Function at 0x422740
Capabilities:
Check os version
Get number of processors

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43aff0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x1f0
push esi
push edi
mov edi, ecx
mov eax, 0x7ffffffe
mov ecx, dword [0x4551ec]
sub eax, ecx
mov dword [ebp - 0x34], ecx
cmp eax, 0xe
jb 0x42303d
cmp dword [0x4551f0], 8
mov eax, 0x4551dc
mov esi, 7
mov dword [ebp - 0x3c], 0
cmovae eax, dword [0x4551dc]
xorps xmm0, xmm0
add ecx, 0xe
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x4c], xmm0
cmp ecx, esi
jbe 0x422802
mov esi, ecx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x4227e3
mov esi, 0x7ffffffe
jmp 0x4227ed
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040d6a0
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x38], esi
mov esi, dword [ebp - 0x34]
add esi, esi
mov dword [ebp - 0x3c], ecx
push esi
push dword [ebp - 0x14]
push eax
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.GH_Inj_Log.txt]
mov ecx, dword [ebp - 0x30]
xor edx, edx
add esp, 0xc
movups xmmword [esi + ecx], xmm0
movq xmm0, qword [0x44a968]
movq qword [esi + ecx + 0x10], xmm0
mov eax, dword [0x44a970]
mov dword [esi + ecx + 0x18], eax
mov eax, dword [ebp - 0x34]
mov word [ecx + eax*2 + 0x1c], dx
push edx
mov dword [ebp - 4], edx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x84], edx
push eax
lea eax, [ebp - 0x1c4]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
push 0x3c
lea eax, [ebp - 0x200]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
lea eax, [ebp - 0x1c4]
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x200]
push 0x1e
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
mov eax, dword [0x459a14]
add esp, 0x10
cmp eax, 0x4563
jg 0x422945
je 0x42293e
cmp eax, 0x3839
jg 0x422914
je 0x42290a
cmp eax, 0x2800
jg 0x4228f5
je 0x4228eb
cmp eax, 0x1db1
je 0x4228e1
cmp eax, 0x2580
jne 0x422999
push 0x44aeb0
jmp 0x4229a5
push str.1507
jmp 0x4229a5
cmp eax, 0x295a
jne 0x422999
push str.1511
jmp 0x4229a5
push str.1607
jmp 0x4229a5
cmp eax, 0x3ad7
je 0x422937
cmp eax, 0x3fab
je 0x422930
cmp eax, 0x42ee
jne 0x422999
push str.1803
jmp 0x4229a5
push str.1709
jmp 0x4229a5
push str.1703
jmp 0x4229a5
push str.1809
jmp 0x4229a5
cmp eax, 0x4a61
jg 0x42296f
je 0x422968
sub eax, 0x47ba
je 0x422961
sub eax, 1
jne 0x422999
push str.1909
jmp 0x4229a5
push str.1903
jmp 0x4229a5
push str.2004
jmp 0x4229a5
cmp eax, 0x4a64
jg 0x422992
je 0x4229a0
sub eax, 0x4a62
je 0x42298b
sub eax, 1
jne 0x422999
push str.21H1
jmp 0x4229a5
push str.20H2
jmp 0x4229a5
cmp eax, 0x55f0
je 0x4229a0
push 0x44af54
jmp 0x4229a5
push str.21H2
lea ecx, [ebp - 0x2c]
call fcn.0041a350
mov byte [ebp - 4], 1
lea eax, [ebp - 0x9c]
push dword [0x459a14]
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
push 0x44a99c
push 0xa
push eax
movups xmmword [ebp - 0x9c], xmm0
call fcn.00423600
mov ecx, dword [0x459a18]
add esp, 0x10
test ecx, ecx
jne 0x422a37
mov esi, dword fs:[0x30]
test esi, esi
je 0x422a5d
mov edx, dword [esi + 0xa8]
mov ecx, dword [esi + 0xa4]
cmp edx, 0xa
jb 0x422a1f
nop word [eax + eax]
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x422a10
lea eax, [ecx + ecx*4]
lea ecx, [edx + eax*2]
movzx eax, word [esi + 0xac]
mov dword [0x459a18], ecx
mov dword [0x459a14], eax
mov eax, ecx
sub eax, 0x3d
je 0x422a56
sub eax, 1
je 0x422a4f
sub eax, 1
jne 0x422a63
mov esi, str.Windows_8.1
jmp 0x422a68
mov esi, str.Windows_8
jmp 0x422a68
