Function at 0x403426
Capabilities:
Create process on windows
Enumerate process modules

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x408abb
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x11c0
call fcn.00408760
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov edx, str._n
mov dword [ebp - 0x1120], eax
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [ebp - 0x111c], eax
mov al, byte [0x42a791]
mov byte [ebp - 0x1118], al
call fcn.00404480
cmp dword [0x42a5e0], 0
jne 0x402dfe
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Map_is_not_loaded
call fcn.00404480
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x20001
push 0
push str.data_buzz.wav
call dword [sym.imp.WINMM.dll_PlaySoundW]
or eax, 0xffffffff
jmp 0x403f3d
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x1020], 0
push str.StarCraft.exe
lea ecx, [ebp - 0x1030]
mov dword [ebp - 0x101c], 0
movups xmmword [ebp - 0x1030], xmm0
call fcn.00405370
lea edx, [ebp - 0x1030]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1168]
call fcn.00406fc0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x101c]
cmp ecx, 7
jbe 0x402e8a
mov edx, dword [ebp - 0x1030]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402e80
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403f2b
push ecx
push edx
call fcn.00407954
add esp, 8
mov eax, dword [ebp - 0x1164]
sub eax, dword [ebp - 0x1168]
sar eax, 2
test eax, eax
je 0x402ed6
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.only_one_starcraft_can_be_runned_
call fcn.00404480
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x20001
push 0
push str.data_buzz.wav
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov esi, 0xfffffffe
jmp 0x403efc
push 0x40
lea eax, [ebp - 0x11cc]
mov dword [ebp - 0x11d0], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1048]
call fcn.004023c0
mov byte [ebp - 4], 3
mov edx, str.Running_At_:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.004046a0
cmp dword [ebp - 0x1034], 7
lea edx, [ebp - 0x1048]
push dword [ebp - 0x1038]
cmova edx, dword [ebp - 0x1048]
mov ecx, eax
call fcn.00405a80
add esp, 4
mov edx, str.Samase_n
mov ecx, eax
call fcn.00404ae0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Map_Title_:
call fcn.004046a0
mov edx, dword [0x42a5e0]
mov ecx, eax
call fcn.004046a0
mov edx, 0x426750
mov ecx, eax
call fcn.00404ae0
mov eax, dword [0x42a5e0]
lea ecx, [ebp - 0x10f0]
mov dword [ebp - 0x1120], eax
lea eax, [ebp - 0x1048]
push eax
call fcn.00404900
add esp, 4
push str.data_samase_
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10d8]
call fcn.00404a10
add esp, 4
push 0x426640
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10c0]
call fcn.00404a10
add esp, 4
mov esi, eax
mov byte [ebp - 4], 6
lea edx, [ebp - 0x1048]
cmp dword [ebp - 0x1034], 7
mov ecx, dword [esi + 0x10]
cmova edx, dword [ebp - 0x1048]
mov eax, dword [esi + 0x14]
mov edi, dword [ebp - 0x1038]
sub eax, ecx
mov dword [ebp - 0x1138], ecx
cmp edi, eax
ja 0x403032
cmp dword [esi + 0x14], 7
lea eax, [edi + ecx]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [ebp - 0x1124], esi
jbe 0x40300b
mov eax, dword [esi]
mov dword [ebp - 0x1124], eax
lea ecx, [eax + ecx*2]
lea eax, [edi + edi]
push eax
push edx
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x1138]
add esp, 0xc
mov ecx, dword [ebp - 0x1124]
add eax, edi
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x403044
push edi
push edx
push dword [ebp - 0x1128]
mov ecx, esi
push edi
call fcn.004051f0
mov esi, eax
mov dword [ebp - 0x1068], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1078], xmm0
mov dword [ebp - 0x1064], 0
xor eax, eax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x1078], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x1068], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
or dword [ebp - 0x111c], 8
push str.dummy____map__
lea edx, [ebp - 0x1078]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10a8]
call fcn.00404a10
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1090]
push dword [ebp - 0x1120]
mov edx, eax
