Function at 0x408d20
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
push ebx
push esi
push str._PROCESS_HOLLOWING__n
call fcn.0051d703
add esp, 4
test edi, edi
je 0x409066
push edi
push str.___PE_file_content_:_0x_p_n
call fcn.0051d703
mov eax, dword [edi + 0x3c]
add esp, 8
cmp dword [edi + eax], 0x4550
je 0x408d80
push str.____The_PE_file_is_not_valid___n
call fcn.0051d703
add esp, 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___The_PE_file_is_valid._n
call fcn.0051d703
add esp, 4
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.0051f6f0
mov ecx, dword [ebp + 8]
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 4
push 1
push 0
push 0
push 0
push ecx
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408dff
push str.____An_error_is_occured_when_trying_to_create_the_target_process___n
call fcn.0051d703
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.00408620
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0xc], 0
je 0x409059
lea esi, [esp + 0x10]
call fcn.004084b0
mov esi, edx
test esi, esi
je 0x40904f
test eax, eax
je 0x40904f
push eax
push str.___Target_Process_PEB_:_0x_p_n
call fcn.0051d703
push esi
push str.___Target_Process_Image_Base_:_0x_p_n
call fcn.0051d703
mov ecx, dword [edi + 0x3c]
mov edx, 0x10b
add esp, 0x10
cmp word [ecx + edi + 0x18], dx
jne 0x408e69
mov ebx, 1
push str.___Source_PE_Image_architecture_:_x86_n
jmp 0x408e70
xor ebx, ebx
push str.___Source_PE_Image_architecture_:_x64_n
call fcn.0051d703
add esp, 4
cmp dword [esp + 0xc], 0
je 0x408e86
push str.___Target_PE_Image_architecture_:_x86_n
jmp 0x408e8b
push str.___Target_PE_Image_architecture_:_x64_n
call fcn.0051d703
add esp, 4
test ebx, ebx
je 0x408eb4
cmp dword [esp + 0xc], 0
jne 0x408ebb
push str.____Architecture_are_not_compatible___n
call fcn.0051d703
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], 0
jne 0x408e9e
push str.___Architecture_are_compatible___n
call fcn.0051d703
add esp, 4
test ebx, ebx
je 0x409039
mov eax, dword [edi + 0x3c]
movzx ebx, word [eax + edi + 0x5c]
cmp ebx, 0xffffffff
jne 0x408ee7
push str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_source_image._n
jmp 0x408de3
push ebx
push str.___Source_Image_subsystem_:_0x_X_n
call fcn.0051d703
add esp, 8
cmp dword [esp + 0xc], 0
je 0x409023
mov ecx, esi
mov esi, dword [esp + 0x10]
call fcn.00408550
mov esi, eax
cmp esi, 0xffffffff
jne 0x408f1c
push str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
jmp 0x408de3
push esi
push str.___Target_Process_subsystem_:_0x_X_n
call fcn.0051d703
add esp, 8
cmp ebx, esi
jne 0x409019
push str.___Subsytems_are_compatible._n
call fcn.0051d703
mov ecx, dword [edi + 0x3c]
add esp, 4
cmp dword [ecx + edi + 0xa0], 0
jne 0x408f8a
push str.___The_source_image_doesnt_have_a_relocation_table._n
call fcn.0051d703
add esp, 4
push edi
lea ecx, [esp + 0x14]
call fcn.004086a0
add esp, 4
test eax, eax
je 0x408fca
push 0x57e81c
call fcn.0051d703
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.00408660
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___The_source_image_has_a_relocation_table._n
call fcn.0051d703
lea edx, [esp + 0x14]
add esp, 4
push edx
mov ecx, edi
call fcn.00408910
add esp, 4
test eax, eax
je 0x408fca
push str.___The_injection_has_succeed___n
call fcn.0051d703
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.00408660
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____The_injection_has_failed___n
call fcn.0051d703
add esp, 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x408ff8
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409066
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x10]
push eax
call esi
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____Subsytems_are_not_compatible._n
jmp 0x408de3
push str.____Target_PE_Image_architecture_not_x86_n
call fcn.0051d703
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___Source_PE_Image_architecture_not_x86_n
call fcn.0051d703
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x57e720
jmp 0x408de3
push str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
call fcn.0051d703
add esp, 4
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret