Function at 0x4014d0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create process on windows
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403350
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.004011f0
lea eax, [ebp - 0x258]
mov dword [ebp - 0x248], 0x44
push eax
lea eax, [ebp - 0x248]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1cc]
movlpd qword [ebp - 0x244], xmm0
push eax
mov ecx, 0x4c
movlpd qword [ebp - 0x23c], xmm0
mov esi, str.trgame.exe__eac_nop_loaded__elevated:t__p:3__pp:_Talesrunner_patch_new___ps:154.197.124.18__zone:154.197.124.18__zoneID:1__zoneName:HK_Test____hongkong
movlpd qword [ebp - 0x234], xmm0
lea edi, [ebp - 0x1cc]
movlpd qword [ebp - 0x22c], xmm0
rep movsd dword es:[edi], dword [esi]
push 0
movlpd qword [ebp - 0x224], xmm0
movlpd qword [ebp - 0x21c], xmm0
movlpd qword [ebp - 0x214], xmm0
movlpd qword [ebp - 0x20c], xmm0
movups xmmword [ebp - 0x258], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x4015d4
mov edx, str.CreateProcess_failed__
call fcn.00402070
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x404368
mov ecx, eax
call fcn.00402070
xor eax, eax
jmp 0x401f88
mov edx, str.Started_trgame.exe_with_PID:
call fcn.00402070
push dword [ebp - 0x250]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x404384
mov ecx, eax
call fcn.00402070
mov edi, dword [ebp - 0x250]
mov dword [ebp - 0x268], edi
mov byte [ebp - 0x1d2], 0x78
mov word [ebp - 0x1d8], 0x9090
mov word [ebp - 0x1dc], 0x6aeb
mov word [ebp - 0x1e0], 0x874
mov word [ebp - 0x1e4], 0x6a74
mov dword [ebp - 0x54], 0x14bb
mov word [ebp - 0x50], 0x9000
mov dword [ebp - 0x4c], 0x1dc9e8b
mov word [ebp - 0x48], 0
mov dword [ebp - 0x1c], 0x90909090
mov word [ebp - 0x18], 0x9090
mov byte [ebp - 0x16], 0x90
mov byte [ebp - 0x264], 0
mov dword [ebp - 0x24], 0x90909090
mov word [ebp - 0x20], 0x9090
mov byte [ebp - 0x1d1], 0xeb
mov dword [ebp - 0x64], 0x92e9
mov word [ebp - 0x60], 0x9000
mov dword [ebp - 0x5c], 0x90e9
mov word [ebp - 0x58], 0x9000
mov dword [ebp - 0x78], 0x33353139
mov dword [ebp - 0x74], 0xcff500
mov dword [ebp - 0x70], 0x28259c0
mov dword [ebp - 0x6c], 0xcff594
mov byte [ebp - 0x68], 4
mov dword [ebp - 0x44], 0x2e343531
mov dword [ebp - 0x40], 0x2e373931
mov dword [ebp - 0x3c], 0x2e323031
mov dword [ebp - 0x38], 0x323032
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x30], 0xf
mov dword [ebp - 0x2c], 0x90909090
mov word [ebp - 0x28], 0x9090
push edi
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40172d
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_open_process._Error:
call fcn.00402070
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x402290
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4017ca
push edi
push 0x401470
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, str.trgame.exe
mov ecx, edi
call fcn.004013c0
mov ecx, dword [ebp - 0x268]
mov edi, eax
mov edx, str.DINPUT8.dll
mov dword [ebp - 0x25c], edi
call fcn.004013c0
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x200]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x401798
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_get_exit_code_of_process._Error:
call fcn.00402070
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
jmp 0x4017b4
cmp dword [ebp - 0x200], 0x103
je 0x4017e2
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.trgame.exe_has_exited.
call fcn.00402070
push 0x402290
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x258]
call esi
push dword [ebp - 0x254]
call esi
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0
push 1
lea ecx, [ebp - 0x1d3]
lea eax, [edi + 0x1161154]
push ecx
push eax
push esi
mov dword [ebp - 0x1d0], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [ebp - 0x1d3]
cmp al, 0xf
jne 0x401a20
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Game_Running..._n
call fcn.00402070
push 0
push 0x40
push 4
add edi, 0xafceb0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x25c]
push 0
push 0x40
push 4
add eax, 0xf00470
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x25c]
push 0
push 0x40
push 4
add eax, 0xf0f240
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x25c]
push 0
push 0x40
push 4
add eax, 0xf004e5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 7
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [ebp - 0x25c]
lea eax, [ebp - 0x1c]
push 0
push 7
push eax
lea eax, [edi + 0xf00470]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 7
lea eax, [ebp - 0x1c]
push eax
lea eax, [edi + 0xf0f240]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 7
lea eax, [ebp - 0x1c]
push eax
lea eax, [edi + 0xf004e5]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x40
push 4
add edi, 0x7e7d87
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x25c]
push 0
push 0x40
push 4
add eax, 0x7e77ac
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 6
lea eax, [ebp - 0x2c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [ebp - 0x25c]
lea eax, [ebp - 0x2c]
push 0
push 6
push eax
lea eax, [edi + 0x7e77ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x40
push 4
lea eax, [edi + 0x1161154]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0x40
push 4
add edi, 0x116115c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 6
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1d0]
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 6
lea eax, [ebp - 0x24]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [ebp - 0x25c]
push 0
push 0x40
push 4
add edi, 0x11632bc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x1d1]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [ebp - 0x25c]
push 0
push 0x40
push 4
add edi, 0x11631e3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 6
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [ebp - 0x25c]
push 0
