Function at 0x401e70
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x100
mov ebx, ecx
mov esi, edx
push 0
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x401f63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push edi
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0xc
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x2c], eax
push 0x208
push edi
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x2c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x10600001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x24]
push ecx
push str.pRoutine___p_n
push 3
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 0x8bec8b55
mov dword [ebp - 0xc8], 0xc985084d
mov dword [ebp - 0xc4], 0x98b6d74
mov dword [ebp - 0xc0], 0x6774c985
mov dword [ebp - 0xbc], 0x13981
mov dword [ebp - 0xb8], 0x5f758000
mov word [ebp - 0xb4], 0xbb53
mov dword [ebp - 0xae], 0x75003b80
mov dword [ebp - 0xaa], 0x103c653
mov dword [ebp - 0xa6], 0x187b83
mov dword [ebp - 0xa2], 0x6a0574
mov dword [ebp - 0x9e], 0x8b1853ff
mov dword [ebp - 0x9a], 0xa8b1c53
mov dword [ebp - 0x96], 0x1374d139
mov dword [ebp - 0x92], 0x74204b3b
mov dword [ebp - 0x8e], 0xeb098b04
mov dword [ebp - 0x8a], 0x8b018bf3
mov dword [ebp - 0x86], 0x2890451
mov dword [ebp - 0x82], 0x83045089
mov dword [ebp - 0x7e], 0x7400187b
mov dword [ebp - 0x7a], 0xff016a05
mov dword [ebp - 0x76], 0x73ff1853
mov dword [ebp - 0x72], 0x1053ff0c
mov dword [ebp - 0x6e], 0x64044389
mov dword [ebp - 0x6a], 0x18a1
mov dword [ebp - 0x66], 0x34408b00
mov dword [ebp - 0x62], 0xc6084389
mov dword [ebp - 0x5e], 0xc8830203
mov dword [ebp - 0x5a], 0x3eb5bff
mov dword [ebp - 0x56], 0x5dc0315b
mov word [ebp - 0x52], 0x4c2
mov byte [ebp - 0x50], 0
mov dword [ebp - 0xb2], edi
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], esi
call fcn.0040e7c0
add esp, 0xc
push edi
push str.pArg_______p_n
push 3
call fcn.0040e7c0
mov eax, dword [0x459948]
lea ecx, [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0xc
add eax, 4
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
movlpd qword [ebp - 0x40], xmm0
push 0
push 8
push ecx
push eax
push ebx
call esi
test eax, eax
jne 0x4021cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0xf0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x2c], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x2c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, 0x10600003
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x15c]
call fcn.0041cc70
push ebx
lea ecx, [ebp - 0x15c]
mov dword [ebp - 4], 0
call fcn.0041ce00
test al, al
jne 0x4022a4
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], 0
push ebx
mov dword [esi + 0x414], 0xfa
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x2c], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x2c]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
add esp, 0xc
push 0x8000
push 0
push dword [ebp - 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10600005
jmp 0x4030be
cmp dword [ebp - 0x158], 0
je 0x403012
mov ecx, dword [0x459a18]
mov dword [ebp - 0x28], 0
test ecx, ecx
jne 0x40230f
mov esi, dword fs:[0x30]
test esi, esi
je 0x402398
mov edx, dword [esi + 0xa8]
mov ecx, dword [esi + 0xa4]
cmp edx, 0xa
jb 0x4022f1
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x4022e2
lea eax, [ecx + ecx*4]
lea ecx, [edx + eax*2]
movzx eax, word [esi + 0xac]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [0x459a18], ecx
mov dword [0x459a14], eax
cmp ecx, 0x3d
jne 0x402398
mov eax, dword [0x45996c]
push 0
mov dword [ebp - 0x44], eax
mov eax, dword [0x459964]
push 4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
push eax
push dword [0x459970]
mov dword [ebp - 0x38], 0
push dword [ebp - 0x14c]
mov dword [ebp - 0x2c], 0
call esi
push 0
mov esi, eax
lea eax, [ebp - 0x2c]
push 4
push eax
push dword [0x459968]
and esi, 1
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test esi, eax
je 0x403012
xor edx, edx
mov esi, dword [ebp - 0x38]
mov ecx, edx
mov eax, dword [ebp - 0x2c]
ror esi, cl
xor esi, dword [ebp - 0x44]
mov ecx, esi
and ecx, 0x1f
rol eax, cl
xor eax, esi
cmp eax, dword [ebp - 0x10]
je 0x4023b1
inc edx
cmp edx, 0x20
jl 0x402375
jmp 0x4023ae
push 0
push 4
lea eax, [ebp - 0x28]
push eax
push 0x24
push dword [ebp - 0x14c]
call dword [ebp - 0x144]
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x403012
cmp dword [0x459a14], 0x4a61
push 4
sbb eax, eax
and eax, 0xfffffff8
push 0x3000
add eax, 0x18
push eax
push 0
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x402489
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x11e
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, 0x10600001
jmp 0x4030be
push eax
push str.pNewEntry___p_n
push 3
call fcn.0040e7c0
mov edx, dword [ebp - 0x1c]
lea eax, [edi + 0x24]
mov ecx, esi
mov dword [ebp - 0xf4], 0
and ecx, 0x1f
xor esi, eax
mov eax, dword [ebp - 0x40]
add esp, 0xc
ror esi, cl
xorps xmm0, xmm0
cmp dword [0x459a14], 0x4a61
mov ecx, dword [ebp - 0x18]
movlpd qword [ebp - 0xfc], xmm0
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], ecx
jb 0x4024f6
lea eax, [edx + 0x14]
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf8], esi
jmp 0x402506
mov dword [ebp - 0x100], 1
mov dword [ebp - 0xfc], esi
mov eax, dword [0x459950]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0x108]
push eax
push edx
push ebx
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xd0], edx
call esi
test eax, eax
jne 0x4025d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x150
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
add esp, 0xc
jmp 0x402bd9
push 0
push 0xa1
lea eax, [ebp - 0xf0]
push eax
push edi
push ebx
call esi
test eax, eax
jne 0x40268f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x15e
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
add esp, 0xc
jmp 0x402bd9
lea ecx, [ebp - 0x15c]
call fcn.0041cf80
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x402760
mov esi, dword [ebp + 0x14]
push 0x208
push eax
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x16e
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x24]
push edi
call esi
mov esi, 0x10600006
jmp 0x4030be
push 0xb0
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x210]
add esp, 0xc
push 0
push 0xb0
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x402859
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x17b
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x24]
push edi
call esi
mov esi, 0x10600003
jmp 0x4030be
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1e8]
add ecx, 0x28
mov byte [ebp - 0x11], 0
test al, 4
jne 0x402932
push 0
or eax, 4
push 4
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0x1e8]
push eax
push ecx
push ebx
call esi
test eax, eax
jne 0x40292e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x18e
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
add esp, 0xc
jmp 0x402bd9
mov byte [ebp - 0x11], 1
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push 4
push 8
push dword [ebp - 0x18]
mov dword [ebp - 0x30], 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x402a07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x19f
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
add esp, 0xc
cmp byte [ebp - 0x11], 0
je 0x402bd9
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x402bbd
push 0
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push ebx
call esi
test eax, eax
jne 0x402ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x1b1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x30]
add esp, 0xc
push eax
push dword [ebp - 0x34]
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 8
push dword [ebp - 0x18]
push edi
call eax
jmp 0x4029f2
push 0
push 4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x40]
add eax, 4
push eax
push ebx
call esi
test eax, eax
jne 0x402c03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x1c5
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add esp, 0xc
push eax
push 4
push 8
push dword [ebp - 0x18]
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x40]
push 0
push 4
push eax
push dword [ebp - 0x18]
push edi
call esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 8
push dword [ebp - 0x18]
push edi
call ebx
cmp byte [ebp - 0x11], 0
je 0x402bd9
and dword [ebp - 0x1e8], 0xfffffffb
lea eax, [ebp - 0x1e8]
push 0
push 4
push eax
mov eax, dword [ebp - 0x28]
add eax, 0x28
push eax
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x24]
push edi
call esi
mov esi, 0x10600002
jmp 0x4030be
lea eax, [ebp - 0x30]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0x120
push 1
push dword [0x45994c]
push ebx
call eax
test eax, eax
jne 0x402d51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x1df
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add esp, 0xc
push eax
push 4
push 8
push dword [ebp - 0x18]
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x18]
push 0
push 4
push eax
mov eax, dword [ebp - 0x40]
add eax, 4
push eax
push edi
call esi
push 0
push 4
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x18]
push edi
call esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 8
push dword [ebp - 0x18]
push edi
call ebx
cmp byte [ebp - 0x11], 0
je 0x402d27
and dword [ebp - 0x1e8], 0xfffffffb
lea eax, [ebp - 0x1e8]
push 0
push 4
push eax
mov eax, dword [ebp - 0x28]
add eax, 0x28
push eax
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x24]
push edi
call esi
mov esi, 0x10600007
jmp 0x4030be
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x2c]
sbb edx, dword [ebp - 0x38]
test edx, edx
ja 0x402df5
jb 0x402dc0
cmp eax, esi
jae 0x402df5
nop word [eax + eax]
push 0xa
push dword [0x459958]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x18
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x120]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x402eb2
cmp dword [ebp - 0x120], 2
jne 0x402da4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x1c]
push ebx
call esi
cmp dword [ebp - 0x120], 2
je 0x402ff5
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], 0
push ebx
mov dword [esi + 0x414], 0x23a
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, 0x10600008
jmp 0x4030be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], eax
push ebx
mov dword [esi + 0x414], 0x210
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add esp, 0xc
push eax
push 4
push 8
push dword [ebp - 0x18]
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x18]
push 0
push 4
push eax
mov eax, dword [ebp - 0x40]
add eax, 4
push eax
push edi
call esi
push 0
push 4
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x18]
push edi
call esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push 8
push dword [ebp - 0x18]
push edi
call ebx
cmp byte [ebp - 0x11], 0
je 0x402fb5
and dword [ebp - 0x1e8], 0xfffffffb
lea eax, [ebp - 0x1e8]
push 0
push 4
push eax
mov eax, dword [ebp - 0x28]
add eax, 0x28
push eax
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x24]
push edi
call esi
cmp dword [ebp - 0x44], 0
jne 0x40284f
push dword [0x459954]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, 0x10000004
jmp 0x4030be
push 0x8000
push 0
push edi
push ebx
call esi
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [ebp - 0x11c]
mov dword [ecx], eax
jmp 0x4030be
mov esi, dword [ebp + 0x14]
push 0x208
push 0
lea ebx, [esi + 4]
mov dword [esi], 0
push ebx
mov dword [esi + 0x414], 0x106
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x20c]
mov dword [ebp - 0x10], eax
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryFakeVEH.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call edi
add eax, eax
push eax
push str.SR_FakeVEH
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x20]
add esp, 0xc
push 0x8000
push 0
push dword [ebp - 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10600004
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x4030cf
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x158]
test eax, eax
je 0x4030e2
push eax
call fcn.00438d2a
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret