Function at 0x42e560
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481ec0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
push str.Begin_SR_HijackThread_n
push 2
call fcn.00428a80
add esp, 8
lea ecx, [ebp - 0xcc]
call fcn.00428a90
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0xcc]
push edi
mov dword [ebp - 4], 0
call fcn.004291d0
test al, al
jne 0x42e64d
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push edi
mov dword [esi + 0x414], 0xc
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov esi, 0x10200001
mov eax, str.Cant_initialize_ProcessInfo_class_n
jmp 0x42e749
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xcc]
call fcn.00428ea0
test al, al
je 0x42e6ab
cmp dword [ebp - 0x14], 0xf
je 0x42e6ab
lea ecx, [ebp - 0xcc]
call fcn.00429020
test al, al
jne 0x42e6ab
lea ecx, [ebp - 0xcc]
call fcn.00428ed0
test al, al
jne 0x42e694
cmp dword [ebp - 0x1c], 2
jne 0x42e6ab
lea ecx, [ebp - 0xcc]
call fcn.00428e90
mov esi, eax
call ebx
cmp esi, eax
jne 0x42e775
lea ecx, [ebp - 0xcc]
call fcn.004290d0
test al, al
jne 0x42e653
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push edi
mov dword [esi + 0x414], 0x29
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov esi, 0x10200002
mov eax, str.No_compatible_thread_found_n
add esp, 0xc
push eax
push 2
call fcn.00428a80
add esp, 8
lea ecx, [ebp - 0xcc]
call fcn.00428c10
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xcc]
call fcn.00428e90
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x42e6ba
push ebx
push str.Target_thread__06X_n
push 2
call fcn.00428a80
add esp, 0xc
push ebx
push 0
push 0x1a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x42e85a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x35
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.OpenThread_failed:__08X_n
push 2
call fcn.00428a80
add esp, 0x18
mov esi, 0x10200003
jmp 0x42e757
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x42e919
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x3e
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.SuspendThread_failed:__08X_n
push 2
call fcn.00428a80
mov esi, dword [ebp - 0x10]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x10200004
jmp 0x42e757
push str.Target_thread_suspended_n
push 2
call fcn.00428a80
push 0x2c8
lea eax, [ebp - 0x394]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
mov dword [ebp - 0x398], 0x10001
lea eax, [ebp - 0x398]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x42ea11
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x4e
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.GetThreadContext_failed:__08X_n
push 2
call fcn.00428a80
mov esi, dword [ebp - 0x10]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x10200005
jmp 0x42e757
push 0x40
push 0x3000
push 0x100
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x42eae2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x5b
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.VirtualAllocEx_failed:__08X_n
push 2
call fcn.00428a80
mov esi, dword [ebp - 0x10]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x10200006
jmp 0x42e757
mov eax, dword [ebp - 0x2e0]
lea esi, [edi + 0x18]
push str.Shellcode_prepared_n
push 2
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0xc704ec83
mov word [ebp - 0x54], 0x2404
mov dword [ebp - 0x4e], 0x53525150
mov word [ebp - 0x4a], 0xbb9c
mov dword [ebp - 0x44], 0xff0103c6
mov dword [ebp - 0x40], 0x53ff0c73
mov dword [ebp - 0x3c], 0x4438910
mov dword [ebp - 0x38], 0x18a164
mov dword [ebp - 0x34], 0x408b0000
mov dword [ebp - 0x30], 0x8438934
mov dword [ebp - 0x2c], 0x203c7
mov dword [ebp - 0x28], 0x5b9d0000
mov dword [ebp - 0x24], 0xc358595a
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x52], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x2e0], esi
call fcn.00428a80
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc]
push str.Hijacking_thread_with:_n
push 2
mov dword [ebp - 0x60], eax
call fcn.00428a80
push esi
push str.pRoutine___p_n
push 3
call fcn.00428a80
push edi
push str.pArg_______p_n
push 3
call fcn.00428a80
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x70]
add esp, 0x28
push 0
push 0x50
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x42ec95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0xe4
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.WriteProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
mov esi, dword [ebp - 0x10]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10200007
jmp 0x42e757
lea eax, [ebp - 0x398]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x42ed75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0xf1
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.SetThreadContext_failed:__08X_n
push 2
call fcn.00428a80
mov esi, dword [ebp - 0x10]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10200008
jmp 0x42e757
push str.EIP_replaced_n
push 2
call fcn.00428a80
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x42ee78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x104
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.ResumeThread_failed:__08X_n
push 2
call fcn.00428a80
mov eax, dword [ebp - 0x20]
add esp, 0x18
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2e0], eax
lea eax, [ebp - 0x398]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call eax
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10200009
jmp 0x42e757
push str.Thread_resumed_n
push 2
call fcn.00428a80
add esp, 8
push 0
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Entering_wait_state_n
push 2
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
call fcn.00428a80
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x1c], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x74]
sbb edx, dword [ebp - 0x1c]
test edx, edx
ja 0x42ef70
jb 0x42ef10
cmp eax, dword [ebp + 0x18]
jae 0x42ef70
nop dword [eax]
nop word [eax + eax]
push 0xa
push dword [0x7ab4e8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x18
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x8c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x90], eax
test eax, eax
je 0x42f0a0
cmp dword [ebp - 0x8c], 2
je 0x42f08c
cmp dword [ebp - 0x14], 0
je 0x42f0a0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x74]
sbb edx, dword [ebp - 0x1c]
test edx, edx
jb 0x42ef10
ja 0x42ef70
cmp eax, dword [ebp + 0x18]
jb 0x42ef10
cmp dword [ebp - 0x8c], 2
je 0x42f204
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push edi
mov dword [esi + 0x414], 0x15a
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebp - 0x10]
add esp, 0xc
cmp dword [ebp - 0x8c], 0
jne 0x42f1e4
mov eax, dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call eax
cmp eax, 0xffffffff
je 0x42f1e4
push str.Shell_timed_out_n
push 2
call fcn.00428a80
mov eax, dword [ebp - 0x20]
add esp, 8
mov dword [ebp - 0x2e0], eax
lea eax, [ebp - 0x398]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call eax
test eax, eax
je 0x42f1e4
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call edi
cmp eax, 0xffffffff
je 0x42f1e4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x1020000b
jmp 0x42e757
push str.Shelldata_retrieved_n
push 2
call fcn.00428a80
add esp, 8
jmp 0x42ef70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x131
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryThread_Hijacking.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_HijackThread
call esi
add eax, eax
push eax
push str.SR_HijackThread
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [ebp - 0x14]
add esp, 0xc
test ebx, ebx
jne 0x42f142
push str.Interrupt__n
push 2
call fcn.00428a80
add esp, 8
jmp 0x42f156
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.ReadProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
add esp, 0xc
cmp dword [ebp - 0x90], 0
je 0x42f1c0
cmp dword [ebp - 0x8c], 0
jne 0x42f1c0
mov esi, dword [ebp - 0x10]
mov eax, dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call eax
cmp eax, 0xffffffff
je 0x42f1c0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2e0], eax
lea eax, [ebp - 0x398]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call eax
test eax, eax
je 0x42f1c0
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call edi
cmp eax, 0xffffffff
je 0x42f1c0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test ebx, ebx
jne 0x42f1da
push dword [0x7ab4ec]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, 0x10000004
jmp 0x42e757
mov esi, 0x1020000c
jmp 0x42e757
push str.pRoutine_timed_out_n
push 2
call fcn.00428a80
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x1020000a
jmp 0x42e757
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [ebp - 0x88]
push str.pRoutine_returned:__08X_n
push 2
call fcn.00428a80
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov eax, dword [ebp - 0x88]
xor esi, esi
mov dword [ecx], eax
jmp 0x42e757