Function at 0x403980
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Execute command
Execute shellcode via indirect call
Get disk information
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441545
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x462074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov esi, eax
push 1
push esi
mov dword [ebp - 0x28], esi
call edi
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0
push str.clmz5x7vg0017nx0121hnjyy5
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x114], 0
movups xmmword [ebp - 0x128], xmm0
call fcn.004068d0
lea eax, [ebp - 0x128]
mov dword [ebp - 4], 0
push eax
call fcn.00421e9f
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x114]
cmp ecx, 0x10
jb 0x403a52
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403a48
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403a48
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0043ff52
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov dword [ebp - 4], 1
push str.________Enter_Your_Key_:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0x44]
add esp, 8
call fcn.004061b0
push 2
push esi
call edi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
push 0
push 0
push 0x44ccf4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x40449f
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x128]
call fcn.00405b70
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0041b05d
mov byte [ebp - 4], 2
add esp, 8
mov ecx, dword [ebp - 0x114]
cmp ecx, 0x10
jb 0x403b24
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403b1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403b1a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0043ff52
add esp, 8
push str.Authenticated_successfully
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x128]
mov edi, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
xorps xmm0, xmm0
push 6
push str.secret
movups xmmword [ebp - 0x128], xmm0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
call fcn.004068d0
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0040d6fb
add esp, 8
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x403baa
mov eax, dword [eax]
push ecx
push eax
push edi
call fcn.00407c20
add esp, 0xc
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0xfc]
cmp ecx, 0x10
jb 0x403bfc
mov edx, dword [ebp - 0x110]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403bf2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403c47
push ecx
push edx
call fcn.0043ff52
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0xf
mov byte [ebp - 0x110], 0
cmp ecx, 0x10
jb 0x403c57
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403c4d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403c4d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0043ff52
add esp, 8
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push 0x44ce7c
call edi
add esp, 4
push 5
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push str.______________join_discord_for_help:_https:__discord.gg_zgkGdW7v4A
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.______________pasted_by_mayzorr
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x44ceec
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x44ceec
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x44cf10
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x44cf58
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x44cfa0
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str._______________________________________________________________
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x44d030
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x44d078
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str._________________________________________________________________
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
push 0x406180
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.________________________________________________________________
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.____________________________________________________________
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.______________________________
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call fcn.00402de0
test al, al
jne 0x403e40
push str.____cannot_get_appdata_dir_n
jmp 0x403e4e
call fcn.00402e80
test al, al
jne 0x403eaf
push str.____cannot_get_exitlag.exe_path_n
call fcn.00401210
push 0x44ce7c
call edi
mov ecx, dword [ebp - 0x30]
add esp, 8
cmp ecx, 0x10
jb 0x403e91
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e87
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40444d
push ecx
push edx
call fcn.0043ff52
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043fcc3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xf8]
xor esi, esi
push eax
push 8
mov dword [ebp - 0xf8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403ef6
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 4
push eax
push 4
lea eax, [ebp - 0x28]
push eax
push 0x14
push dword [ebp - 0xf8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0xf8]
test eax, eax
je 0x403f07
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x403f5d
push str.____should_run_as_admin_n
call fcn.00401210
push 0x44ce7c
call edi
mov ecx, dword [ebp - 0x30]
add esp, 8
cmp ecx, 0x10
jb 0x403f53
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403f49
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40444d
push ecx
push edx
call fcn.0043ff52
add esp, 8
mov eax, 1
jmp 0x403e93
push str.choose_action:_n
call fcn.00401210
push str.1._Create_New_HWID_n
call fcn.00401210
push str.2._Start_Exitlag_With_Injector__n
call fcn.00401210
lea eax, [ebp - 0x2c]
push eax
push 0x44d280
call fcn.00401240
mov eax, dword [ebp - 0x2c]
add esp, 0x14
cmp eax, 1
jne 0x4041ae
mov byte [ebp - 0x24], 0
nop dword [eax]
push 0xb0
lea eax, [ebp - 0xf4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x110]
push 0x4620a8
call fcn.00402230
mov esi, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x128]
push dword [ebp - 0x24]
call fcn.00407fb0
add esp, 4
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 8
push eax
mov ecx, esi
call fcn.00401ef0
mov byte [ebp - 4], 7
mov esi, eax
mov ecx, dword [ebp - 0x114]
cmp ecx, 8
jb 0x404035
mov edx, dword [ebp - 0x128]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40402b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a42
push ecx
push edx
call fcn.0043ff52
add esp, 8
sub esp, 0xc
mov dword [ebp - 0x118], 0
xor eax, eax
mov dword [ebp - 0x114], 7
lea ecx, [ebp - 0xf4]
mov word [ebp - 0x128], ax
push esi
call fcn.00405e40
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0xfc]
cmp ecx, 8
jb 0x4040a5
mov edx, dword [ebp - 0x110]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40409b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a42
push ecx
push edx
call fcn.0043ff52
add esp, 8
xor eax, eax
mov dword [ebp - 0x100], 0
lea ecx, [ebp - 0x128]
mov dword [ebp - 0xfc], 7
mov word [ebp - 0x110], ax
call fcn.004036c0
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x4040dc
mov eax, dword [eax]
push ecx
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.00407c20
mov byte [ebp - 4], 0xa
add esp, 0xc
mov ecx, dword [ebp - 0x114]
cmp ecx, 0x10
jb 0x40412b
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404121
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a42
push ecx
push edx
call fcn.0043ff52
add esp, 8
lea ecx, [ebp - 0xf4]
call fcn.004044d0
push str.___hwid_created_n
call fcn.00401210
mov byte [ebp - 4], 1
add esp, 4
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf4], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xf8], eax
lea ecx, [ebp - 0xf0]
call fcn.00404ff0
lea ecx, [ebp - 0xec]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x8c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
lea eax, [ebp - 0x2c]
push eax
push 0x44d280
call fcn.00401240
mov eax, dword [ebp - 0x2c]
add esp, 8
cmp eax, 1
je 0x403fa0
cmp eax, 2
jne 0x404404
cmp dword [0x4620d4], 8
mov eax, 0x4620c0
push 5
cmovae eax, dword [0x4620c0]
push 0
push 0
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
jne 0x404235
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____cannot_start_exitlag.exe__code:__d__n
call fcn.00401210
push 0x44ce7c
call edi
mov ecx, dword [ebp - 0x30]
add esp, 0xc
cmp ecx, 0x10
jb 0x403f53
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403f49
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403f49
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
movq xmm0, qword [str.ExitLag.exe]
lea ecx, [ebp - 0x20]
mov eax, dword [0x44d2e4]
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], eax
call fcn.00403860
cmp eax, 0xffffffff
jne 0x404274
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
push 0x12c
call esi
lea ecx, [ebp - 0x20]
call fcn.00403860
cmp eax, 0xffffffff
je 0x404260
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0xf8], esi
test esi, esi
jne 0x4042ae
push str.Failed_to_open_the_target_process.
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edi, dword [0x44d464]
push 0x40
push 0x3000
mov dword [ebp - 0x28], edi
push dword [edi + 0x44d478]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push dword [edi + 0x44d47c]
mov dword [ebp - 0x24], eax
push 0x44d428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
xor edi, edi
cmp cx, word [eax + 0x44d42e]
jae 0x404338
lea esi, [eax + 0x44d534]
nop dword [eax + eax]
mov eax, dword [esi]
push 0
push dword [esi - 4]
add eax, 0x44d428
push eax
mov eax, dword [esi - 8]
add eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x28]
lea esi, [esi + 0x28]
inc edi
movzx eax, word [eax + 0x44d42e]
cmp edi, eax
jl 0x404300
mov esi, dword [ebp - 0xf8]
push 0x20
push 0x3000
push 0x1000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov eax, dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlZeroMemory
push str.ntdll
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x100], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0
push 0x10
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x108]
push eax
push edi
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov eax, fcn.00402dd0
lea esi, [edi + 0x10]
sub eax, 0x402c90
push eax
push 0x402c90
push esi
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0xffffffffffffffff
push 0
push 0
push edi
push esi
mov esi, dword [ebp - 0xf8]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push str.___injected__good_luck._n
call fcn.00401210
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x40440e
push str.____unknown_command_n
call fcn.00401210
add esp, 4
push 0x44ce7c
call edi
mov ecx, dword [ebp - 0x30]
add esp, 4
cmp ecx, 0x10
jb 0x403e91
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e87
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403e87
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 4
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push str.Failed_to_authenticate:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405f60
mov ecx, dword [ebp - 0x12c]
add esp, 8
mov esi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 4]
call edx
push eax
push esi
call fcn.00405f60
add esp, 8
mov ecx, eax
push 0x406180
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push str.failed_to_get_hwid
lea ecx, [ebp - 0x138]
call fcn.004014d0
push 0x45ecc4
lea eax, [ebp - 0x138]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3