Function at 0x429270
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Inject apc

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481cc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push ebx
push esi
push edi
push str.Begin_SR_QueueUserAPC_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
add esp, 8
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
push 0x40
push 0x3000
push 0x48
push 0
push edi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0x53e58955
mov dword [ebp - 0x48], 0x85085d8b
mov dword [ebp - 0x44], 0x832074db
mov dword [ebp - 0x40], 0x1b75003b
mov dword [ebp - 0x3c], 0xff0103c6
mov dword [ebp - 0x38], 0x53ff0c73
mov dword [ebp - 0x34], 0x4438910
mov dword [ebp - 0x30], 0x18a164
mov dword [ebp - 0x2c], 0x408b0000
mov dword [ebp - 0x28], 0x8438934
mov dword [ebp - 0x24], 0x5b0203c6
mov dword [ebp - 0x20], 0x4c25d
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x4293e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x66
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_QueueUserAPC
call esi
add eax, eax
push eax
push str.SR_QueueUserAPC
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.VirtualAllocEx_failed:__08X_n
push 2
call fcn.00428a80
add esp, 0x18
mov eax, 0x10400002
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
lea esi, [ebx + 0x18]
push ebx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
push str.Codecave_allocated_at__p_n
push 2
mov dword [ebp - 0x54], eax
call fcn.00428a80
add esp, 0xc
lea eax, [ebp - 0x64]
push 0
push 0x48
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4294df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x78
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_QueueUserAPC
call esi
add eax, eax
push eax
push str.SR_QueueUserAPC
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.WriteProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
mov eax, dword [ebp + 8]
add esp, 0x18
push 0x8000
push 0
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
pop esi
mov eax, 0x10400003
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push str.Queueing_APCs_with:_n
push 2
call fcn.00428a80
push esi
push str.pRoutine___p_n
push 3
call fcn.00428a80
push ebx
push str.pArg_______p_n
push 3
call fcn.00428a80
add esp, 0x20
lea ecx, [ebp - 0xb8]
call fcn.00428a90
push edi
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 0
call fcn.004291d0
test al, al
jne 0x4295e0
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push edi
mov dword [esi + 0x414], 0x88
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_QueueUserAPC
call esi
add eax, eax
push eax
push str.SR_QueueUserAPC
push ebx
call sub.VCRUNTIME140.dll_memcpy
push str.Cant_initialize_ProcessInfo_class_n
push 2
call fcn.00428a80
mov eax, dword [ebp + 8]
add esp, 0x14
push 0x8000
push 0
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10400004
jmp 0x4299cc
xor al, al
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xb8]
call fcn.00428ea0
test al, al
je 0x42969f
cmp dword [ebp - 0x18], 0xf
je 0x42969f
lea ecx, [ebp - 0xb8]
call fcn.00429020
test al, al
jne 0x42969f
lea ecx, [ebp - 0xb8]
call fcn.00428ed0
test al, al
jne 0x429632
cmp dword [ebp - 0x1c], 2
jne 0x42969f
lea ecx, [ebp - 0xb8]
call fcn.00428e90
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x42969f
lea ecx, [ebp - 0xb8]
call fcn.00428e90
mov edi, eax
push edi
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x42969f
push ebx
push esi
lea eax, [ebx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
je 0x429698
push edi
push str.APC_queued_to_thread__06X_n
push 2
call fcn.00428a80
add esp, 0xc
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov byte [ebp - 0xd], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xb8]
call fcn.004290d0
test al, al
jne 0x4295e5
cmp byte [ebp - 0xd], al
jne 0x42976d
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push edi
mov dword [esi + 0x414], 0xb4
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_QueueUserAPC
call esi
add eax, eax
push eax
push str.SR_QueueUserAPC
push ebx
call sub.VCRUNTIME140.dll_memcpy
push str.No_compatible_thread_found_n
push 2
call fcn.00428a80
mov eax, dword [ebp + 8]
add esp, 0x14
push 0x8000
push 0
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10400005
jmp 0x4299cc
push str.Entering_wait_state_n
push 2
call fcn.00428a80
add esp, 8
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
call edi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
call edi
sub eax, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x18]
test edx, edx
ja 0x429827
jb 0x4297d1
cmp eax, esi
jae 0x429827
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop word [eax + eax]
push 0xa
push dword [0x7ab4e8]
call edi
push 0
push 0x18
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4298e3
cmp dword [ebp - 0x7c], 2
je 0x4298cf
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x18]
test edx, edx
ja 0x429827
jb 0x4297e0
cmp eax, esi
jb 0x4297e0
cmp dword [ebp - 0x7c], 2
je 0x4299b0
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push edi
mov dword [esi + 0x414], 0xf2
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_QueueUserAPC
call esi
add eax, eax
push eax
push str.SR_QueueUserAPC
push ebx
call sub.VCRUNTIME140.dll_memcpy
push str.Shell_timed_out_n
push 2
call fcn.00428a80
add esp, 0x14
mov esi, 0x10400006
jmp 0x4299cc
push str.Shelldata_retrieved_n
push 2
call fcn.00428a80
add esp, 8
jmp 0x429827
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0xd7
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryQueueUserAPC.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_QueueUserAPC
call esi
add eax, eax
push eax
push str.SR_QueueUserAPC
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x429995
push str.Interrupt__n
push 2
call fcn.00428a80
add esp, 8
push dword [0x7ab4ec]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, 0x10000004
jmp 0x4299cc
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.ReadProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
add esp, 0xc
mov esi, 0x10400007
jmp 0x4299cc
push dword [ebp - 0x78]
push str.pRoutine_returned:__08X_n
push 2
call fcn.00428a80
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov eax, dword [ebp - 0x78]
xor esi, esi
mov dword [ecx], eax
lea ecx, [ebp - 0xb8]
call fcn.00428c10
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret