Function at 0x402270
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x402940
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], edx
lea edx, [ebp - 0x58]
push ecx
push eax
push edx
call fcn.00427bd0
add esp, 0xc
mov eax, dword [ebp - 0x50]
movsd xmm0, qword [ebp - 0x58]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x7c]
movsd qword [ebp - 0x44], xmm0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], 0
push ecx
push eax
call fcn.00402950
add esp, 8
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x74]
add eax, eax
push 4
push 0x1000
mov dword [ebp - 0x20], eax
push eax
push 0
push dword [ebp + 0xc]
call sub.KERNEL32.dll_VirtualAllocEx
mov esi, dword [ebp + 8]
test eax, eax
je 0x402411
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x5c]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x40247e
push 0xc
push str.kernel32.dllCString::new_failed
lea eax, [ebp - 0x44]
push eax
call fcn.00423870
add esp, 0xc
cmp dword [ebp - 0x44], 0
jne 0x4027ab
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x6c], ecx
push 0xc
push str.LoadLibraryW.
lea eax, [ebp - 0x44]
push eax
call fcn.00423870
add esp, 0xc
cmp dword [ebp - 0x44], 0
jne 0x4027e8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x64], ecx
push dword [ebp - 0x28]
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x4024e5
push dword [ebp - 0x24]
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x402578
push 0
push 0
push dword [ebp - 0x20]
push eax
push 0
push 0
push dword [ebp + 0xc]
call sub.KERNEL32.dll_CreateRemoteThread
mov esi, dword [ebp + 8]
test eax, eax
je 0x40260b
mov dword [ebp - 0x20], eax
nop word [eax + eax]
push 0
push dword [ebp - 0x20]
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x402543
push 0xffffffffffffffff
push dword [ebp - 0x20]
call sub.KERNEL32.dll_WaitForSingleObject
jmp 0x4023f0
push 1
push 0x30
call fcn.00402f90
add esp, 8
test eax, eax
je 0x402822
movsd xmm1, qword [0x43965e]
movsd xmm2, qword [0x439656]
movsd xmm0, qword [0x439666]
mov ecx, 0x30
mov edx, 0x30
movsd qword [eax + 0x20], xmm1
movsd xmm1, qword [0x43964e]
movsd qword [eax + 0x18], xmm2
movsd xmm2, qword [0x439646]
movsd qword [eax + 0x28], xmm0
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [0x43963e]
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
jmp 0x4024d1
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x44], 0x4396ac
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x64], fcn.00428730
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x30], 1
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00423b80
add esp, 8
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [esi], 1
jmp 0x402781
push 1
push 0x29
call fcn.00402f90
add esp, 8
test eax, eax
je 0x402830
movsd xmm2, qword [0x439718]
movsd xmm1, qword [0x439710]
mov cl, byte [0x439728]
movsd xmm0, qword [0x439720]
movsd qword [eax + 0x18], xmm2
movsd qword [eax + 0x10], xmm1
movsd xmm2, qword [0x439708]
movsd xmm1, qword [str.Failed_to_get_the_handle_of_kernel32.dll.Failed_to_get_the_address_of_LoadLibraryA.Failed_to_create_a_remote_thread_in_the_target_process.Failed_to_load_dllGetExitCodeThread_returns_falsecalled__Option::unwrap____on_a__None__value_rustc_de1bc0008be096cf7ed67b93402250d3b3e480d0library_alloc_srccollections_btree_navigate.rs]
mov byte [eax + 0x28], cl
mov ecx, 0x29
movsd qword [eax + 0x20], xmm0
jmp 0x4025d3
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0
push eax
push dword [ebp - 0x20]
call sub.KERNEL32.dll_GetExitCodeThread
