Function at 0x401000
Capabilities:
Create process on windows
Create thread
Get system information on windows
Inject dll
Inject thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4b8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x4b4], eax
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov dword [esp + 0x90], 0
mov esi, eax
movaps xmmword [esp + 0x70], xmm0
lea eax, [esp + 0x70]
movaps xmmword [esp + 0x80], xmm0
push eax
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
mov dword [esp + 0x2c], 0x44
movaps xmmword [esp + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x104
lea eax, [esp + 0x2b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.elementclient.bin
lea eax, [esp + 0x2b4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x4000004
push 0
push 0
push 0
push 0x403198
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40136f
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov dword [esp + 8], eax
lea eax, [esp + 0xa8]
push 0x104
push eax
push esi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.elementplugin.dll
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [esp + 0x18]
push 0
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40119f
push 0x4016a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Falha_ao_abrir_o_processo_remoto:
push eax
call fcn.00401470
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [esp + 8]
call esi
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x4b4]
xor ecx, esp
call fcn.00401987
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xa8]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4011b0
sub ecx, edx
sar ecx, 1
push 4
push 0x1000
lea eax, [ecx*2 + 2]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x401238
push 0x4016a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Falha_ao_alocar_mem
push eax
call fcn.00401470
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov edi, dword [esp + 0xc]
push edi
call esi
push dword [esp + 8]
call esi
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x4b4]
xor ecx, esp
call fcn.00401987
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xa8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401242
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0xb0]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4012d9
push 0x4016a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Falha_ao_escrever_o_caminho_da_DLL_no_processo_remoto:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
push eax
call fcn.00401470
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov edi, dword [esp + 0xc]
push edi
call esi
push dword [esp + 8]
call esi
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x4b4]
xor ecx, esp
call fcn.00401987
mov esp, ebp
pop ebp
ret
push str.LoadLibraryW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401309
push 0x4016a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Falha_ao_obter_o_endere
jmp 0x40127f
push 0
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x401333
push 0x4016a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Falha_ao_criar_thread_remota:
jmp 0x40127f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [esp + 8]
call esi
mov edx, str.PROCESSO_INICIADO___OK__
jmp 0x401374
mov edx, str.Falha_ao_criar_o_processo
push 0x4018f0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004016d0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [esp + 0x4bc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00401987
mov esp, ebp
pop ebp
ret