mov esi, str.Windows_7
jmp 0x422a68
mov ecx, dword [0x459a18]
mov esi, str.Windows_10
test ecx, ecx
jne 0x422aba
mov eax, dword fs:[0x30]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x422ad3
mov edx, dword [eax + 0xa8]
mov ecx, dword [eax + 0xa4]
cmp edx, 0xa
jb 0x422a9f
nop word [eax + eax]
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x422a90
lea eax, [ecx + ecx*4]
lea ecx, [edx + eax*2]
mov eax, dword [ebp - 0x14]
mov dword [0x459a18], ecx
movzx eax, word [eax + 0xac]
mov dword [0x459a14], eax
cmp ecx, 0x64
jne 0x422ad3
cmp dword [0x459a14], 0x55f0
mov eax, str.Windows_11
cmovne eax, esi
mov esi, eax
push dword [edi + 0x14]
xorps xmm0, xmm0
mov word [ebp - 0xdc], 0
push str._08X
lea eax, [ebp - 0xec]
mov word [ebp - 0xa0], 0
push 9
push eax
movups xmmword [ebp - 0xec], xmm0
mov word [ebp - 0xb4], 0
movups xmmword [ebp - 0xb0], xmm0
mov word [ebp - 0xc8], 0
movups xmmword [ebp - 0xc4], xmm0
movups xmmword [ebp - 0xd8], xmm0
call fcn.00423600
push dword [edi + 0x18]
lea eax, [ebp - 0xb0]
push str._08X
push 9
push eax
call fcn.00423600
push dword [edi + 0x1c]
lea eax, [ebp - 0xc4]
push str._08X
push 9
push eax
call fcn.00423600
push dword [edi + 0x20]
lea eax, [ebp - 0xd8]
push str._08X
push 9
push eax
call fcn.00423600
add esp, 0x34
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x1a0]
push eax
call fcn.0040bb10
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0x194], 0
je 0x422bb7
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.Failed_to_open_create_error_log_file:_n_ls_n
push 1
call fcn.0040e7c0
add esp, 0xc
jmp 0x422f99
lea edx, [ebp - 0x200]
lea ecx, [ebp - 0x1a0]
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.Version____________:
lea ecx, [ebp - 0x1a0]
call fcn.00415910
mov edx, str.GH_Injector_V
mov ecx, eax
call fcn.00415910
mov edx, 0x448dcc
mov ecx, eax
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
cmp dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x1a0]
mov edx, 0x44aab0
jbe 0x422c42
call fcn.00415910
mov edx, esi
mov ecx, eax
call fcn.00415910
mov edx, 0x44aaac
mov ecx, eax
call fcn.00415910
cmp dword [ebp - 0x18], 8
lea edx, [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
jmp 0x422c49
call fcn.00415910
mov edx, esi
mov ecx, eax
call fcn.00415910
mov edx, 0x44aa98
mov ecx, eax
call fcn.00415910
lea edx, [ebp - 0x9c]
mov ecx, eax
call fcn.00415910
mov edx, 0x44aa94
mov ecx, eax
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.File_______________:
lea ecx, [ebp - 0x1a0]
call fcn.00415910
mov ecx, dword [edi]
mov edx, str._nullptr_
test ecx, ecx
cmovne edx, ecx
mov ecx, eax
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.Target_____________:
lea ecx, [ebp - 0x1a0]
call fcn.00415910
mov ecx, dword [edi + 4]
mov edx, str._undetermined_
cmp word [ecx], 0
cmovne edx, ecx
mov ecx, eax
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.Target_PID_________:
lea ecx, [ebp - 0x1a0]
call fcn.00415910
push dword [edi + 8]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.Source_____________:
lea ecx, [ebp - 0x1a0]
call fcn.00415910
mov edx, dword [edi + 0x28]
mov ecx, eax
call fcn.00415910
mov edx, str._in
mov ecx, eax
call fcn.00415910
mov edx, dword [edi + 0x2c]
mov ecx, eax
call fcn.00415910
mov edx, str._at_line
mov ecx, eax
call fcn.00415910
push dword [edi + 0x30]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.Errorcode__________:_0x
lea ecx, [ebp - 0x1a0]
call fcn.00415910