test eax, eax
je 0x402683
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x4026d9
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0
jmp 0x402729
push 1
push 0x2a
call fcn.00402f90
add esp, 8
test eax, eax
je 0x40283e
movsd xmm2, qword [0x439741]
movsd xmm1, qword [0x439739]
movzx ecx, word [0x439751]
movsd xmm0, qword [0x439749]
movsd qword [eax + 0x18], xmm2
movsd qword [eax + 0x10], xmm1
movsd xmm2, qword [0x439731]
movsd xmm1, qword [0x439729]
mov word [eax + 0x28], cx
movsd qword [eax + 0x20], xmm0
mov ecx, 0x2a
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x48]
mov edi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi], 1
test ebx, ebx
mov byte [edx], 0
je 0x40276b
push 1
push ebx
push edx
jmp 0x402763
push 1
push 0x37
call fcn.00402f90
add esp, 8
test eax, eax
je 0x40284c
movsd xmm0, qword [0x439782]
movsd xmm1, qword [0x439773]
movsd xmm2, qword [0x43977b]
mov ecx, 0x37
movsd qword [eax + 0x2f], xmm0
movsd qword [eax + 0x28], xmm2
movsd qword [eax + 0x20], xmm1
movsd xmm2, qword [0x43976b]
movsd xmm1, qword [0x439763]
movsd qword [eax + 0x18], xmm2
movsd qword [eax + 0x10], xmm1
movsd xmm2, qword [0x43975b]
movsd xmm1, qword [0x439753]
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
jmp 0x4025df
push 1
push 0x1f
call fcn.00402f90
add esp, 8
test eax, eax
je 0x40285a
movsd xmm0, qword [0x4397b3]
movsd xmm1, qword [0x4397ac]
movsd xmm2, qword [0x4397a4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x1f
mov dword [ebp - 0x38], 0x1f
movsd qword [eax + 0x17], xmm0
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [0x43979c]
movsd qword [eax + 8], xmm2
jmp 0x40271e
push 1
push 0x12
call fcn.00402f90
add esp, 8
test eax, eax
je 0x402868
movzx ecx, word [0x43979a]
movsd xmm0, qword [0x439792]
movsd xmm1, qword [0x43978a]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x12
mov dword [ebp - 0x38], 0x12
mov word [eax + 0x10], cx
movsd qword [eax + 8], xmm0
movsd qword [eax], xmm1
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 3
push eax
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x48]
movsd xmm0, qword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
test ecx, ecx
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov byte [eax], 0
je 0x40276b
push 1
push ecx
push eax
call fcn.00402fa0
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov byte [edi], 0
test eax, eax
je 0x402781
push 1
push eax
push edi
call fcn.00402fa0
add esp, 0xc
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x402798
add eax, eax
push 2
push eax
push dword [ebp - 0x5c]
call fcn.00402fa0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x40]
movsd xmm1, qword [ebp - 0x38]
mov dword [ebp - 0x10], 5
movsd qword [ebp - 0x50], xmm1
movsd qword [ebp - 0x58], xmm0
push 0x4396d4
push 0x4395fc
lea eax, [ebp - 0x58]
push eax
push 0x13
push 0x4396c0
call fcn.00438450
add esp, 0x14
jmp 0x402874
movsd xmm0, qword [ebp - 0x40]
movsd xmm1, qword [ebp - 0x38]
mov dword [ebp - 0x10], 4
movsd qword [ebp - 0x50], xmm1
movsd qword [ebp - 0x58], xmm0
push 0x4396f0
push 0x4395fc
lea eax, [ebp - 0x58]
push eax
push 0x13
push 0x4396c0
call fcn.00438450
add esp, 0x14
jmp 0x402874
push 1
push 0x30
call fcn.00438290
add esp, 8
jmp 0x402874
push 1
push 0x29
call fcn.00438290
add esp, 8
jmp 0x402874
push 1
push 0x2a
call fcn.00438290
add esp, 8
jmp 0x402874
push 1
push 0x37
call fcn.00438290
add esp, 8
jmp 0x402874
push 1
push 0x1f
call fcn.00438290
add esp, 8
jmp 0x402874
push 1
push 0x12
call fcn.00438290
add esp, 8
ud2