call fcn.00404a10
add esp, 4
push 0x426640
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1060]
call fcn.00404a10
add esp, 4
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x107c]
cmp ecx, 7
jbe 0x403127
mov edx, dword [ebp - 0x1090]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40311d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032fa
push ecx
push edx
call fcn.00407954
add esp, 8
xor eax, eax
mov dword [ebp - 0x1080], 0
mov dword [ebp - 0x107c], 7
mov word [ebp - 0x1090], ax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x1094]
cmp ecx, 7
jbe 0x403188
mov edx, dword [ebp - 0x10a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40317e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032fa
push ecx
push edx
call fcn.00407954
add esp, 8
xor eax, eax
mov dword [ebp - 0x1098], 0
mov dword [ebp - 0x1094], 7
mov word [ebp - 0x10a8], ax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x1064]
cmp ecx, 7
jbe 0x4031e9
mov edx, dword [ebp - 0x1078]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4031df
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032fa
push ecx
push edx
call fcn.00407954
add esp, 8
xor eax, eax
mov dword [ebp - 0x1068], 0
mov dword [ebp - 0x1064], 7
mov word [ebp - 0x1078], ax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10ac]
cmp ecx, 7
jbe 0x40324a
mov edx, dword [ebp - 0x10c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403240
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032fa
push ecx
push edx
call fcn.00407954
add esp, 8
xor eax, eax
mov dword [ebp - 0x10b0], 0
mov dword [ebp - 0x10ac], 7
mov word [ebp - 0x10c0], ax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10c4]
cmp ecx, 7
jbe 0x4032a7
mov edx, dword [ebp - 0x10d8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40329d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032fa
push ecx
push edx
call fcn.00407954
add esp, 8
xor eax, eax
mov dword [ebp - 0x10c8], 0
mov dword [ebp - 0x10c4], 7
mov word [ebp - 0x10d8], ax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x10dc]
cmp ecx, 7
jbe 0x40330a
mov edx, dword [ebp - 0x10f0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403300
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403300
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00407954
add esp, 8
mov edx, dword [0x42a5e0]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x10e0], 0
mov dword [ebp - 0x10dc], 7
mov word [ebp - 0x10f0], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403332
sub ecx, esi
mov dword [ebp - 0x1020], 0
sar ecx, 1
xorps xmm0, xmm0
push ecx
push edx
lea ecx, [ebp - 0x1030]
mov dword [ebp - 0x101c], 0
movups xmmword [ebp - 0x1030], xmm0
call fcn.00405370
mov eax, dword [ebp - 0x111c]
or eax, 6
or eax, 1
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x101c], 7
lea ecx, [ebp - 0x1110]
push 0xffffffffffffffff
mov dword [ebp - 0x111c], eax
mov dword [ebp - 0x1120], eax
lea eax, [ebp - 0x1030]
cmova eax, dword [ebp - 0x1030]
push 3
push ecx
push eax
call fcn.00407420
mov esi, eax
test esi, esi
jne 0x403406
mov edx, dword [ebp - 0x1100]
mov eax, 0x16d
test dl, 1
mov ecx, 0x1ff
cmovne ecx, eax
mov eax, edx
shr eax, 0xa
mov dword [ebp - 0x114c], ecx
test al, 1
je 0x4033f8
mov eax, dword [ebp - 0x10fc]
cmp eax, 0xa000000c
jne 0x4033ea
lea eax, [esi + 4]
jmp 0x40342f
cmp eax, 0xa0000003
jne 0x4033f8
mov eax, 0xa
jmp 0x40342f
shr edx, 4
movzx eax, dl
and eax, 1
or eax, 2
jmp 0x40342f
lea eax, [esi - 2]
mov dword [ebp - 0x114c], 0xffff
cmp eax, 0x79
ja case.0x40341f.4
movzx eax, byte [eax + 0x403f78]
jmp dword [eax*4 + 0x403f70]
mov eax, 1
jmp 0x40342f
xor eax, eax
mov dword [ebp - 0x1158], esi
mov dword [ebp - 0x1154], 0x42a0c0
test eax, eax
je 0x403491
cmp eax, 1
setne al
test al, al
je 0x403499
cmp dword [ebp - 0x104c], 7
lea ecx, [ebp - 0x1188]
push ecx
lea ecx, [ebp - 0x11d0]
push ecx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1060]
cmova eax, dword [ebp - 0x1060]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403499
mov byte [ebp - 0x1114], 1
jmp 0x4034a0
