Function at 0x402780
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Create process on windows
Create process suspended
Resume thread
Spoof parent pid
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xfa8
mov eax, dword [0x420040]
xor eax, esp
mov dword [esp + 0xfa4], eax
push esi
push edi
push 0x402740
call fcn.00407b4f
add esp, 4
push 0x402760
call fcn.00409fbb
add esp, 4
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlImageNtHeaderEx
push esi
mov dword [0x421438], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x421438]
mov dword [0x42143c], eax
test esi, esi
je 0x403e54
nop dword [eax]
test eax, eax
je 0x403e54
push 0x421448
push 0x421440
push 0x421444
mov ecx, esi
call dword [0x417198]
nop
call esi
and dword [0x421448], 0x7fff
lea eax, [esp + 0x134]
push 4
push eax
push 1
mov dword [esp + 0x140], 0xb
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0x13c]
mov dword [esp + 0x13c], 3
push eax
push 3
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0x140]
mov dword [esp + 0x140], 1
push eax
push 6
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0x144]
mov dword [esp + 0x144], 1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
cmp dword [0x421444], 0xa
jb 0x402959
push 4
lea eax, [esp + 0x148]
mov dword [esp + 0x148], 4
push eax
push 7
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0x14c]
mov dword [esp + 0x14c], 1
push eax
push 9
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0x150]
mov dword [esp + 0x150], 3
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0x134]
mov dword [esp + 0x134], 1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
cmp dword [0x421448], 0x4563
jae 0x40293c
cmp dword [0x421444], 0xa
jbe 0x402959
push 4
lea eax, [esp + 0x128]
mov dword [esp + 0x128], 0xf
push eax
push 0xe
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
sub esp, 8
xor edx, edx
mov ecx, str.User32.dll
push 0
sub esp, 0xc
call fcn.00401940
add esp, 0x18
test al, al
jne 0x402985
push 0x10
push 0x41cc58
push str.Failed_to_load_User32.dll
jmp 0x403e60
sub esp, 8
xor edx, edx
mov ecx, str.Shlwapi.dll
push 0
sub esp, 0xc
call fcn.00401940
add esp, 0x18
test al, al
jne 0x4029b5
push 0x10
push 0x41cc58
push str.Failed_to_load_Shlwapi.dll
jmp 0x403e60
push 0x208
lea eax, [esp + 0x37c]
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x788]
push 0x208
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0xb98]
push 0x410
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x990]
push 0x208
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x580]
push 0x208
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x378]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x402a5b
push 0x10
push 0x41cc58
push str.Unable_to_get_ini_path___1_
jmp 0x403e60
nop dword [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x402a7c
push 0x10
push 0x41cc58
push str.Unable_to_get_ini_path___2_
jmp 0x403e60
lea eax, [esp + 0x378]
push 0x5c
push eax
call fcn.004059d5
add esp, 8
test eax, eax
je 0x402a97
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x378]
push eax
push str._sDLLInjector.ini
push 0xffffffffffffffff
lea eax, [esp + 0x794]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402ad6
push 0x10
push 0x41cc58
push str.Unable_to_get_ini_path___3_
jmp 0x403e60
push 0
push 0x80
push 3
push 0
push 1
push 0
lea eax, [esp + 0x7a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x402b09
push 0x10
push 0x41cc58
push str.Unable_to_open_ini_
jmp 0x403e60
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20a
call fcn.0040448b
add esp, 4
mov esi, eax
push 0x208
push 0
push esi
call fcn.00406000
add esp, 0xc
mov byte [esi + 0x208], 0
lea eax, [esp + 0x788]
push eax
push 0x104
push esi
call fcn.00407b7f
add esp, 0xc
test eax, eax
jne 0x402b57
mov byte [esi + 0x208], 1
push 0
push str.AllowMultipleInstancesOfDLLInjector
push ecx
mov ecx, esi
