Function at 0x100061d0
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Delete file
Execute shellcode via indirect call
Get file attributes
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10009480
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x998
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8cc], edx
mov dword [ebp - 0x9a0], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebx + 0x14]
push 0x410
mov dword [ebp - 0x9a8], eax
lea eax, [ebp - 0x460]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x460]
call fcn.100080b0
test al, al
jne 0x10006267
mov eax, 0x10300001
jmp 0x1000694f
mov ecx, 0x104
lea esi, [ebp - 0x460]
lea edi, [ebp - 0x870]
rep movsd dword es:[edi], dword [esi]
push str.SWHEX86.txt
lea ecx, [ebp - 0x870]
call fcn.100031a0
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100062a9
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xb0
lea eax, [ebp - 0x998]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x870]
push eax
lea ecx, [ebp - 0x998]
call fcn.10007680
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x998]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x98c], 2
je 0x1000631a
lea ecx, [ebp - 0x994]
call fcn.10007ae0
test eax, eax
jne 0x10006310
mov eax, dword [ebp - 0x998]
lea ecx, [ebp - 0x998]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool_]
mov esi, 0x10300002
jmp 0x100068a2
mov edi, dword [ebp - 0x9a0]
push 0x40
push 0x3000
push 0x1000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 0x9a4], esi
test esi, esi
jne 0x10006380
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x99c]
mov dword [ecx], eax
lea ecx, [ebp - 0x994]
call fcn.10007ae0
test eax, eax
jne 0x10006376
mov eax, dword [ebp - 0x998]
lea ecx, [ebp - 0x998]
push esi
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool_]
mov esi, 0x10300003
jmp 0x100068a2
lea eax, [ebp - 0x8d8]
mov dword [ebp - 0x8d8], 0
push eax
push str.CallNextHookEx
mov edx, str.user32.dll
mov ecx, edi
call fcn.10001a40
mov eax, dword [ebp - 0x8d8]
add esp, 8
test eax, eax
jne 0x100063c7
push 0x8000
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300004
jmp 0x100068a2
mov ecx, dword [ebp - 0x8d4]
sub eax, esi
push 0
sub eax, 0x1b
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x8cc]
push 0x35
mov dword [ebp - 0x35], eax
lea eax, [ebp - 0x4c]
push eax
push esi
push edi
mov dword [ebp - 0x44], 0xffec8b55
mov dword [ebp - 0x40], 0x75ff1075
mov dword [ebp - 0x3c], 0x875ff0c
mov word [ebp - 0x38], 0x6a
mov byte [ebp - 0x36], 0xe8
mov dword [ebp - 0x31], 0x535000eb
mov byte [ebp - 0x2d], 0xbb
mov dword [ebp - 0x28], 0x141c43c6
mov dword [ebp - 0x24], 0x53ff33ff
mov dword [ebp - 0x20], 0x5b038904
mov dword [ebp - 0x1c], 0xcc25d58
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10006469
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x99c]
push 0x8000
push 0
push esi
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300005
jmp 0x100068a2
push 0x10008090
lea ecx, [ebp - 0x998]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call fcn.10007bc0
push 0x10008070
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov esi, dword [ebp - 0x9a4]
lea ecx, [esi + 8]
push ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push 0x10007e30
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, [ebp - 0x994]
call fcn.10007ae0
test eax, eax
jne 0x100064e7
mov eax, dword [ebp - 0x998]
lea ecx, [ebp - 0x998]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool_]
push str.GH_Injector_SWHEX___x86.exe
lea ecx, [ebp - 0x460]
call fcn.100031a0
mov ecx, dword [ebx + 0x10]
xorps xmm0, xmm0
xor eax, eax
movlpd qword [ebp - 0x8c4], xmm0
movlpd qword [ebp - 0x8bc], xmm0
movlpd qword [ebp - 0x8b4], xmm0
movlpd qword [ebp - 0x8ac], xmm0
movlpd qword [ebp - 0x8a4], xmm0
movlpd qword [ebp - 0x896], xmm0
movlpd qword [ebp - 0x88e], xmm0
mov word [ebp - 0x886], ax
mov dword [ebp - 0x8c8], 0x44
mov dword [ebp - 0x89c], 1
mov word [ebp - 0x898], ax
movups xmmword [ebp - 0x8e8], xmm0
cmp ecx, 0xffffffff
je 0x10006767
mov dword [ebp - 0x8d0], eax
lea eax, [ebp - 0x8d0]
push eax
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x100065a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x99c]
push 0x8000
push 0
push esi
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300006
jmp 0x100068a2
lea eax, [ebp - 0x8cc]
mov dword [ebp - 0x8cc], 0
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x8d0]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x10006607
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x99c]
push dword [ebp - 0x8d0]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300007
jmp 0x100068a2
lea eax, [ebp - 0x87c]
mov dword [ebp - 0x87c], 0
push eax
push 4
lea eax, [ebp - 0x8d4]
mov dword [ebp - 0x8d4], 0
push eax
push 0x13
push dword [ebp - 0x8cc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x10006680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x99c]
push dword [ebp - 0x8cc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ecx], eax
call esi
push dword [ebp - 0x8d0]
call esi
mov esi, dword [ebp - 0x9a4]
push 0x8000
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300008
jmp 0x100068a2
mov eax, dword [ebp - 0x8d4]
lea ecx, [ebp - 0x8e8]
push ecx
lea ecx, [ebp - 0x8c8]
mov dword [ebp - 0x9a0], eax
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x460]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10006708
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x99c]
push dword [ebp - 0x9a0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ecx], eax
call esi
push dword [ebp - 0x8cc]
call esi
push dword [ebp - 0x8d0]
call esi
mov esi, dword [ebp - 0x9a4]
push 0x8000
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300009
jmp 0x100068a2
push dword [ebp - 0x9a0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x8cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x8d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7d0
push dword [ebp - 0x8e8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100067be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x99c]
push 0
push dword [ebp - 0x8e8]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, 0x1030000a
jmp 0x100068a2
lea eax, [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x8c8]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1000672c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x99c]
push 0x8000
push 0
push esi
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10300009
jmp 0x100068a2
lea eax, [ebp - 0x878]
mov dword [ebp - 0x878], 0
push eax
push dword [ebp - 0x8e8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x8e8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x8e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x878], 0
je 0x10006816
push 0x8000
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, dword [ebp - 0x878]
jmp 0x100068a2
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x87c], eax
lea eax, [esi + 0x1c]
mov dword [ebp - 0x9a0], edx
mov byte [ebp - 0x871], 0
push 0
push 1
lea ecx, [ebp - 0x871]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x87c]
sbb edx, dword [ebp - 0x9a0]
test edx, edx
ja 0x1000689d
jb 0x1000686c
cmp eax, 0x7d0
ja 0x1000689d
cmp byte [ebp - 0x871], 0
lea eax, [esi + 0x1c]
je 0x10006832
push 0
push 4
push dword [ebp - 0x9a8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x8000
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor esi, esi
jmp 0x100068a2
mov esi, 0x1030000b
mov eax, dword [ebp - 0x998]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x998]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x99c], eax
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x948], 0
mov dword [ebp - method.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
je 0x10006915
mov eax, dword [ebp - 0x988]
lea ecx, [ebp - 0x958]
cmp dword [eax], ecx
jne 0x10006915
mov edx, dword [ebp - 0x940]
mov ecx, dword [ebp - 0x944]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x978]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [ebp - 0x968]
mov dword [eax], edx
cmp byte [ebp - 0x94c], 0
je 0x10006929
lea ecx, [ebp - 0x994]
call fcn.10007ae0
lea ecx, [ebp - 0x994]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x990]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x930]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10008286
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret