Function at 0x426d00
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1878
call fcn.00436190
push esi
push edi
push str.Begin_ManualMap_n
push 1
call fcn.00428a80
xor eax, eax
mov dword [ebp - 0x4f0], 0
push 0x208
push eax
mov word [ebp - 0x4e4], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x4d8]
mov dword [ebp - 0x4e8], 0
push eax
movq qword [ebp - 0x4e0], xmm0
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x2c8]
xorps xmm0, xmm0
push 0
push eax
movq qword [ebp - 0x2d0], xmm0
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x7ab5a0]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x7ab5a4]
mov dword [ebp - 0x98], eax
mov eax, dword [0x7ab5b0]
mov dword [ebp - 0x94], eax
mov eax, dword [0x7ab5a8]
mov dword [ebp - 0x90], eax
mov eax, dword [0x7ab5ac]
mov dword [ebp - 0x8c], eax
mov eax, dword [0x7ab5b4]
mov dword [ebp - 0x88], eax
mov eax, dword [0x7ab5bc]
mov dword [ebp - 0x84], eax
mov eax, dword [0x7ab5b8]
mov dword [ebp - 0x80], eax
mov eax, dword [0x7ab5c0]
mov dword [ebp - 0x7c], eax
mov eax, dword [0x7ab5c4]
mov dword [ebp - 0x78], eax
mov eax, dword [0x7ab588]
mov dword [ebp - 0x74], eax
mov eax, dword [0x7ab58c]
mov dword [ebp - 0x70], eax
mov eax, dword [0x7ab590]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x7ab594]
movups xmm0, xmmword [0x493d94]
mov dword [ebp - 0x68], eax
mov eax, dword [0x7ab554]
mov dword [ebp - 0x64], eax
mov eax, dword [0x7ab558]
mov dword [ebp - 0x60], eax
mov eax, dword [0x7ab560]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x7ab4e4]
mov dword [ebp - 0x58], eax
mov eax, dword [0x7ab598]
mov dword [ebp - 0x54], eax
mov eax, dword [0x7ab574]
mov dword [ebp - 0x50], eax
mov eax, dword [0x7ab578]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x7ab57c]
mov dword [ebp - 0x48], eax
mov eax, dword [0x7ab580]
mov dword [ebp - 0x44], eax
mov eax, dword [0x7ab584]
mov dword [ebp - 0x40], eax
mov eax, dword [0x7ab4f0]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x7ab5c8]
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x38], eax
mov eax, dword [0x7ab5cc]
mov dword [ebp - 0x34], eax
mov eax, dword [0x7ab5d0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x7ab5d4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x7ab5d8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x7ab5dc]
mov dword [ebp - 0x24], eax
mov eax, dword [0x7ab5e0]
mov dword [ebp - 0x20], eax
mov eax, dword [0x7ab5e4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
push 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x4ec], eax
call fcn.00416680
add esp, 0x24
mov dword [ebp - 0xb0], eax
call fcn.00416670
mov esi, dword [ebp + 8]
mov dword [ebp - 0xac], eax
test esi, esi
je 0x427972
mov ecx, 0x104
mov eax, esi
nop dword [eax]
cmp word [eax], 0
je 0x426f0e
add eax, 2
sub ecx, 1
jne 0x426f00
xor edx, edx
mov edi, 0x80070057
test ecx, ecx
mov eax, edi
cmovne eax, edx
mov dword [ebp - 8], eax
je 0x42797a
mov eax, 0x104
mov edx, 0x104
sub eax, ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, 0x208
mov word [ebp - 0x4de], ax
lea eax, [ebp - 0x4d8]
mov word [ebp - 0x4e0], cx
sub esi, eax
mov dword [ebp - 0x4dc], eax
mov ecx, eax
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x426f7e
movzx eax, word [esi + ecx]
test ax, ax
je 0x426f7e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x426f60
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
test edx, edx
mov word [eax], cx
mov eax, 0x8007007a
cmovne eax, ecx
mov dword [ebp - 4], eax
jne 0x427031
mov esi, dword [ebp + 0x20]
push 0x208
push ecx
lea edi, [esi + 4]
mov dword [esi], eax
push edi
mov dword [esi + 0x414], 0x2e
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
mov dword [ebp + 0x14], eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
add eax, eax
push eax
push str.MMAP_NATIVE::ManualMap
push dword [ebp + 0x14]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 4]
push eax
push str.StringCbCopyW_failed:__08X_n
jmp 0x427a08
push 0x5c
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_wcsrchr
mov edx, eax
add esp, 8
test edx, edx
jne 0x4270ea
mov esi, dword [ebp + 0x20]
mov eax, dword [ebp - 4]
push 0x208
push edx
lea edi, [esi + 4]
mov dword [esi], eax
push edi
mov dword [esi + 0x414], 0x38
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
mov dword [ebp + 0x14], eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
add eax, eax
push eax
push str.MMAP_NATIVE::ManualMap
push dword [ebp + 0x14]
call sub.VCRUNTIME140.dll_memcpy
push str.wcsrchr_failed_n
push 1
call fcn.00428a80
add esp, 0x14
mov eax, 0x30
pop edi
pop esi
mov esp, ebp
pop ebp
ret
add edx, 2
je 0x4278e1
mov eax, 0x104
mov ecx, edx
nop word [eax + eax]
cmp word [ecx], 0
je 0x42710e
add ecx, 2
sub eax, 1
jne 0x427100
xor ecx, ecx
test eax, eax
cmovne edi, ecx
mov dword [ebp + 8], edi
je 0x4278e4
mov ecx, 0x104
sub ecx, eax
add ecx, ecx
neg eax
push edx
sbb eax, eax
and eax, ecx
mov word [ebp - 0x2d0], ax
mov eax, 0x208
mov word [ebp - 0x2ce], ax
lea eax, [ebp - 0x2c8]
push 0x208
push eax
mov dword [ebp - 0x2cc], eax
call fcn.0041abb0
mov dword [ebp + 8], eax
test eax, eax
jns 0x4271f6
mov esi, dword [ebp + 0x20]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], eax
push edi
mov dword [esi + 0x414], 0x54
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
mov dword [ebp + 0x14], eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
add eax, eax
push eax
push str.MMAP_NATIVE::ManualMap
push dword [ebp + 0x14]
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp + 8]
push str.StringCbCopyW_failed:__08X_n
jmp 0x427a08
push str.Shell_data_initialized_n
push 1
call fcn.00428a80
mov esi, dword [ebp + 0x14]
add esp, 8
test esi, 0x2000000
je 0x4272c8
test esi, 0x200000
jne 0x4272c8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x4f4], 0xffffffff
mov edx, 1
mov dword [ebp - 0x1874], eax
nop dword [eax + eax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [ebp + edx*4 - 0x1874], eax
inc edx
cmp edx, 0x270
jb 0x427240
lea eax, [ebp - 0x1878]
mov dword [ebp - 0x1878], 0x270
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.00427a20
mov edi, 0xf01
mul edi
cmp eax, edi
jae 0x4272a1
cmp eax, 0xd13
jae 0x4272a1
nop dword [eax]
lea ecx, [ebp + 8]
call fcn.00427a20
mul edi
cmp eax, 0xd13
jb 0x427290
movzx eax, dx
add eax, 0x10f
and eax, 0xfff0
mov word [ebp - 0x4e4], ax
movzx eax, ax
push eax
push str.Shift_offset___04X_n
push 1
call fcn.00428a80
add esp, 0xc
and esi, 0x100000
mov ecx, 0x485e50
sub ecx, section..mmap_se
mov eax, 0x486160
sub eax, 0x485e60
mov dword [ebp - 0x10], ecx
neg esi
push 0x40
sbb esi, esi
and esi, eax
lea eax, [ecx + 0x4fc]
push 0x3000
add eax, esi
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], edi
lea ecx, [edi + 0x4eb]
and ecx, 0xfffffff0
mov dword [ebp - 4], ecx
add ecx, 0xf
add ecx, eax
and ecx, 0xfffffff0
mov dword [ebp - 8], ecx
test esi, esi
je 0x427339
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], esi
test edi, edi
jne 0x4273ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x20]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], eax
push edi
mov dword [esi + 0x414], 0x82
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
mov esi, dword [ebp + 0x20]
add eax, eax
push eax
push str.MMAP_NATIVE::ManualMap
lea eax, [esi + 0x20c]
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [esi]
push str.VirtualAllocEx_failed:__08X_n
push 1
call fcn.00428a80
add esp, 0x18
mov eax, 0x15
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
push str.Shellsize____08X_n
push 2
call fcn.00428a80
push dword [ebp - 0x14]
push str.Total_size___08X_n
push 2
call fcn.00428a80
push edi
push str.pArg_________p_n
push 2
call fcn.00428a80
push dword [ebp - 4]
push str.pShell_______p_n
push 2
call fcn.00428a80
add esp, 0x30
test esi, esi
je 0x42743e
push dword [ebp - 8]
push str.pVEHShell_____p_n
push 2
call fcn.00428a80
add esp, 0xc
push 0
push 0x4dc
lea eax, [ebp - 0x4f0]
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x42751d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x20]
mov dword [esi + 0x414], 0x95
push 0x208
lea edi, [esi + 4]
mov dword [esi], eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
mov esi, dword [ebp + 0x20]
add eax, eax
push eax
push str.MMAP_NATIVE::ManualMap
lea eax, [esi + 0x20c]
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [esi]
push str.WriteProcessMemory_failed:__08X_n
push 1
call fcn.00428a80
add esp, 0x18
push 0x8000
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
mov eax, 0x10
pop esi
mov esp, ebp
pop ebp
ret
push str.Shelldata_written_to_memory_n
push 1
call fcn.00428a80
add esp, 8
push 0
push dword [ebp - 0x10]
push section..mmap_se
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x42755e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x20]
mov dword [esi + 0x414], 0xa2
jmp 0x427471
push str.Shell_written_to_memory_n
push 1
call fcn.00428a80
add esp, 8
test esi, esi
je 0x4275b0
push 0
push esi
push 0x485e60
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4275a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x20]
mov dword [esi + 0x414], 0xb1
jmp 0x427471
push str.VEHShell_written_to_memory_n
push 1
call fcn.00428a80
add esp, 8
push str.Entering_StartRoutine_n
push 1
call fcn.00428a80
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0xc]
mov esi, dword [ebp + 0x20]
mov ecx, edx
push esi
push dword [ebp + 0x1c]
or ecx, 0x3000
mov dword [ebp - 0xc], 0
push eax
test dl, 8
cmove ecx, edx
push ecx
push dword [ebp + 0x10]
push edi
push dword [ebp - 4]
push dword [ebp + 0xc]
call fcn.0042b430
push str.Return_from_StartRoutine_n
push 1
mov dword [ebp + 0x14], eax
call fcn.00428a80
add esp, 0x30
cmp dword [ebp + 0x14], 0
je 0x427648
mov esi, dword [ebp + 0x14]
push esi
push str.StartRoutine_failed:__08X_n
push 1
call fcn.00428a80
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, 3
je 0x427640
cmp eax, 1
jne 0x42762f
cmp esi, 0x1020000a
je 0x427640
push 0x8000
push 0
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push str.Fetching_routine_data_n
push 1
call fcn.00428a80
add esp, 8
lea eax, [ebp - 0x4f0]
push 0
push 0x4dc
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x427739
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
lea edi, [esi + 4]
mov dword [esi], eax
push 0
push edi
mov dword [esi + 0x414], 0xd9
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
mov esi, dword [ebp + 0x20]
add eax, eax
push eax
push str.MMAP_NATIVE::ManualMap
lea eax, [esi + 0x20c]
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [esi]
push str.ReadProcessMemory_failed:__08X_n
push 1
call fcn.00428a80
add esp, 0x18
cmp dword [ebp + 0x10], 3
je 0x42772e
push 0x8000
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
mov eax, 0x1b
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 3
je 0x427750
push 0x8000
push 0
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp dword [ebp - 0xc], 0
je 0x427801
mov eax, dword [ebp - 0x4e8]
lea edi, [esi + 4]
push 0x208
push 0
push edi
mov dword [esi], eax
mov dword [esi + 0x414], 0xec
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
add eax, eax
push eax
mov eax, dword [ebp + 0x20]
add eax, 0x20c
push str.MMAP_NATIVE::ManualMap
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0xc]
push str.Shell_failed:__08X_n
push 1
call fcn.00428a80
mov eax, dword [ebp - 0xc]
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x4f0], 0
jne 0x4278b2
push 0x208
lea edi, [esi + 4]
mov dword [esi], 0
push 0
push edi
mov dword [esi + 0x414], 0xf5
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
add eax, eax
push eax
mov eax, dword [ebp + 0x20]
add eax, 0x20c
push str.MMAP_NATIVE::ManualMap
push eax
call sub.VCRUNTIME140.dll_memcpy
push str.Shell_failed_n
push 1
call fcn.00428a80
add esp, 0x14
mov eax, 0x20
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.Shell_returned_successfully_n
push 1
call fcn.00428a80
mov ecx, dword [ebp - 0x4f0]
mov eax, dword [ebp + 0x18]
push ecx
push str.Imagebase___p_n
push 1
mov dword [eax], ecx
call fcn.00428a80
add esp, 0x14
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp + 8], edi
mov esi, dword [ebp + 0x20]
push 0x208
push 0
mov dword [esi], edi
lea edi, [esi + 4]
push edi
mov dword [esi + 0x414], 0x46
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
mov dword [ebp + 0x14], eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
add eax, eax
push eax
push str.MMAP_NATIVE::ManualMap
push dword [ebp + 0x14]
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp + 8]
jmp 0x427a03
mov eax, 0x80070057
mov dword [ebp - 8], eax
mov esi, dword [ebp + 0x20]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], eax
push edi
mov dword [esi + 0x414], 0x20
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esi + 0x20c]
push 0
push eax
mov dword [ebp + 0x14], eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryManual_Mapping.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.MMAP_NATIVE::ManualMap
call esi
add eax, eax
push eax
push str.MMAP_NATIVE::ManualMap
push dword [ebp + 0x14]
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 8]
push str.StringCbLengthW_failed:__08X_n
push 1
call fcn.00428a80
add esp, 0x18
mov eax, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret