Function at 0x466d80
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cead6
mov eax, dword fs:[0]
push eax
mov eax, 0x1660
call fcn.005c9b00
mov eax, dword [0x658c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1518], 0
push str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea ecx, [ebp - 0x12c]
call fcn.0045c2c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1531]
call fcn.00463720
push eax
lea ecx, [ebp - 0x1514]
call fcn.0045d100
nop
lea eax, [ebp - 0x1624]
push eax
lea ecx, [ebp - 0x12c]
call fcn.0046ff60
mov ecx, dword [eax]
mov dword [ebp - 0x15f8], ecx
lea edx, [ebp - 0x1640]
push edx
lea ecx, [ebp - 0x12c]
call fcn.0046d770
mov eax, dword [eax]
mov dword [ebp - 0x1604], eax
lea ecx, [ebp - 0x1514]
push ecx
mov edx, dword [ebp - 0x15f8]
push edx
mov eax, dword [ebp - 0x1604]
push eax
call fcn.00459ba0
add esp, 0xc
push 1
push str.SeDebugPrivilege
call fcn.00468b40
add esp, 8
push 0x5d3810
lea ecx, [ebp - 0x18c]
call fcn.0045c2c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18c]
call fcn.0046da70
mov dword [ebp - 0x1538], eax
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x1524], ecx
mov edx, dword [ebp - 0x1524]
mov dword [ebp - 0x1644], edx
mov eax, dword [ebp - 0x1538]
mov cl, byte [eax]
mov byte [ebp - 0x1519], cl
mov edx, dword [ebp - 0x1524]
mov al, byte [ebp - 0x1519]
mov byte [edx], al
mov ecx, dword [ebp - 0x1538]
add ecx, 1
mov dword [ebp - 0x1538], ecx
mov edx, dword [ebp - 0x1524]
add edx, 1
mov dword [ebp - 0x1524], edx
cmp byte [ebp - 0x1519], 0
jne 0x466e85
push 0x5c
call fcn.005c94a9
add esp, 4
mov dword [ebp - 0x154c], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x154c], 0
je 0x466f8a
push str.Love
lea ecx, [ebp - 0x174]
call fcn.0045c2c0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1518]
or eax, 1
mov dword [ebp - 0x1518], eax
push str.DeviceLove
lea ecx, [ebp - 0x15c]
call fcn.0045c2c0
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x1518]
or ecx, 2
mov dword [ebp - 0x1518], ecx
push str.Love.sys
lea ecx, [ebp - 0x144]
call fcn.0045c2c0
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x1518]
or edx, 4
mov dword [ebp - 0x1518], edx
push 0x2f70
push 0x5d3bc8
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x15c]
push ecx
lea edx, [ebp - 0x144]
push edx
mov ecx, dword [ebp - 0x154c]
call fcn.0045dea0
mov dword [ebp - 0x1550], eax
jmp 0x466f94
mov dword [ebp - 0x1550], 0
mov eax, dword [ebp - 0x1550]
mov dword [ebp - 0x1608], eax
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x1608]
mov dword [0x65af40], ecx
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x1518]
and edx, 4
je 0x466fd8
and dword [ebp - 0x1518], 0xfffffffb
lea ecx, [ebp - 0x144]
call fcn.00460c70
nop
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x1518]
and eax, 2
je 0x466ffd
and dword [ebp - 0x1518], 0xfffffffd
lea ecx, [ebp - 0x15c]
call fcn.00460c70
nop
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x1518]
and ecx, 1
je 0x467022
and dword [ebp - 0x1518], 0xfffffffe
lea ecx, [ebp - 0x174]
call fcn.00460c70
nop
mov ecx, dword [0x65af40]
call fcn.00467b30
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00476d40
mov dword [ebp - 0x152c], eax
push 0x5d3840
mov edx, dword [ebp - 0x152c]
push edx
call fcn.004667a0
add esp, 8
mov dword [ebp - 0x1530], eax
cmp dword [ebp - 0x1530], 0
je 0x4672f3
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 0x1618], eax
push 0x5d384c
lea ecx, [ebp - 0x164c]
push ecx
call fcn.0045a150
add esp, 8
mov dword [ebp - 0x160c], eax
mov edx, dword [ebp - 0x160c]
mov dword [ebp - 0x1610], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x1610]
mov dword [ebp - 0x1614], eax
mov ecx, dword [ebp - 0x1614]
push ecx
mov edx, dword [ebp - 0x1618]
push edx
call fcn.0044a990
add esp, 8
mov dword [ebp - 0x1558], eax
push 0x454220
mov ecx, dword [ebp - 0x1558]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x164c]
call fcn.00460cd0
nop
mov eax, dword [ebp - 0x152c]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1540], eax
cmp dword [ebp - 0x1540], 0
jne 0x467194
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 0x1568], ecx
push 0x5d3878
lea edx, [ebp - 0x1654]
push edx