push 0x40
push 4
add edi, 0x116347d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 6
lea eax, [ebp - 0x5c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Game_Connect..._n
call fcn.00402070
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x268]
jmp 0x4016e3
cmp al, 0x90
jne 0x401f35
push 0
push 0x40
push 4
add edi, 0x155a850
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x1d2]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [ebp - 0x25c]
lea eax, [ebp - 0x44]
push 0
push 0x15
push eax
lea eax, [edi + 0x18759f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x15
lea eax, [ebp - 0x44]
push eax
lea eax, [edi + 0x1878490]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x15
lea eax, [ebp - 0x44]
push eax
lea eax, [edi + 0x187904c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x15
lea eax, [ebp - 0x44]
push eax
lea eax, [edi + 0x18aee1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x11
lea eax, [ebp - 0x78]
push eax
lea eax, [edi + 0x18aee34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [edi + 0x18783c0]
mov dword [ebp - 0x1d0], 0
push eax
lea eax, [ebp - 0x1d0]
mov edx, esi
push eax
call fcn.00401370
add esp, 8
mov dword [ebp - 0x1d0], eax
lea ecx, [ebp - 0x1fc]
push 0
push 4
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1fc], 0x5f6c6572
jne 0x401b76
push 0
push 0x24
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x5f6c6572
push eax
push dword [ebp - 0x1d0]
mov dword [ebp - 0x98], 0x34303363
push esi
mov dword [ebp - 0x94], 0x34656265
mov dword [ebp - 0x90], 0x61653565
mov dword [ebp - 0x8c], 0x34343361
mov dword [ebp - 0x88], 0x66633661
mov dword [ebp - 0x84], 0x32313430
mov dword [ebp - 0x80], 0x62356533
mov dword [ebp - 0x7c], 0x37376266
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 4
lea eax, [ebp - 0x1f8]
push eax
lea eax, [edi + 0x1a44f3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [ebp - 0x1f4]
push eax
lea eax, [edi + 0x18ac590]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [ebp - 0x1e8]
push eax
lea eax, [edi + 0x18ac550]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [ebp - 0x1ec]
push eax
lea eax, [edi + 0x18ac538]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [ebp - 0x1f0]
push eax
lea eax, [edi + 0x18ac5cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [ebp - 0x204]
push eax
lea eax, [edi + 0x1a45574]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x1f8]
cmp ecx, 0x41
jne 0x401c1c
lea eax, [ecx - 0x40]
jmp 0x401c2d
mov eax, dword [ebp - 0x264]
xor edx, edx
cmp ecx, 0x42
movzx eax, al
cmove eax, edx
cmp dword [ebp - 0x1f4], 0x271f
mov dword [ebp - 0x264], eax
jne 0x401eb7
cmp dword [ebp - 0x1f0], 1
jle 0x401eb7
cmp al, 1
jne 0x401eb7
mov edi, dword [ebp - 0x260]
push 0
push 0x40
push 4
add edi, 0xb24c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x1d8]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [ebp - 0x260]
push 0
push 0x40
push 4
add edi, 0xb254
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x1dc]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 1
push 0x201
push dword [0x4063dc]
call edi
push 0
push 1
push 0x202
push dword [0x4063dc]
call edi
mov edi, dword [ebp - 0x25c]
push 0
push 0x40
push 4
add edi, 0x3966ac
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 6
lea eax, [ebp - 0x54]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [ebp - 0x1ec], 0x10000
jne 0x401ddf
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x1b
push pe_nt_image_headers32
push dword [0x4063dc]
call esi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x1b
push pe_nt_image_headers32
push dword [0x4063dc]
call edi
push 0
push 0x1b
push 0x101
push dword [0x4063dc]
call edi
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x1d0], 0x3e8
push eax
lea ecx, [ebp - 0x274]
call fcn.004022c0
mov ecx, eax
call fcn.004022e0
push 0
push 0x79
push pe_nt_image_headers32
push dword [0x4063dc]
call esi
push 0
push 0x79
push pe_nt_image_headers32
push dword [0x4063dc]
call edi
push 0
push 0x79
push 0x101
push dword [0x4063dc]
call edi
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x1d0], 0x3e8
push eax
lea ecx, [ebp - 0x27c]
call fcn.004022c0
mov ecx, eax
call fcn.004022e0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x268]
jmp 0x4016e3
cmp dword [ebp - 0x1e8], 1
jne 0x401f35
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x1b
push pe_nt_image_headers32
push dword [0x4063dc]
call esi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x1b
push pe_nt_image_headers32
push dword [0x4063dc]
call edi
push 0
push 0x1b
push 0x101
push dword [0x4063dc]
call edi
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x1d0], 0x3e8
push eax
lea ecx, [ebp - 0x284]
call fcn.004022c0
mov ecx, eax
call fcn.004022e0
push 0
push 0x78
push pe_nt_image_headers32
push dword [0x4063dc]
call esi
push 0
push 0x78
push pe_nt_image_headers32
push dword [0x4063dc]
call edi
push 0
push 0x78
push 0x101
push dword [0x4063dc]
call edi
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x1d0], 0x3e8
push eax
lea ecx, [ebp - 0x28c]
call fcn.004022c0
mov ecx, eax
call fcn.004022e0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x268]
jmp 0x4016e3
push 0
push 0x40
push 4
add edi, 0x3966ac
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 6
lea eax, [ebp - 0x4c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [ebp - 0x260]
push 0
push 0x40
push 4
add edi, 0xb24c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x1e0]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [ebp - 0x260]
push 0
push 0x40
push 4
add edi, 0xb254
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0x1e4]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x268]
jmp 0x4016e3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040243c
mov esp, ebp
pop ebp
ret 0x10