test esi, esi
jne 0x403f5b
mov byte [ebp - 0x1114], 0
mov dword [ebp - 4], 0x10
mov eax, dword [ebp - 0x111c]
test al, 1
je 0x4034f3
mov ecx, dword [ebp - 0x101c]
cmp ecx, 7
jbe 0x4034f3
mov edx, dword [ebp - 0x1030]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4034e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4034e9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00407954
add esp, 8
cmp byte [ebp - 0x1114], 0
je 0x403dbb
push 0xffffffffffffffff
push dword [ebp - 0x1188]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Samase_Process_ID:
call fcn.00404480
push dword [ebp - 0x1180]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edi, dword [0x42a77c]
mov esi, dword [0x42a778]
cmp esi, edi
je 0x40358b
nop dword [eax]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x4019f0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov edx, str.pids:
mov ecx, eax
call fcn.00404480
push dword [esi]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
add esi, 4
cmp esi, edi
jne 0x403550
xor edi, edi
mov dword [ebp - 0x111c], 0
xor esi, esi
mov dword [ebp - 0x1134], edi
xor ecx, ecx
mov dword [ebp - 0x1130], esi
mov dword [ebp - 0x112c], ecx
mov byte [ebp - 4], 0x12
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x1020], 0
push str.StarCraft.exe
lea ecx, [ebp - 0x1030]
mov dword [ebp - 0x101c], 0
movups xmmword [ebp - 0x1030], xmm0
call fcn.00405370
lea edx, [ebp - 0x1030]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1150]
call fcn.00406fc0
lea ecx, [ebp - 0x1134]
mov dword [ebp - 0x1120], eax
cmp ecx, eax
je 0x403678
test edi, edi
je 0x40364a
mov eax, dword [ebp - 0x112c]
sub eax, edi
sar eax, 2
lea ecx, [eax*4]
mov eax, edi
cmp ecx, 0x1000
jb 0x40363a
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032fa
push ecx
push edi
call fcn.00407954
mov eax, dword [ebp - 0x1120]
add esp, 8
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x1134], edi
mov dword [ebp - 0x1130], esi
mov dword [ebp - 0x112c], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x1150]
test ecx, ecx
je 0x4036da
mov eax, dword [ebp - 0x1148]
sub eax, ecx
sar eax, 2
lea edx, [eax*4]
mov eax, ecx
cmp edx, 0x1000
jb 0x4036b2
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032fa
push edx
push ecx
call fcn.00407954
add esp, 8
mov dword [ebp - 0x1150], 0
mov dword [ebp - 0x114c], 0
mov dword [ebp - 0x1148], 0
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x101c]
cmp ecx, 7
jbe 0x40371e
mov edx, dword [ebp - 0x1030]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403714
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032fa
push ecx
push edx
call fcn.00407954
add esp, 8
cmp edi, esi
jne 0x403746
lea ecx, [ebp - 0x1158]
mov dword [ebp - 0x1158], 0x64
mov dword [ebp - 0x1154], 0
call fcn.00404df0
jmp 0x4037d3
mov eax, dword [0x42a778]
mov esi, dword [0x42a77c]
cmp eax, esi
je 0x4037dd
mov edx, edi
mov dword [ebp - 0x1124], edi
mov cl, 1
cmp eax, esi
je 0x4037b1
mov edi, dword [edx]
nop dword [eax]
xor edx, edx
movzx ecx, cl
cmp edi, dword [eax]
cmovne edx, ecx
add eax, 4
mov cl, dl
cmp eax, esi
jne 0x403770
mov edx, dword [ebp - 0x1124]
test cl, cl
jne 0x4037b1
mov eax, dword [0x42a778]
add edx, 4
mov dword [ebp - 0x1124], edx
cmp edx, dword [ebp - 0x1130]
jne 0x403761
mov edi, dword [ebp - 0x1134]
mov esi, dword [ebp - 0x1130]
jmp 0x4037d3
mov eax, dword [edx]
mov esi, dword [ebp - 0x1130]
mov edi, dword [ebp - 0x1134]
mov dword [ebp - 0x111c], eax
mov eax, esi
sub eax, edi
sar eax, 2
push eax
push edi
call fcn.00404f80
cmp edi, esi
je 0x4035b1
jmp 0x403810
mov eax, dword [edi]
mov dword [ebp - 0x111c], eax
mov dword [ebp - 0x1120], eax
cmp esi, dword [0x42a780]
je 0x4037fe
mov dword [esi], eax
add dword [0x42a77c], 4
jmp 0x403810
lea eax, [ebp - 0x1120]
mov ecx, 0x42a778
push eax
push esi
call fcn.00405c70
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.StarCraft_Process_ID:
call fcn.004046a0
mov esi, dword [ebp - 0x111c]
mov ecx, eax
push esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push 0x4048d0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0x20001
