Function at 0x401f40
Capabilities:
Allocate or change rwx memory
Check if file exists
Create thread
Enumerate pe sections
Execute shellcode via indirect call
Get file attributes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410300
mov eax, dword fs:[0]
push eax
mov eax, 0x1110
call fcn.00410240
mov eax, dword [0x41800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x111c], esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401fdd
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.OOPS__We_ran_into_some_problems...
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Failed_to_find_
call fcn.00403cf0
mov edx, edi
mov ecx, eax
call fcn.00403cf0
mov edx, 0x412670
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor al, al
jmp 0x402a88
push 0xb8
lea eax, [ebp - 0x1104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 4
lea ecx, [ebp - 0x1104]
push 0x24
push edi
call fcn.004037d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1104]
mov eax, dword [ebp - 0x1104]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::fail_void_const]
test al, al
je 0x402031
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.OOPS__We_ran_into_some_problems..._488
jmp 0x402105
lea eax, [ebp - 0x102c]
push eax
lea ecx, [ebp - 0x1104]
call dword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
mov ecx, dword [ebp - 0x1024]
add ecx, dword [ebp - 0x102c]
mov eax, dword [ebp - 0x1020]
adc eax, dword [ebp - 0x1028]
test eax, eax
jg 0x40207a
jl 0x40206a
cmp ecx, 0x1000
jae 0x40207a
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.OOPS__We_ran_into_some_problems..._489
jmp 0x402105
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.File_size_0x
call fcn.00403cf0
push 0x401f20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov edx, dword [ebp - 0x1024]
add edx, dword [ebp - 0x102c]
mov ecx, dword [ebp - 0x1020]
adc ecx, dword [ebp - 0x1028]
push ecx
push edx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_long___int64__]
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x1024]
add ecx, dword [ebp - 0x102c]
mov eax, dword [ebp - 0x1020]
adc eax, dword [ebp - 0x1028]
push ecx
mov dword [ebp - 0x1030], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edi, eax
add esp, 4
mov dword [ebp - 0x1108], edi
test edi, edi
jne 0x402147
mov edx, str.OOPS__We_ran_into_some_problems..._490
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0x10f4]
call fcn.00403c20
test eax, eax
jne 0x402a70
push eax
mov eax, dword [ebp - 0x1104]
lea ecx, [ebp - 0x1104]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
jmp 0x402a70
mov edx, str.Allocated_buffer_at_0x
call fcn.00403cf0
push 0x401f20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push edi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0
push 0
push 0
lea ecx, [ebp - 0x1104]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
mov ecx, dword [ebp - 0x1024]
add ecx, dword [ebp - 0x102c]
mov eax, dword [ebp - 0x1020]
adc eax, dword [ebp - 0x1028]
push eax
push ecx
push edi
lea ecx, [ebp - 0x1104]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
lea ecx, [ebp - 0x10f4]
call fcn.00403c20
test eax, eax
jne 0x4021d4
push eax
mov eax, dword [ebp - 0x1104]
lea ecx, [ebp - 0x1104]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov eax, 0x5a4d
cmp word [edi], ax
je 0x402201
mov edx, str.OOPS__We_ran_into_some_problems..._491
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push edi
jmp 0x402a67
mov eax, dword [edi + 0x3c]
mov ecx, 0x14c
add eax, edi
mov dword [ebp - 0x1114], eax
cmp word [eax + 4], cx
je 0x40221e
mov edx, str.OOPS__We_ran_into_some_problems..._492
jmp 0x4021e3
push 0x40
push 0x3000
push dword [eax + 0x50]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [ebp - 0x1118], eax
test eax, eax
jne 0x402265
mov edx, str.OOPS__We_ran_into_some_problems..._493__
call fcn.00403cf0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x412778
mov ecx, eax
jmp 0x4021e9
mov edx, str.Allocated_0x
call fcn.00403cf0
push 0x401f20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, dword [ebp - 0x1114]
push dword [ecx + 0x50]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, str._bytes_in_target_process_at_0x
mov ecx, eax
call fcn.00403cf0
push 0x401f20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push dword [ebp - 0x1118]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0x1000
mov dword [ebp - 0x104c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x1118]
push eax
push esi
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0x1044], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x402349
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
mov edx, str.OOPS__We_ran_into_some_problems..._494__
mov ecx, eax
call fcn.00403cf0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x412778
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x402a70
mov edx, str.Mapped_header
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x1114]
movzx eax, word [ecx + 0x14]
lea edi, [ecx + 0x18]
add edi, eax
xor ecx, ecx
mov eax, dword [ebp - 0x1114]
mov dword [ebp - 0x1110], ecx
cmp word [eax + 6], cx
je 0x402470
nop word [eax + eax]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x402454
push 0
push eax
mov eax, dword [edi + 0x14]
add eax, dword [ebp - 0x1108]
push eax
mov eax, dword [edi + 0xc]
add eax, dword [ebp - 0x1118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
je 0x4023f1
mov edx, str.Mapped__
call fcn.00403cf0
mov edx, edi
mov ecx, eax
call fcn.00403cf0
mov edx, 0x412814
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x40244e
mov edx, str.OOPS__We_ran_into_some_problems..._495__
call fcn.00403cf0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x412778
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [ebp - 0x1108]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [ebp - 0x111c]
add esp, 4
push 0x8000
push 0
push dword [ebp - 0x1118]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x1110]
mov eax, dword [ebp - 0x1114]
inc ecx
add edi, 0x28
mov dword [ebp - 0x1110], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jne 0x402390
mov edi, dword [ebp - 0x111c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
push 0x3000
push 0x10
push 0
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [ebp - 0x1110], eax
test eax, eax
jne 0x4024b4
mov edx, str.OOPS__We_ran_into_some_problems..._496__
call fcn.00403cf0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
jmp 0x402a42
mov edx, str.Allocated_0x
call fcn.00403cf0