call fcn.004010c0
test eax, eax
jne 0x402ba5
push eax
lea edx, [esp + 0x12]
mov byte [esp + 0x12], al
mov ecx, 0x41d248
call fcn.00402460
add esp, 4
test eax, eax
je 0x402ba5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0xe], 1
jne 0x402ba5
push 0x10
push 0x41cc58
push str.Only_one_instance_of_DLLInjector.exe_is_allowed_
jmp 0x403e60
push 0
push str.UseFullPathsFromIni
push ecx
mov ecx, esi
call fcn.004010c0
push 0x41d2f4
push ecx
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.00401160
mov edi, eax
test edi, edi
jne 0x402bdc
push 0x10
push 0x41cc58
push str.Failed_to_get_exe_name_
jmp 0x403e60
push edi
push 0x41d32c
push 0xffffffffffffffff
lea eax, [esp + 0x58c]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402c0f
push 0x10
push 0x41cc58
push str.Failed_to_get_exe_name___3_
jmp 0x403e60
cmp dword [esp + 0x10], 1
jne 0x402c26
lea eax, ds:[esp + 0x580]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push 0
xor edx, edx
lea ecx, [esp + 0x584]
call fcn.00402460
add esp, 4
test eax, eax
je 0x402c95
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x208
lea eax, [esp + 0x174]
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x580]
push eax
push str.There_is_already_a_process_with_the_name__s_running__close_it_before_trying_to_use_DLLInjector_again_
push 0xffffffffffffffff
lea eax, [esp + 0x17c]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0x170]
push 0x10
push 0x41cc58
push eax
jmp 0x403e60
push str.CommandLine
push ecx
mov ecx, esi
call fcn.00401160
mov dword [esp + 8], eax
test eax, eax
jne 0x402d07
push edi
cmp dword [esp + 0x14], eax
jne 0x402ce5
lea eax, [esp + 0x37c]
push eax
push str.__s_s_
push 0xffffffffffffffff
lea eax, [esp + 0xba8]
push 0x208
push eax
call fcn.00401030
add esp, 0x18
mov dword [esp + 0x1c], eax
jmp 0x402d62
push str.__s_
push 0xffffffffffffffff
lea eax, [esp + 0xba4]
push 0x208
push eax
call fcn.00401030
add esp, 0x14
mov dword [esp + 0x1c], eax
jmp 0x402d62
cmp dword [esp + 0x10], 0
push eax
push edi
jne 0x402d36
lea eax, [esp + 0x380]
push eax
push str.__s_s___s
push 0xffffffffffffffff
lea eax, [esp + 0xbac]
push 0x208
push eax
call fcn.00401030
add esp, 0x1c
jmp 0x402d52
push str.__s___s
push 0xffffffffffffffff
lea eax, [esp + 0xba8]
push 0x208
push eax
call fcn.00401030
add esp, 0x18
push dword [esp + 8]
mov dword [esp + 0x20], eax
call fcn.00404486
add esp, 4
push edi
call fcn.00404486
add esp, 4
cmp dword [esp + 0x1c], 0xffffffff
jne 0x402d85
push 0x10
push 0x41cc58
push str.Unable_to_get_full_exe_path_
jmp 0x403e60
push 0
push str.Use4GBPatch
push ecx
mov ecx, esi
call fcn.004010c0
mov dword ds:[esp + 0x120], eax
test eax, eax
je 0x402e59
mov edi, 1
inc eax
cmp eax, edi
jbe 0x402e59
lfence
nop dword [eax]
push 0x208
lea eax, [esp + 0x174]
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x170]
push edi
push str.FileToPatch__u
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
je 0x402e46
lea eax, [esp + 0x170]
push eax
push ecx
mov ecx, esi
call fcn.00401160
mov dword [esp + 8], eax
test eax, eax
je 0x402ee6
mov edx, eax
lea ecx, [esp + 0x378]
call fcn.00401480
push dword [esp + 8]
mov byte [esp + 0x13], al
call fcn.00404486
add esp, 4
cmp byte [esp + 0xf], 0
je 0x402ed5
mov ecx, dword [esp + 0x120]
inc edi
lea eax, [ecx + 1]
cmp edi, eax
jb 0x402dc0
push 0
push str.EnableFakeParentProcess
push ecx
mov ecx, esi
call fcn.004010c0
xor ecx, ecx
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
test eax, eax
jne 0x4036c5
push eax
push eax
push 1
lea eax, [esp + 0x40]
movlpd qword [esp + 0x174], xmm0
push eax
mov dword [esp + 0x44], 0xc
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword ds:[esp + 0x18], eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x402ef7
push 0x10
push 0x41cc58
push str.Failed_to_create_event_
jmp 0x403e60
push 0x10
push 0x41cc58
push str.Failed_to_patch_4GB_flag_in_exe_
jmp 0x403e60
push 0x10
push 0x41cc58
push str.Failed_to_get_the_exe_name__4GB_patch__
jmp 0x403e60
push 0
push str.EnableMitigationsOnChildProcess
push ecx
mov ecx, esi
mov dword [esp + 0x178], eax
call fcn.004010c0
push 0x44
push 0
cmp eax, 1
jne 0x4035f7
lea eax, [esp + 0x4c]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x15c], xmm0
call fcn.00406000
add esp, 0xc
mov dword [esp + 0x11c], 0
lea eax, [esp + 0x168]
mov dword [esp + 0x40], 0x48
mov dword [esp + 0x74], eax
mov eax, 8
mov word [esp + 0x72], ax
lea eax, [esp + 0x11c]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov edi, dword [esp + 0x11c]
test edi, edi
jne 0x402f8a
push 0x10
push 0x41cc58
push str.Failed_to_get_size_required_for_attribute_list___Mitigations_
jmp 0x403e60
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x84], eax
test eax, eax
jne 0x402fb6
push 0x10
push 0x41cc58
push str.HeapAlloc_Fatal_Error___Mitigations_
jmp 0x403e60
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x4035cb
test edi, edi
je 0x4035cb
lea eax, [esp + 0x11c]
push eax
push 0
push 1
push dword [esp + 0x90]
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x40301e
push dword ds:[esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc58
push str.InitializeProcThreadAttributeList_Failed___Mitigations_
jmp 0x403e60
push 0
push 0x41d7c8
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403047
or dword [esp + 0x150], eax
mov eax, dword [esp + 0x154]
mov dword [esp + 0x154], eax
push 0
push str.SEHOP
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403071
mov eax, dword [esp + 0x154]
or dword [esp + 0x150], 4
mov dword [esp + 0x154], eax
push 0
push str.HeapTerminate
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x4030a3
mov eax, dword [esp + 0x154]
or dword [esp + 0x150], 0x1000
mov dword [esp + 0x154], eax
push 0
push str.ForceRelocateImages
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x4030d0
mov eax, dword [esp + 0x154]
or dword [esp + 0x150], 0x100
mov dword [esp + 0x154], eax
push 0
push str.BottomUpASLR
push ecx
mov ecx, esi
call fcn.004010c0
nop
cmp eax, 1
jne 0x4030fe
mov eax, dword [esp + 0x154]
or dword [esp + 0x150], 0x10000
mov dword [esp + 0x154], eax
push 0
push str.HighEntropyASLR
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x40312b
mov eax, dword [esp + 0x154]
or dword [esp + 0x150], 0x100000
mov dword [esp + 0x154], eax
push 0
push str.RelocationsRequired
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403158
mov eax, dword [esp + 0x154]
or dword [esp + 0x150], 0x300
mov dword [esp + 0x154], eax
push 0
push str.StrictHandleChecks
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403185
mov eax, dword [esp + 0x154]
or dword [esp + 0x150], 0x1000000
mov dword [esp + 0x154], eax
push 0
push str.Win32kSystemCallDisable
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x4031b2
mov eax, dword [esp + 0x154]
or dword [esp + 0x150], 0x10000000
mov dword [esp + 0x154], eax
push 0
push str.ExtensionPointDisable
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x4031e0
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 1
mov dword [esp + 0x150], eax
push 0
push 0x41d908
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x40320d
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 0x100
mov dword [esp + 0x150], eax
push 0
push str.CFGExportSuppression
push ecx
mov ecx, esi
call fcn.004010c0
nop dword [eax]
cmp eax, 1
jne 0x40323e
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 0x300
mov dword [esp + 0x150], eax
push 0
push str.StrictCFG
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x40326b
mov eax, dword [esp + 0x15c]
or dword [esp + 0x158], 0x100
mov dword [esp + 0x15c], eax
push 0
push str.DynamicCodeDisable
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403295
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 0x10
mov dword [esp + 0x150], eax
push 0
push str.DynamicCodeAllowOptOut
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x4032c0
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 0x30
mov dword [esp + 0x150], eax
push 0
push str.BlockNonMicrosoftBinaries
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x4032ed
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 0x1000
mov dword [esp + 0x150], eax
push 0
push str.FontDisable
push ecx
mov ecx, esi
call fcn.004010c0
nop dword [eax]
cmp eax, 1
jne 0x40331e
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 0x10000
mov dword [esp + 0x150], eax
push 0
push str.NoRemoteImages
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x40334b
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 0x100000
mov dword [esp + 0x150], eax
push 0
push str.NoLowLabelImages
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403378
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 0x1000000
mov dword [esp + 0x150], eax
push 0
push str.PreferSystem32
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x4033a5
mov eax, dword [esp + 0x150]
or dword [esp + 0x154], 0x10000000
mov dword [esp + 0x150], eax
push 0
push str.RestrictIndirectBranchPrediction
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x4033d2
mov eax, dword [esp + 0x15c]
or dword [esp + 0x158], 0x10000
mov dword [esp + 0x15c], eax
push 0
push str.SpeculativeStoreBypassDisable
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403403
mov eax, dword [esp + 0x15c]
or dword [esp + 0x158], 0x1000000
mov dword [esp + 0x15c], eax
push 0
push str.ShadowStack
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403430
mov eax, dword [esp + 0x15c]
or dword [esp + 0x158], 0x10000000
mov dword [esp + 0x15c], eax
push 0
push str.ContextIPValidation
push ecx
mov ecx, esi
call fcn.004010c0
nop
cmp eax, 1
jne 0x40345b
mov eax, dword [esp + 0x158]
or dword [esp + 0x15c], 1
mov dword [esp + 0x158], eax
push 0
push str.BlockNonCETEHCONT
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403485
mov eax, dword [esp + 0x158]
or dword [esp + 0x15c], 0x30
mov dword [esp + 0x158], eax
push 0
push str.BlockFSCTL
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x4034b2
mov eax, dword [esp + 0x158]
or dword [esp + 0x15c], 0x1000000
mov dword [esp + 0x158], eax
push 0
push 0
push 0x10
lea eax, [esp + 0x15c]
push eax
push 0x20007
push 0
push dword [esp + 0x9c]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x4034e9
push 0x10
push 0x41cc58
push str.UpdateProcThreadAttribute_Failed___Mitigations_
jmp 0x403e60
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0x80004
push 1
push 0
push 0
lea eax, [esp + 0xbb8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403585
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x403570
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403570
push 0x10
push str.CreateProcess_Error__Mitigations_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc58
push str.Failed_to_start_exe___Mitigations_
jmp 0x403e60
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov eax, dword [esp + 0x84]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub edi, 1
jne 0x4035a0
push dword [esp + 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x403990
push dword [esp + 0x84]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc58
push str.HeapSize_Failed___Mitigations_
jmp 0x403e60
lea eax, ds:[esp + 0xd8]
push eax
call fcn.00406000
add esp, 0xc
mov dword [esp + 0xd0], 0x44
lea eax, [esp + 0x168]
mov dword [esp + 0x104], eax
mov eax, 8
mov word [esp + 0x102], ax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xd4]
push eax
push 0
push 0
push 4
push 1
push 0
push 0
lea eax, [esp + 0xbb8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403990
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4036b0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4036b0
push 0x10
push str.CreateProcess_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc58
push str.Failed_to_start_exe_
jmp 0x403e60
push 0x44
lea eax, [esp + 0x90]
push 0
push eax
call fcn.00406000
add esp, 0xc
mov dword [esp + 0x120], 0
lea eax, [esp + 0x120]
mov dword [esp + 0x88], 0x48
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov edi, dword [esp + 0x120]
test edi, edi
jne 0x403725
push 0x10
push 0x41cc58
push str.Failed_to_get_size_required_for_attribute_list___FakeParentProcess_
jmp 0x403e60
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword ds:[esp + 0xcc], eax
test eax, eax
jne 0x403755
push 0x10
push 0x41cc58
push str.HeapAlloc_Fatal_Error___FakeParentProcess_
jmp 0x403e60
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x403e2d
test edi, edi
je 0x403e2d
lea eax, [esp + 0x120]
push eax
push 0
push 1
push dword [esp + 0xd8]
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x4037be
push dword ds:[esp + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc58
push str.InitializeProcThreadAttributeList_Failed___FakeParentProcess_
jmp 0x403e60
push str.FakeParentProcess
push ecx
mov ecx, esi
call fcn.00401160
mov dword [esp + 0x11c], eax
test eax, eax
jne 0x4037e7
push 0x10
push 0x41cc58
push str.Failed_to_get_fake_parent_process_exe_name_
jmp 0x403e60
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
xor edx, edx
mov ecx, eax
call fcn.00402460
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40384f
push 0xc8
push eax
lea eax, [esp + 0x178]
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x170]
push dword [esp + 8]
push str.Failed_to_get_fake_parent_process_handle__Error:_u
push 0xffffffffffffffff
push 0x64
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0x170]
push 0x10
push 0x41cc58
push eax
jmp 0x403e60
push 0
push 0
push 4
lea eax, [esp + 0x28]
push eax
push 0x20000
push 0
push dword [esp + 0xe4]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x40388d
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc58
push str.UpdateProcThreadAttribute_Failed__FakeParentProcess__
jmp 0x403e60
push dword [esp + 0x11c]
call fcn.00404486
add esp, 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x8c]
push eax
push 0
push 0
push 0x80004
push 0
push 0
push 0
lea eax, [esp + 0xbb8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403945
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x403930
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403930
push 0x10
push str.CreateProcess_Error__FakeParentProcess_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc58
push str.Failed_to_start_exe__FakeParentProcess__
jmp 0x403e60
push dword [esp + 0xcc]
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov eax, dword [esp + 0xcc]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub edi, 1
jne 0x403960
push dword [esp + 0xcc]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x421448], 0x3fab
jae 0x4039a5
cmp dword [0x421444], 0xa
jbe 0x4039c6
push 4
lea eax, [esp + 0x128]
mov dword [esp + 0x128], 1
push eax
push 0xd
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0x41e044
push ecx
mov ecx, esi
call fcn.00401160
mov edi, eax
test edi, edi
jne 0x4039ea
push 0x10
push 0x41cc58
push str.Failed_to_get_dll_name_
jmp 0x403a58
cmp dword [esp + 0x10], 0
push edi
jne 0x403a18
lea eax, [esp + 0x37c]
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [esp + 0x9a0]
push 0x104
push eax
call fcn.00401030
add esp, 0x18
jmp 0x403a34
push 0x41d32c
push 0xffffffffffffffff
lea eax, [esp + 0x99c]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
push edi
mov dword [esp + 0xc], eax
call fcn.00404486
add esp, 4
cmp dword [esp + 8], 0xffffffff
jne 0x403ad2
push 0x10
push 0x41cc58
push str.Unable_to_get_full_dll_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x403a75
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
cmp eax, 0xffffffff
jne 0x403aa6
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
push 0x41cc58
push str.ResumeThread_Failed___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xfa4]
xor ecx, esp
call fcn.00404478
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x41cde4
push ecx
mov ecx, esi
call fcn.004010c0
test eax, eax
je 0x403bd0
inc eax
mov edi, 1
mov dword [esp + 0x124], eax
cmp eax, edi
jbe 0x403bd0
lfence
nop dword [eax + eax]
push 0x208
lea eax, [esp + 0x174]
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x170]
push edi
push str.FileToCreate__zu
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
je 0x403bc2
lea eax, ds:[esp + 0x170]
push eax
push ecx
mov ecx, esi
call fcn.00401160
mov dword [esp + 8], eax
test eax, eax
je 0x403cbc
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word ds:[ecx]
add ecx, 2
test ax, ax
jne 0x403b76
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf
jbe 0x403ba8
push 0x10
push 0x41cc58
push str.Name_of_the_file_to_create_is_too_long_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403bb6
lfence
mov ecx, dword [esp + 8]
xor dl, dl
call fcn.004023a0
push dword [esp + 8]
call fcn.00404486
add esp, 4
inc edi
cmp edi, dword [esp + 0x124]
jb 0x403b10
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x12c]
mov byte [esp + 0x11f], 0
push eax
lea eax, [esp + 0x123]
mov dword [esp + 0x130], 0
push eax
lea edx, [esp + 0x99c]
mov dword [esp + 0x138], 0
call fcn.00401a40
add esp, 0xc
test al, al
jne 0x403d52
cmp byte [esp + 0x11b], 1
jne 0x403ced
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.00402600
push 0x208
lea eax, [esp + 0x174]
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x170]
push dword [esp + 0x12c]
push dword [esp + 0x12c]
push str.Failed_to_inject_dll__Fatal_Error______d._d_
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x18
lea eax, [esp + 0x170]
push 0x10
push 0x41cc58
push eax
jmp 0x403e60
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc58
push str.Failed_to_get_the_name_of_the_file_to_create_
jmp 0x403e60
mov ecx, esi
call fcn.00402600
push 0x208
lea eax, [esp + 0x174]
push 0
push eax
call fcn.00406000
add esp, 0xc
lea eax, [esp + 0x170]
push dword [esp + 0x128]
push dword [esp + 0x130]
push str.Failed_to_inject_dll__Normal_Error______d._d_
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x18
lea eax, [esp + 0x170]
push 0x10
push 0x41cc58
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [esp + 0x18]
jmp 0x403d7f
mov edi, dword [esp + 0x18]
test edi, edi
je 0x403d8b
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x403d7f
push 0x10
push 0x41cc58
push str.Error_while_waiting_for_patching_event_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop
test edi, edi
je 0x403d8b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x403dc9
push 0
push dword [esp + 0x24]
mov byte [esp + 0x123], 1
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, esi
call fcn.00402600
push 0x10
push 0x41cc58
push str.ResumeThread_Failed___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [esp + 0x11b], 0
jne 0x403aa6
push 1
push str.WaitForProcessTermination
push ecx
mov ecx, esi
call fcn.004010c0
cmp eax, 1
jne 0x403aa6
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [eax + eax]
cmp eax, 0xffffffff
jne 0x403aa6
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, esi
call fcn.00402600
push 0x10
push 0x41cc58
push str.Fatal_Error_while_waiting_for_the_process_to_close_
jmp 0x403a9d
push dword [esp + 0xcc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc58
push str.HeapSize_Failed___FakeParentProcess_
jmp 0x403e60
push 0x10
push 0x41cc58
push str.Unable_to_get_RtlGetNtVersionNumbers_or_RtlImageNtHeaderEx_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0xfac]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00404478
mov esp, ebp
pop ebp
ret 0x10