Function at 0x419660
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa6c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
push str.InjectW_called_with_pData___p_n
push 0
call fcn.00428a80
push 0x418
lea eax, [ebp - 0x454]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
push 0
push dword [0x7ab5fc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4196b2
mov eax, 0x42
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test ebx, ebx
jne 0x41977b
push 0x208
lea eax, [ebp - 0x450]
mov dword [ebp - 0x40], 0x7e
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push str.pData_is_invalid_n
push ebx
call fcn.00428a80
sub esp, 0x404
lea esi, [ebp - 0x454]
mov edi, esp
mov ecx, 0x106
rep movsd dword es:[edi], dword [esi]
push 1
push 0xffffffffffffffff
push ebx
push 0
call fcn.00419230
add esp, 0x428
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [0x7ab5fc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x7ab4e8]
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp - 0xc], esi
call esi
push dword [0x7ab4ec]
call esi
mov ecx, dword [0x4ad010]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
test ecx, ecx
je 0x41ab9e
cmp byte [0x4ad014], 0
je 0x4197c9
cmp byte [ecx + 0x6c], 0
jne 0x41ab9e
lea eax, [ebp - 8]
push eax
call fcn.004161f0
test eax, eax
je 0x419801
push str.PDB_download_incomplete_or_imports_not_resolved_n
push 0
call fcn.00428a80
sub esp, 0x410
lea esi, [ebp - 0x454]
mov edi, esp
mov ecx, 0x106
rep movsd dword es:[edi], dword [esi]
push 0x37
push 0xffffffffffffffff
push ebx
jmp 0x419765
mov ecx, dword [0x4ad010]
test ecx, ecx
je 0x41ab9e
cmp byte [0x4ad014], 0
je 0x419822
cmp byte [ecx + 0x6c], 0
jne 0x41ab9e
mov eax, dword [ecx]
mov edx, dword [eax + 8]
movzx eax, byte [0x4ad014]
push eax
call edx
mov esi, dword [eax]
test esi, esi
je 0x419852
push esi
push str.Resolving_imports_failed:__08X_n
push 0
call fcn.00428a80
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 0x61c], 3
jne 0x41991f
call fcn.004166f0
test al, al
jne 0x41991f
push 0x208
lea eax, [ebp - 0x450]
mov dword [ebp - 0x40], 0x9c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push str.LdrpLoadDllInternal_is_only_supported_on_Windows_10_n
push 0
call fcn.00428a80
sub esp, 0x404
lea esi, [ebp - 0x454]
mov edi, esp
mov ecx, 0x106
rep movsd dword es:[edi], dword [esi]
push 0x3b
push 0xffffffffffffffff
push ebx
jmp 0x419765
push ebx
call fcn.00430170
add esp, 4
test al, al
jne 0x419a05
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x450]
push 0
push eax
mov dword [ebp - 0x40], 0xb0
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x454]
push str.File_doesnt_exist:__08X_n
push 0
call fcn.00428a80
sub esp, 0x400
lea esi, [ebp - 0x454]
mov edi, esp
mov ecx, 0x106
rep movsd dword es:[edi], dword [esi]
push 5
push 0xffffffffffffffff
push ebx
push ebx
call fcn.00419230
add esp, 0x428
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 0x618], 0
jne 0x419ad5
push 0x208
lea eax, [ebp - 0x450]
mov dword [ebp - 0x40], 0xb9
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push str.Invalid_process_identifier_specified_n
push 0
call fcn.00428a80
sub esp, 0x404
lea esi, [ebp - 0x454]
mov edi, esp
mov ecx, 0x106
rep movsd dword es:[edi], dword [esi]
push 6
push 0xffffffffffffffff
push ebx
push ebx
call fcn.00419230
add esp, 0x428
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test byte [ebx + 0x624], 0x20
je 0x419f25
push str.Copying_dll_into_temp_directory_n
push 0
call fcn.00428a80
add esp, 8
mov ecx, 0x104
mov eax, ebx
cmp word [eax], 0
je 0x419b06
add eax, 2
sub ecx, 1
jne 0x419af8
xor eax, eax
mov edi, 0x80070057
test ecx, ecx
mov edx, ecx
cmovne edi, eax
mov eax, 0x104
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x419fba
test edx, edx
je 0x419fba
lea esi, [ebx + edx*2]
sub esi, 2
cmp word [esi - 2], 0x5c
jne 0x419b34
push 0x208
lea eax, [ebp - 0x65c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x65c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x419c43
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x450]
push 0
push eax
mov dword [ebp - 0x40], 0xd6
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x454]
push str.GetTempPathW_failed:__08X_n
push 0
call fcn.00428a80
sub esp, 0x400
lea esi, [ebp - 0x454]
mov edi, esp
mov ecx, 0x106
rep movsd dword es:[edi], dword [esi]
push 0xb
push 0xffffffffffffffff
push ebx
push ebx
call fcn.00419230
add esp, 0x428
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x104
lea eax, [ebp - 0x65c]
nop
cmp word [eax], 0
je 0x419c5e
add eax, 2
sub ecx, 1
jne 0x419c50
mov eax, 0x104
mov edx, ecx
sub eax, ecx
mov edi, 0x80070057
neg edx
sbb edx, edx
and edx, eax
xor eax, eax
test ecx, ecx
mov dword [ebp - 4], edx
cmovne edi, eax
je 0x419cd2
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x65c]
mov edx, 0x104
lea ecx, [ecx + eax*2]
sub edx, eax
je 0x419cb9
mov eax, accept
sub esi, ecx
nop word [eax + eax]
test eax, eax
je 0x419cb9
movzx edi, word [ecx + esi]
test di, di
je 0x419cb9
mov word [ecx], di
dec eax
add ecx, 2
sub edx, 1
jne 0x419ca0
test edx, edx
lea eax, [ecx - 2]
mov edi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne edi, eax
test edi, edi
jns 0x419d73
push 0x208
lea eax, [ebp - 0x450]
mov dword [ebp - 0x454], edi
push 0
push eax
mov dword [ebp - 0x40], 0xe0
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push edi
push str.StringCchCatW_failed:__08X_n
jmp 0x41a04e
push 0
lea eax, [ebp - 0x65c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x419e60
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x450]
push 0
push eax
mov dword [ebp - 0x40], 0xe9
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x454]
push str.CopyFileW_failed:__08X_n
push 0
call fcn.00428a80
sub esp, 0x400
lea esi, [ebp - 0x454]
mov edi, esp
mov ecx, 0x106
rep movsd dword es:[edi], dword [esi]
push 0xc
push 0xffffffffffffffff
push ebx
push ebx
call fcn.00419230
add esp, 0x428
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x65c]
push eax
push 0x410
push ebx
call fcn.0041abb0
mov edi, eax
test edi, edi
jns 0x419f15
push 0x208
lea eax, [ebp - 0x450]
mov dword [ebp - 0x454], edi
push 0
push eax
mov dword [ebp - 0x40], 0xf3
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push edi
push str.StringCbCopyW_failed:__08X_n
jmp 0x41a04e
push ebx
push str.Path_of_dll_copy:__ls_n
push 0
call fcn.00428a80
add esp, 0xc
test byte [ebx + 0x624], 0x10
je 0x41a441
push str.Scrambling_dll_name_n
push 0
call fcn.00428a80
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x1c], 0
movq qword [ebp - 0x28], xmm0
call edi
mov esi, eax
mov dword [ebp - 8], 0
add esi, dword [ebx + 0x624]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 8]
add eax, esi
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
xor esi, esi
lea ebx, [esi + 0x1a]
call edi
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x41a084
call edi
cdq
mov ecx, 0xa
idiv ecx
add edx, 0x30
jmp 0x41a09b
push 0x208
lea eax, [ebp - 0x450]
mov dword [ebp - 0x454], edi
push 0
push eax
mov dword [ebp - 0x40], 0xc8
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push edi
push str.StringCchLengthW_failed:__08X_n
push 0
call fcn.00428a80
sub esp, 0x400
mov edi, esp
push 4
push 0xffffffffffffffff
mov ecx, 0x106
lea esi, [ebp - 0x454]
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
call fcn.00419230
add esp, 0x428
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edx, 1
jne 0x41a093
call edi
cdq
idiv ebx
add edx, 0x41
jmp 0x41a09b
call edi
cdq
idiv ebx
add edx, 0x61
movzx eax, dx
mov word [ebp + esi*2 - 0x38], ax
inc esi
cmp esi, 0xa
jne 0x419f96
xor eax, eax
mov dword [ebp - 0x24], 0x64002e
push 0x208
push eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x65c]
push eax
mov dword [ebp - 0x20], 0x6c006c
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x65c]
mov esi, ebx
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x41a10e
movzx eax, word [ecx + esi]
test ax, ax
je 0x41a10e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x41a0f0
test edx, edx
lea eax, [ecx - 2]
mov edi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne edi, eax
jne 0x41a1c5
push 0x208
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 0x454], edi
push eax
mov dword [ebp - 0x40], 0x125
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push edi
push str.StringCchCopyW_failed:__08X_n
jmp 0x41a04e
push 0x5c
push ebx
call sub.VCRUNTIME140.dll_wcsrchr
mov edx, eax
add esp, 8
test edx, edx
jne 0x41a287
push 0x208
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 0x40], 0x12f
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push str.wcsrchr_failed_n
push 0
call fcn.00428a80
add esp, 0x14
push dword [0x7ab5fc]
call dword [ebp - 0xc]
mov eax, 0x30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add edx, 2
lea eax, [ebp - 0x38]
push eax
mov ecx, edx
mov eax, 0x410
sub ecx, ebx
sar ecx, 1
sub eax, ecx
push eax
push edx
call fcn.0041abb0
mov edi, eax
test edi, edi
jns 0x41a361
push 0x208
lea eax, [ebp - 0x450]
mov dword [ebp - 0x454], edi
push 0
push eax
mov dword [ebp - 0x40], 0x141
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push edi
push str.StringCbCopyW_failed:__08X_n
push 0
call fcn.00428a80
add esp, 0x18
push dword [0x7ab5fc]
call dword [ebp - 0xc]
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x65c]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
add esp, 8
test eax, eax
je 0x41a431
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0x208
push 0
mov eax, dword [eax]
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x450]
push eax
mov dword [ebp - 0x40], 0x14d
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x454]
push str._wrename_failed:__08X_n
push 0
call fcn.00428a80
sub esp, 0x400
mov edi, esp
push 0xd
jmp 0x41a05f
push ebx
push str.Path_of_renamed_dll:__ls_n
push 0
call fcn.00428a80
add esp, 0xc
test byte [ebx + 0x624], 0x40
je 0x41a5b3
mov eax, dword [ebx + 0x62c]
test eax, eax
je 0x41a58e
push eax
push str.hHandleValue___08X_n
push 0
call fcn.00428a80
mov esi, dword [ebx + 0x62c]
add esp, 0xc
mov dword [ebp - 0x14], 0
test esi, esi
je 0x41aae9
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x41aae9
push str.Attached_to_target_process_n
push 0
call fcn.00428a80
push 0x410
lea eax, [ebp - 0xa6c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
mov dword [ebp - 0x18], 0x208
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xa6c]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x41a691
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x450]
push 0
push eax
mov dword [ebp - 0x40], 0x18a
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x454]
push str.QueryFullProcessImageNameW_failed:__08X_n
push 0
call fcn.00428a80
sub esp, 0x400
mov edi, esp
push 9
jmp 0x41a05f
push str.Forwarding_call_to_handle_hijacking_n
push 0
call fcn.00428a80
lea eax, [ebp - 0x454]
push eax
push ebx
call fcn.004185f0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [ebx + 0x618]