call fcn.00456ff0
add esp, 8
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x155c]
mov dword [ebp - 0x1560], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1560]
mov dword [ebp - 0x1564], ecx
mov edx, dword [ebp - 0x1564]
push edx
mov eax, dword [ebp - 0x1568]
push eax
call fcn.0044a990
add esp, 8
mov dword [ebp - 0x156c], eax
push 0x454220
mov ecx, dword [ebp - 0x156c]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1654]
call fcn.00460cd0
nop
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
push 0
push 0
mov ecx, dword [ebp - 0x1530]
push ecx
mov edx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edx
push 0
push 0
mov eax, dword [ebp - 0x1540]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x153c], eax
cmp dword [ebp - 0x153c], 0
je 0x467267
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x153c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x153c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 0x157c], eax
push 0x5d389c
lea ecx, [ebp - 0x165c]
push ecx
call fcn.0045a150
add esp, 8
mov dword [ebp - 0x1570], eax
mov edx, dword [ebp - 0x1570]
mov dword [ebp - 0x1574], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x1578], eax
mov ecx, dword [ebp - 0x1578]
push ecx
mov edx, dword [ebp - 0x157c]
push edx
call fcn.0044a990
add esp, 8
mov dword [ebp - 0x1580], eax
push 0x454220
mov ecx, dword [ebp - 0x1580]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x165c]
call fcn.00460cd0
nop
jmp 0x4672e5
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 0x1590], eax
push 0x5d38bc
lea ecx, [ebp - 0x1664]
push ecx
call fcn.00456ff0
add esp, 8
mov dword [ebp - 0x1584], eax
mov edx, dword [ebp - 0x1584]
mov dword [ebp - 0x1588], edx
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x1588]
mov dword [ebp - 0x158c], eax
mov ecx, dword [ebp - 0x158c]
push ecx
mov edx, dword [ebp - 0x1590]
push edx
call fcn.0044a990
add esp, 8
mov dword [ebp - 0x1594], eax
push 0x454220
mov ecx, dword [ebp - 0x1594]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1664]
call fcn.00460cd0
nop
mov eax, dword [ebp - 0x1540]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [ebp - 0x152c]
mov dword [0x65af4c], ecx
cmp dword [0x65af4c], 0
jne 0x46731a
push str.Process_ID_not_found
push str.ProcessID
call fcn.00465f30
add esp, 8
push 0
push 0x65af60
push 0x104
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov dword [ebp - 0x1554], eax
cmp dword [ebp - 0x1554], 0
jne 0x467354
push 0x5d27ae
push 0x5d3918
call fcn.00465f30
add esp, 8
cmp dword [ebp - 0x1554], 0x104
jbe 0x467372
push str.Path_Length_too_short
push str.GetFullPathName
call fcn.00465f30
add esp, 8
push 0x65af60
call fcn.00466190
add esp, 4
test eax, eax
jne 0x467395
push str.Dll_to_inject_does_not_exist
push str.FileExists
call fcn.00465f30
add esp, 8
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [0x65af4c]
push ecx
call fcn.00466a20
add esp, 8
test eax, eax
je 0x4673c1
push str.Dll_already_injected
push str.GrabModule
call fcn.00465f30
add esp, 8
mov edx, dword [0x65af4c]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1520], eax
cmp dword [ebp - 0x1520], 0
jne 0x4673f6
push 0x5d27af
push 0x5d39a0
call fcn.00465f30
add esp, 8
push 0x40
push 0x3000
push 0x104
push 0
mov eax, dword [ebp - 0x1520]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x1528], eax
cmp dword [ebp - 0x1528], 0
jne 0x467432
push 0x5d27c9
push 0x5d39ac
call fcn.00465f30
add esp, 8
push 0
push 0x104
push 0x65af60
mov ecx, dword [ebp - 0x1528]
push ecx
mov edx, dword [ebp - 0x1520]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x467468
push 0x5d27ca
push 0x5d39bc
call fcn.00465f30
add esp, 8
push 0
push 0
mov eax, dword [ebp - 0x1528]
push eax
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x1520]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x1598], eax
cmp dword [ebp - 0x1598], 0
jne 0x4674ac
push 0x5d27cb
push 0x5d39d0
call fcn.00465f30
add esp, 8
mov eax, dword [ebp - 0x1520]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov ecx, dword [ebp - 0x1528]
push ecx
mov edx, dword [ebp - 0x1520]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 0x15a8], eax
push str.___DLL_Successfully_Injected.