lea edx, [ebp - 0xb0]
mov ecx, eax
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.Advanced_errorcode_:_0x
lea ecx, [ebp - 0x1a0]
call fcn.00415910
lea edx, [ebp - 0xc4]
mov ecx, eax
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.Injectionmode______:
lea ecx, [ebp - 0x1a0]
call fcn.00415910
mov ecx, dword [edi + 0xc]
mov esi, eax
cmp ecx, 4
ja case.default.0x422dcf
jmp dword [ecx*4 + 0x423044]
push 0x44ad5c
jmp 0x422dfe
push str.LdrLoadDll
jmp 0x422dfe
push str.LdrpLoadDll
jmp 0x422dfe
push str.LdrpLoadDllInternal
jmp 0x422dfe
push str.ManualMap
jmp 0x422dfe
push str.bruh_moment
lea ecx, [ebp - 0x80]
call fcn.0041a350
mov edx, dword [ebp - 0x80]
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 3
mov ecx, esi
cmp dword [ebp - 0x6c], 8
push dword [ebp - 0x70]
cmovb edx, eax
call fcn.00423410
add esp, 4
mov ecx, eax
push 0x40d000
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.00401e10
mov edx, str.Launchmethod_______:
lea ecx, [ebp - 0x1a0]
call fcn.00415910
mov ecx, dword [edi + 0x10]
mov esi, eax
cmp ecx, 5
ja case.default.0x422e57
jmp dword [ecx*4 + 0x423058]
push str.NtCreateThreadEx
jmp 0x422e8d
push str.HijackThread
jmp 0x422e8d
push str.SetWindowsHookEx
jmp 0x422e8d
push 0x44ae64
jmp 0x422e8d
push str.KernelCallback
jmp 0x422e8d
push str.FakeVEH
jmp 0x422e8d
push str.bruh_moment
lea ecx, [ebp - 0x68]
call fcn.0041a350
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 4
mov ecx, esi
cmp dword [ebp - 0x54], 8
push dword [ebp - 0x58]
cmovb edx, eax
call fcn.00423410
add esp, 4
mov ecx, eax
push 0x40d000
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.00401e10
mov edx, str.Platform___________:
lea ecx, [ebp - 0x1a0]
call fcn.00415910
mov ecx, dword [edi + 0x24]
test ecx, ecx
jle 0x422eea
mov edx, str.x64_x86__native_
jmp 0x422ef9
test ecx, ecx
mov edx, str.wow64
mov esi, 0x44acc8
cmovne edx, esi
mov ecx, eax
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.HandleValue________:_0x
lea ecx, [ebp - 0x1a0]
call fcn.00415910
lea edx, [ebp - 0xd8]
mov ecx, eax
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, str.Flags______________:_0x
lea ecx, [ebp - 0x1a0]
call fcn.00415910
lea edx, [ebp - 0xec]
mov ecx, eax
call fcn.00415910
push 0x40d000
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0x40d000
lea ecx, [ebp - 0x1a0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, [ebp - 0x19c]
call fcn.0040cc00
test eax, eax
jne 0x422f99
push eax
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1a0]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool_]
lea ecx, [ebp - 0x1a0]
call fcn.0040b0e0
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x422fda
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x422fd0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42301a
push ecx
push edx
call fcn.00438d0e
add esp, 8
mov ecx, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp ecx, 8
jb 0x42302a
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x423020
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x423020
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00438d0e
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00406220
nop
salc
sub eax, 769458242
inc edx
add ah, ah
sub eax, 0x2deb0042
inc edx
add dl, dh
sub eax, 0x2e5e0042
inc edx
add byte [ebp + 0x2e], ah
inc edx
add byte [esi + ebp + 0x42], ch
add byte [ebx + 0x2e], dh
inc edx
add byte [edx + 0x2e], bh
inc edx
add byte [ecx + 0x5500422e], al
push ebp