push 0
push str.data_bnetclick.wav
call dword [sym.imp.WINMM.dll_PlaySoundW]
push esi
push 0
push 0x438
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
mov dword [ebp - 0x1120], ecx
test ecx, ecx
jne 0x40389c
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Failed_to_open_process._Error:
call fcn.00404480
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x1120]
lea eax, [ebp - 0x1128]
mov dword [0x42a784], ecx
push eax
push 0x1000
lea eax, [ebp - 0x1018]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x403903
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x405dd0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov edx, str.base:_0x
mov ecx, eax
call fcn.00404480
push dword [ebp - 0x1018]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [ebp - 0x1018]
mov dword [0x42a788], eax
cmp byte [ebp - 0x1118], 0
jne 0x403d63
lea ecx, [ebp - 0x1178]
call fcn.00401190
mov ecx, dword [0x42a784]
mov eax, dword [0x42a788]
test ecx, ecx
je 0x403999
test eax, eax
je 0x403999
lea edx, [ebp - 0x1120]
add eax, 0xdf93f5
push edx
push 1
lea edx, [ebp - 0x1138]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x403958
cmp dword [ebp - 0x1120], 1
je 0x403986
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_read_memory._Error:
call fcn.00404480
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, dword [ebp - 0x1138]
mov ecx, dword [0x42a784]
mov eax, dword [0x42a788]
jmp 0x40399b
xor edx, edx
test dl, 1
je 0x403a33
dec dl
mov byte [ebp - 0x1118], dl
test ecx, ecx
je 0x403aa3
test eax, eax
je 0x403a33
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea esi, [eax + 0xdf93f5]
push 0x405dd0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov edx, str.targetAddr::_0x
mov ecx, eax
call fcn.00404480
push esi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov edx, str._base:_0x
mov ecx, eax
call fcn.00404480
push dword [0x42a788]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea eax, [ebp - 0x1154]
push eax
push 1
lea eax, [ebp - 0x1118]
push eax
push esi
push dword [0x42a784]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x42a784]
mov eax, dword [0x42a788]
test ecx, ecx
je 0x403aa3
test eax, eax
je 0x403aa3
lea edx, [ebp - 0x1124]
add eax, 0xbd069c
push edx
push 2
lea edx, [ebp - 0x115c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x403a65
cmp dword [ebp - 0x1124], 2
je 0x403a93
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_read_memory._Error:
call fcn.00404480
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [ebp - 0x115c]
cmp ax, 1
ja 0x403b5f
push dword [ebp - 0x111c]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x1128], esi
test esi, esi
je 0x403ca0
lea eax, [ebp - 0x113c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x403c64
cmp dword [ebp - 0x113c], 0x103
push esi
sete byte [ebp - 0x1114]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x1114], 0
je 0x403cce
lea ecx, [ebp - 0x1170]
call fcn.00401190
mov ecx, dword [ebp - 0x1170]
sub ecx, dword [ebp - 0x1178]
mov eax, dword [ebp - 0x116c]
sbb eax, dword [ebp - 0x1174]
cmp eax, 1
jg 0x403c5d
jl 0x403b3b
cmp ecx, 0x65a0bc00
jae 0x403c5d
lea ecx, [ebp - 0x1150]
mov dword [ebp - 0x1150], 0x64
mov dword [ebp - 0x114c], 0
call fcn.00404df0
jmp 0x403910
cmp dword [0x42a784], 0
mov byte [ebp - 0x1114], 0xff
je 0x403c2a
mov esi, dword [0x42a788]
test esi, esi
je 0x403c2a
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esi, 0xdcc7cc
push 0x405dd0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov edx, str.targetAddr::_0x
mov ecx, eax
call fcn.00404480
push esi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov edx, str._base:_0x
mov ecx, eax
call fcn.00404480
push dword [0x42a788]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea eax, [ebp - 0x113c]
push eax
push 1
lea eax, [ebp - 0x1114]
push eax
push esi
push dword [0x42a784]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x403c02
cmp dword [ebp - 0x113c], 4
jne 0x403c02
mov al, 1
jmp 0x403c04
xor al, al
test al, al
je 0x403c2a
mov edx, str.Memory_written_successfully.
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00404480
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x403d63
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Failed_to_write_memory:
call fcn.00404480
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x403d63
mov edx, str.Exiting_loop_after_5_seconds.
jmp 0x403c0d
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_get_exit_code._Error:
call fcn.00404480
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [ebp - 0x1128]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403cce
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_open_process._Error:
call fcn.00404480
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x404dc0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [0x42a77c]
mov edx, eax
mov ecx, dword [0x42a778]
mov esi, ecx
mov dword [ebp - 0x1128], edx
cmp esi, edx
je 0x403d39
mov edi, dword [ebp - 0x111c]
nop dword [eax]
push edi
push eax
push ecx
call fcn.004072e0
mov edx, eax
mov eax, dword [0x42a77c]
cmp edx, eax
je 0x403d20
lea ecx, [edx + 4]
sub eax, ecx
push eax
push ecx
push edx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [0x42a77c]
add esp, 0xc
sub eax, 4
mov dword [0x42a77c], eax
add esi, 4
cmp esi, dword [ebp - 0x1128]
je 0x403d33
mov ecx, dword [0x42a778]
jmp 0x403cf0
mov edi, dword [ebp - 0x1134]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.process_terminated
call fcn.00404480
push dword [ebp - 0x111c]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x426750
mov ecx, eax
call fcn.00404480
push dword [ebp - 0x1184]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1188]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x403e4c
mov ecx, dword [ebp - 0x112c]
mov eax, edi
sub ecx, edi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x403dac
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403f2b
push ecx
push edi
call fcn.00407954
add esp, 8
jmp 0x403e4c
push 0x20001
push 0
push str.data_buzz.wav
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Error_CreatProcessW_command:
call fcn.004046a0
cmp dword [ebp - 0x104c], 7
lea edx, [ebp - 0x1060]
push dword [ebp - 0x1050]
cmova edx, dword [ebp - 0x1060]
mov ecx, eax
call fcn.00405a80
add esp, 4
mov ecx, eax
push 0x4048d0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Error_code_:
call fcn.004046a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push 0x4048d0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.error_creating_process
call fcn.00404480
mov ecx, dword [ebp - 0x104c]
xor esi, esi
cmp ecx, 7
jbe 0x403e8e
mov edx, dword [ebp - 0x1060]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403e84
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403f2b
push ecx
push edx
call fcn.00407954
add esp, 8
mov ecx, dword [ebp - 0x1034]
xor eax, eax
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x104c], 7
mov word [ebp - 0x1060], ax
cmp ecx, 7
jbe 0x403ee3
mov edx, dword [ebp - 0x1048]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403ed9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403f2b
push ecx
push edx
call fcn.00407954
add esp, 8
xor eax, eax
mov dword [ebp - 0x1038], esi
mov dword [ebp - 0x1034], 7
mov word [ebp - 0x1048], ax
mov edx, dword [ebp - 0x1168]
test edx, edx
je 0x403f3b
mov ecx, dword [ebp - 0x1160]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x403f31
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403f31
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00407954
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004076c0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [ebp - 0x1030]
push eax
lea edx, [ebp - 0x1158]
call fcn.00402330
nop dword [eax]
xor al, 0x40
add byte [16436], ch
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add ah, cl
int3