Function at 0x401000
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Execute shellcode via indirect call
Get graphical window text
Resume thread

Disassembly:
sub esp, 0xbf8
push ebx
push ebp
push esi
lea eax, [esp + 0x18]
push edi
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
xor ebp, ebp
call fcn.00401aa0
mov edi, dword [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [0x41c0b0]
dec edi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.LoadLibraryA
mov dword [edi], ecx
mov edx, dword [0x41c0b4]
push 0x41c0cc
mov dword [edi + 4], edx
mov al, byte [0x41c0b8]
mov byte [edi + 8], al
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetLastError
push 0x41c0ec
mov dword [esp + 0x34], eax
call esi
push eax
call edi
push str.SetLastError
push str.kernel32.dll
mov dword [esp + 0x30], eax
call esi
push eax
call edi
push str.gMap_v0.1_Beta_2_by_TheAce._Original_DLL_code_by_McGod.
push 0x41e2d8
mov dword [esp + 0x3c], eax
call fcn.004031b0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402720
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x4010cd
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4010cd
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
cmp edi, ebx
je 0x4010e4
mov edx, dword [ecx + 4]
push ebx
or edx, edi
push edx
call fcn.00402b70
push 0xa
mov ecx, esi
call fcn.00402720
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x401114
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x401114
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
cmp edi, ebx
je 0x40112b
mov edx, dword [ecx + 4]
push ebx
or edx, edi
push edx
call fcn.00402b70
push str.Remember_you_need_to_be_ingame_for_this_to_reveal_current_act_
push 0x41e2d8
call fcn.004031b0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402720
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x40116f
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40116f
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
cmp edi, ebx
je 0x401186
mov edx, dword [ecx + 4]
push ebx
or edx, edi
push edx
call fcn.00402b70
push 0xa
mov ecx, esi
call fcn.00402720
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x4011b6
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4011b6
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
cmp edi, ebx
je 0x4011cd
mov edx, dword [ecx + 4]
push ebx
or edx, edi
push edx
call fcn.00402b70
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
push ebx
push 0x41c194
push ebx
push ebx
call edi
mov esi, eax
push ebx
cmp esi, ebx
mov dword [esp + 0x80c], esi
jne 0x40120a
push 0x41c1a0
push str.Could_not_find_any_Diablo_II_windows_running...
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xbf8
ret
push str.Diablo_II
push esi
push ebx
call edi
cmp eax, ebx
mov dword [esp + 0x80c], eax
je 0x40124a
lea esi, [esp + 0x80c]
mov eax, dword [esi]
add esi, 4
push ebx
push str.Diablo_II
push eax
push ebx
inc ebp
call edi
cmp eax, ebx
mov dword [esi], eax
jne 0x401225
cmp ebp, ebx
mov dword [esp + 0x18], ebp
jne 0x4012c2
mov esi, dword [esp + 0x808]
lea ecx, [esp + 0x3c]
push 0x100
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 0x408]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x14], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [esp + 0x20]
push ecx
push 0
push 0x28
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
push eax
call edi
test eax, eax
jne 0x4015c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x4015b1
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x40158e
push 0x10
push 0x41c234
push str.Error_while_getting_privileges__1_.
jmp 0x401a4e
lea eax, [ebp + 1]
push str._Diablo_II_windows:
push eax
push str.Found
push 0x41e2d8
mov dword [esp + 0x24], 0xffffffff
call fcn.004031b0
add esp, 8
mov ecx, eax
call fcn.004020c0
push eax
call fcn.004031b0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402720
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x401327
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x401327
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
cmp edi, ebx
je 0x40133e
mov edx, dword [ecx + 4]
push ebx
or edx, edi
push edx
call fcn.00402b70
push 0xa
mov ecx, esi
call fcn.00402720
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x40136e
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40136e
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
cmp edi, ebx
je 0x401385
mov edx, dword [ecx + 4]
push ebx
or edx, edi
push edx
call fcn.00402b70
cmp ebp, ebx
mov dword [esp + 0x10], ebx
jl 0x401557
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x3c]
push 0x100
push eax
mov edi, dword [esp + esi*4 + 0x810]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ebx, [esp + esi*4 + 0x408]
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [esp + 0x3c]
push ecx
push 0x41c210
push esi
push 0x41c214
push 0x41e2d8
call fcn.004031b0
add esp, 8
mov ecx, eax
call fcn.004020c0
push eax
call fcn.004031b0
add esp, 8
push eax
call fcn.004031b0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402720
mov edx, dword [esi]
xor ebp, ebp
mov eax, dword [edx + 4]
add eax, esi
test byte [eax + 4], 6
jne 0x401420
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x401420
mov ebp, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test ebp, ebp
je 0x401438
mov edx, dword [ecx + 4]
push 0
or edx, ebp
push edx
call fcn.00402b70
push edi
push str.HWND_
push esi
call fcn.004031b0
add esp, 8
mov ecx, eax
call fcn.00402500
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00402720
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x401480
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x401480
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x401498
mov edx, dword [ecx + 4]
push 0
or edx, edi
push edx
call fcn.00402b70
mov eax, dword [ebx]
push eax
push str.PID_
push esi
call fcn.004031b0
add esp, 8
mov ecx, eax
call fcn.004022e0
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00402720
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x4014e2
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4014e2
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x4014fa
mov edx, dword [ecx + 4]
push 0
or edx, edi
push edx
call fcn.00402b70
push 0xa
mov ecx, esi
call fcn.00402720
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x40152a
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40152a
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x401542
mov edx, dword [ecx + 4]
push 0
or edx, edi
push edx
call fcn.00402b70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jle 0x401391
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
test eax, eax
jl 0x40156b
cmp eax, esi
jle 0x40126e
push str.Which_window_to_inject:
push 0x41e2d8
call fcn.004031b0
add esp, 8
lea eax, [esp + 0x14]
mov ecx, 0x41e368
push eax
call fcn.00402890
jmp 0x40155b
lea edx, [esp + 0x20]
push edx
push 0
push 0x28
call esi
push eax
call edi
test eax, eax
jne 0x4015c2
push 0x10
push 0x41c260
push str.Error_while_getting_privileges__2_.