xor eax, eax
cmp dword [ebx + 0x620], eax
push 0
sete al
lea eax, [eax*2 + 0x1438]
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x41a472
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x450]
push esi
push eax
mov dword [ebp - 0x40], 0x172
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x454]
push str.OpenProcess_failed:__08X_n
push 0
call fcn.00428a80
sub esp, 0x400
mov edi, esp
push 7
jmp 0x41a05f
lea eax, [ebp - 0xa6c]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_wcsrchr
mov edx, eax
add esp, 8
test edx, edx
jne 0x41a74e
push 0x208
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 0x40], 0x194
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push str.wcsrchr_failed_n
push 0
call fcn.00428a80
sub esp, 0x404
mov edi, esp
push 0x38
jmp 0x41a05f
add edx, 2
je 0x41aa4b
mov eax, 0x104
mov ecx, edx
nop
cmp word [ecx], 0
je 0x41a76e
add ecx, 2
sub eax, 1
jne 0x41a760
xor ecx, ecx
mov edi, 0x80070057
test eax, eax
cmovne edi, ecx
je 0x41aa50
mov ecx, 0x104
sub ecx, eax
add ecx, ecx
neg eax
sbb eax, eax
test ecx, eax
jne 0x41a83e
push 0x208
lea eax, [ebp - 0x450]
mov dword [ebp - 0x454], 0
push 0
push eax
mov dword [ebp - 0x40], 0x1aa
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push str.Target_process_name_length_is_0_n
push 0
call fcn.00428a80
sub esp, 0x404
jmp 0x41a05b
push edx
push 0x208
lea edi, [ebx + 0x410]
push edi
call fcn.0041abb0
mov dword [ebp + 8], eax
test eax, eax
jns 0x41a8f6
push 0x208
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x450]
push 0
push eax
mov dword [ebp - 0x40], 0x1b4
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp + 8]
push str.StringCbCopyW_failed:__08X_n
jmp 0x41a04e
push edi
push str.Target_process_name___ls_n
push 0
call fcn.00428a80
push str.Validating_specified_file_n
push 0
call fcn.00428a80
push 0x14c
push ebx
call fcn.00430820
add esp, 0x1c
test eax, eax
je 0x41a9d0
push 0x208
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x450]
push 0
push eax
mov dword [ebp - 0x40], 0x1d1
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push str.Invalid_file_specified_n
push 0
call fcn.00428a80
sub esp, 0x404
mov edi, esp
push 0xa
push 1
jmp 0x41a061
push ebx
push str.File_validated_and_prepared_for_injection:_n__ls_n
push 0
call fcn.00428a80
lea eax, [ebp - 0x454]
mov dword [ebp - 0x10], 0
push eax
push dword [ebx + 0x628]
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x624]
push dword [ebx + 0x620]
push dword [ebx + 0x61c]
push esi
push ebx
call fcn.004178e0
push str.Injection_finished_n
push 0
mov dword [ebp + 8], eax
call fcn.00428a80
add esp, 0x34
test byte [ebx + 0x624], 0x40
jne 0x41aa30
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
sub esp, 0x418
mov edi, esp
mov dword [ebx + 0x630], eax
push dword [ebp + 8]
push 1
jmp 0x41a061
mov edi, 0x80070057
push 0x208
lea eax, [ebp - 0x450]
mov dword [ebp - 0x454], edi
push 0
push eax
mov dword [ebp - 0x40], 0x1a1
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push edi
push str.StringCbLengthW_failed:__08X_n
jmp 0x41a04e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x450]
push 0
push eax
mov dword [ebp - 0x40], 0x17d
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryInjection.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x450]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x48f6a4
call esi
add eax, eax
push eax
lea eax, [ebp - 0x248]
push 0x48f6a4
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x454]
push str.Invalid_process_handle:__08X_n
push 0
call fcn.00428a80
sub esp, 0x400
mov edi, esp
push 8
jmp 0x41a05f
push 4
call fcn.004175f0
int3