lea ecx, [ebp - 0x1620]
push ecx
call fcn.004550d0
add esp, 8
mov dword [ebp - 0x159c], eax
mov edx, dword [ebp - 0x159c]
mov dword [ebp - 0x15a0], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x15a0]
mov dword [ebp - 0x15a4], eax
mov ecx, dword [ebp - 0x15a4]
push ecx
mov edx, dword [ebp - 0x15a8]
push edx
call fcn.0044a990
add esp, 8
mov dword [ebp - 0x15ac], eax
push 0x454220
mov ecx, dword [ebp - 0x15ac]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1620]
call fcn.00460cd0
nop
cmp dword [ebp - 0x1530], 0
je 0x4677ec
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 0x15bc], eax
push str.___DLL_is_already_injected._Unloading...
lea ecx, [ebp - 0x166c]
push ecx
call fcn.0045a150
add esp, 8
mov dword [ebp - 0x15b0], eax
mov edx, dword [ebp - 0x15b0]
mov dword [ebp - 0x15b4], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x15b4]
mov dword [ebp - 0x15b8], eax
mov ecx, dword [ebp - 0x15b8]
push ecx
mov edx, dword [ebp - 0x15bc]
push edx
call fcn.0044a990
add esp, 8
mov dword [ebp - 0x15c0], eax
push 0x454220
mov ecx, dword [ebp - 0x15c0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x166c]
call fcn.00460cd0
nop
mov eax, dword [ebp - 0x152c]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1548], eax
cmp dword [ebp - 0x1548], 0
jne 0x46768d
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 0x15d0], ecx
push str.____Unable_to_open_target_process_
lea edx, [ebp - 0x162c]
push edx
call fcn.00456ff0
add esp, 8
mov dword [ebp - 0x15c4], eax
mov eax, dword [ebp - 0x15c4]
mov dword [ebp - 0x15c8], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x15c8]
mov dword [ebp - 0x15cc], ecx
mov edx, dword [ebp - 0x15cc]
push edx
mov eax, dword [ebp - 0x15d0]
push eax
call fcn.0044a990
add esp, 8
mov dword [ebp - 0x15d4], eax
push 0x454220
mov ecx, dword [ebp - 0x15d4]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x162c]
call fcn.00460cd0
nop
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
push 0
push 0
mov ecx, dword [ebp - 0x1530]
push ecx
mov edx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edx
push 0
push 0
mov eax, dword [ebp - 0x1548]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x1544], eax
cmp dword [ebp - 0x1544], 0
je 0x467760
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1544]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x1544]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 0x15e4], eax
push str.___DLL_Successfully_Unloaded.
lea ecx, [ebp - 0x1634]
push ecx
call fcn.0045a150
add esp, 8
mov dword [ebp - 0x15d8], eax
mov edx, dword [ebp - 0x15d8]
mov dword [ebp - 0x15dc], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], eax
mov ecx, dword [ebp - 0x15e0]
push ecx
mov edx, dword [ebp - 0x15e4]
push edx
call fcn.0044a990
add esp, 8
mov dword [ebp - 0x15e8], eax
push 0x454220
mov ecx, dword [ebp - 0x15e8]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1634]
call fcn.00460cd0
nop
jmp 0x4677de
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [ebp - 0x1600], eax
push str.____Failed_to_create_remote_thread_for_unloading_DLL_
lea ecx, [ebp - 0x163c]
push ecx
call fcn.00456ff0
add esp, 8
mov dword [ebp - 0x15ec], eax
mov edx, dword [ebp - 0x15ec]
mov dword [ebp - 0x15f0], edx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15f4], eax
mov ecx, dword [ebp - 0x15f4]
push ecx
mov edx, dword [ebp - 0x1600]
push edx
call fcn.0044a990
add esp, 8
mov dword [ebp - 0x15fc], eax
push 0x454220
mov ecx, dword [ebp - 0x15fc]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x163c]
call fcn.00460cd0
nop
mov eax, dword [ebp - 0x1548]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
call fcn.004688c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18c]
call fcn.00460c70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00460c70
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9818
mov esp, ebp
pop ebp
ret