jmp 0x401a4e
push 0x10
push 0x41c28c
push str.Error_while_getting_privileges__3_.
jmp 0x401a4e
mov eax, dword [esp + 0x20]
push 1
push 0x41c2b8
push eax
call fcn.00401f20
add esp, 0xc
test eax, eax
jne 0x4015eb
push 0x10
push 0x41c2cc
push str.Error_while_getting_privileges__4_.
jmp 0x401a4e
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + ecx*4 + 0x408]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
jne 0x40161b
push 0x10
push 0x41c2f8
push str.Could_not_open_Diablo_II_process.
jmp 0x401a4e
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x408]
push ecx
call fcn.00401b80
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
jne 0x401647
push 0x10
push 0x41c324
push str.Theres_been_an_error_suspending_Diablo_IIs_threads._Please_report_this_
jmp 0x401a4e
push str.Threads_suspended.
push 0x41e2d8
call fcn.004031b0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402720
mov edx, dword [esi]
xor edi, edi
mov eax, dword [edx + 4]
add eax, esi
test byte [eax + 4], 6
jne 0x401687
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x401687
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x40169f
mov edx, dword [ecx + 4]
push 0
or edx, edi
push edx
call fcn.00402b70
push ebx
push 0
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
not ecx
push 0x3000
push ecx
push eax
push ebp
call esi
push 0x40
push 0x3000
push 0x25
mov edi, eax
push 0
push ebp
mov dword [esp + 0x2c], edi
call esi
test edi, edi
mov dword [esp + 0x10], eax
je 0x401a42
test eax, eax
je 0x401a42
push str.Memory_allocated.
push 0x41e2d8
call fcn.004031b0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402720
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x40173c
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40173c
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x40175d
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x401755
or al, 4
push 0
push eax
call fcn.00408bfe
mov edx, dword [esp + 0x1c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
dec ecx
push 0
push ecx
mov ecx, dword [esp + 0x20]
push edx
push ecx
push ebp
call ebx
test eax, eax
jne 0x401794
push 0x10
push 0x41c3f4
push str.WriteProcessMemory_failed_when_copying_DLL_filename.
jmp 0x401a4e
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x13c]
push edx
push esi
mov dword [esp + 0x144], 0x10001
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [esp + 0x1f4]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x13c]
mov dword [esp + 0x30], eax
push edx
push esi
mov dword [esp + 0x1fc], ecx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x4017ec
push 0x10
push 0x41c434
push str.Theres_been_an_error_while_hijacking_the_context_of_target_thread.
jmp 0x401a4e
push str.Context_hijacked.
push 0x41e2d8
call fcn.004031b0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402720
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x401830
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x401830
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x401851
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x401849
or al, 4
push 0
push eax
call fcn.00408bfe
lea ecx, [esp + 0x38]
push ecx
push 0x80
push 0x25
push 0x401a70
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x30]
mov edx, 0x401a70
mov ecx, 0x401a70
push 0
mov dword [edx + 1], eax
mov edx, dword [esp + 0x2c]
mov dword [ecx + 8], edx
mov ecx, dword [esp + 0x1c]
mov eax, 0x401a70
mov edx, 0x401a70
push 0x25
push 0x401a70
mov dword [eax + 0x10], ecx
mov eax, dword [esp + 0x38]
mov dword [edx + 0x15], eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x40]
mov ecx, 0x401a70
push eax
push ebp
mov dword [ecx + 0x1c], edx
call ebx
test eax, eax
jne 0x4018ca
push 0x10
push 0x41c494
push str.WriteProcessMemory_failed_when_copying_the_injection_code.
jmp 0x401a4e
push str.Injection_code_written.
push 0x41e2d8
call fcn.004031b0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402720
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x40190e
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40190e
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x40192f
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x401927
or al, 4
push 0
push eax
call fcn.00408bfe
mov ebx, dword [esp + 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x401950
push 0
push str.Error_
push str.Could_not_resume_the_hijacked_thread.
jmp 0x401a4e
push str.Hijacked_thread_resumed.
push 0x41e2d8
call fcn.004031b0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402720
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x401994
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x401994
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x4019b5
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x4019ad
or al, 4
push 0
push eax
call fcn.00408bfe
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + ecx*4 + 0x408]
push edx
call fcn.00401cc0
mov edi, dword [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
not ecx
dec ecx
push 0xc000
push ecx
push eax
push ebp
call esi
mov ecx, dword [esp + 0x10]
push 0xc000
push 0x25
push ecx
push ebp
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push ebx
call esi
mov edx, dword [esp + 0x14]
mov eax, dword [esp + edx*4 + 0x408]
push eax
call fcn.00401c30
mov ecx, dword [esp + 0x24]
push 0
push str.SeDebugPrivilege
push ecx
call fcn.00401f20
push str.PAUSE
call fcn.0040b6dc
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbf8
ret
push 0x10
push 0x41c38c
push str.Theres_been_an_error_while_allocating_memory_inside_Diablo_IIs_process.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xbf8
ret