push 0x401f20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push 0x10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
mov edx, str._bytes_at
mov ecx, eax
call fcn.00403cf0
push 0x401f20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push dword [ebp - 0x1110]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
mov edx, str._for_mmap_data
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0
push 0x10
lea eax, [ebp - 0x104c]
push eax
push dword [ebp - 0x1110]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x40254a
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
mov edx, str.OOPS__We_ran_into_some_problems..._497__
mov ecx, eax
jmp 0x40249f
mov edx, str.Mapped_mmap_data
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x40
push 0x3000
push 0x1000
push 0
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov esi, eax
mov dword [ebp - 0x111c], esi
test esi, esi
jne 0x4025e3
mov edx, str.OOPS__We_ran_into_some_problems..._498__
call fcn.00403cf0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x412778
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x1118]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x1110]
push edi
call esi
jmp 0x402a61
mov edx, str.Allocated_shellcode__0x1000_bytes_at_0x
call fcn.00403cf0
push 0x401f20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push esi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
mov edx, 0x412778
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0
push 0x1000
push 0x402b70
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x402644
mov edx, str.OOPS__We_ran_into_some_problems..._499__
jmp 0x40249f
mov edx, str.Mapped_shellcode
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0
push 0
push dword [ebp - 0x1110]
push esi
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov esi, eax
test esi, esi
jne 0x4026ec
mov edx, str.OOPS__We_ran_into_some_problems..._500__
call fcn.00403cf0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x412778
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x1118]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x1110]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x111c]
push edi
call esi
jmp 0x402a61
mov edx, str.Created_thread_at_0x
call fcn.00403cf0
push 0x401f20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push dword [ebp - 0x111c]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
mov edx, str.__handle:_0x
mov ecx, eax
call fcn.00403cf0
push 0x401f20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push esi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov edx, 0x412778
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Waiting_for_entry_point_to_return...
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x1014], 0x103
jne 0x402a2a
push 0
push 0x10
lea eax, [ebp - 0x103c]
xorps xmm0, xmm0
push eax
push dword [ebp - 0x1110]
movups xmmword [ebp - 0x103c], xmm0
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [ebp - 0x1030]
cmp esi, fcn.00404040
je 0x402a1d
cmp esi, 0x606060
je 0x402a10
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x402770
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Entry_point_returned_
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0
push 0x1000
push eax
push dword [ebp - 0x1118]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x402853
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.If_you_see_this_message_please_reboot_your_system_and_try_again
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x100000
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x1030], eax
test eax, eax
jne 0x40287b
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.OOPS__We_ran_into_some_problems..._504
jmp 0x402a4f
push 0x100000
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [ebp - 0x1114]
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x1014], ecx
movzx eax, word [esi + 0x14]
add esi, 0x18
add esi, eax
mov eax, dword [ebp - 0x1114]
cmp word [eax + 6], cx
je 0x402990
cmp dword [esi + 0x10], 0
je 0x402974
mov ecx, str..pdata
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4028e3
test dl, dl
je 0x4028df
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4028e3
add eax, 2
add ecx, 2
test dl, dl
jne 0x4028c3
xor eax, eax
jmp 0x4028e8
sbb eax, eax
or eax, 1
test eax, eax
je 0x40294c
mov ecx, str..rsrc
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402913
test dl, dl
je 0x40290f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402913
add eax, 2
add ecx, 2
test dl, dl
jne 0x4028f3
xor eax, eax
jmp 0x402918
sbb eax, eax
or eax, 1
test eax, eax
je 0x40294c
mov ecx, str..reloc
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402943
test dl, dl
je 0x40293f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402943
add eax, 2
add ecx, 2
test dl, dl
jne 0x402923
xor eax, eax
jmp 0x402948
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402968
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x1118]
push 0
push dword [esi + 0x10]
push dword [ebp - 0x1030]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x1014]
mov eax, dword [ebp - 0x1114]
movzx eax, word [eax + 6]
inc ecx
add esi, 0x28
mov dword [ebp - 0x1014], ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1114]
jne 0x4028b2
push dword [ebp - 0x1108]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
add esp, 4
push 0x8000
push 0
push dword [ebp - 0x111c]
push edi
call esi
test eax, eax
jne 0x4029d6
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Failed_to_free_shellcode
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x8000
push 0
push dword [ebp - 0x1110]
push edi
call esi
test eax, eax
jne 0x402a07
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Failed_to_free_mmap_data
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 0x1109], 1
jmp 0x402a77
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.OOPS__We_ran_into_some_problems..._503
jmp 0x402a4f
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.OOPS__We_ran_into_some_problems..._502
jmp 0x402a4f
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.OOPS__We_ran_into_some_problems..._501__
call fcn.00403cf0
push dword [ebp - 0x1014]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x412778
mov ecx, eax
call fcn.00403cf0
push 0x403f10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [ebp - 0x1108]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov byte [ebp - 0x1109], 0
lea ecx, [ebp - 0x1104]
call fcn.00402ab0
mov al, byte [ebp - 0x1109]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ef13
mov esp, ebp
pop ebp
ret