b77
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 4], ebx
je 0x402aa9
push dword [ebp - 4]
call esi
call fcn.0040166d
cmp dword [ebp - 0x18], ebx
je 0x402af8
push 0x80000001
push ebx
push 8
push 0x423f90
push 1
push 0x41a888
push 0xc
mov dword [0x423f90], ebx
mov dword [0x423f94], 0x15180
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
call fcn.0040824f
push 1
call fcn.004022f8
add esp, 0x18
jmp 0x402b75
push ebx
call fcn.0040c33a
pop ecx
mov dword [ebp - 0x10], eax
push 0x80000001
push ebx
lea eax, [ebp - 0x10]
push 4
push eax
push 1
push 0x41a878
push 0xe
call fcn.00408cb1
pop ecx
pop ecx
push eax
call fcn.00408952
push eax
call fcn.0040824f
add esp, 0x14
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0x402683
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp byte [0x423f30], bl
jne 0x402b70
push ebx
push ebx
lea eax, [ebp - 0x38]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x402b70
cmp dword [ebp - 0x34], 0x16
jne 0x402b64
cmp dword [ebp - 0x30], ebx
jne 0x402b70
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x402b40
call section..text
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10