Function at 0x408e10
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
push ebx
push esi
push str._PROCESS_HOLLOWING__n
call fcn.0051d8c5
add esp, 4
test edi, edi
je 0x409131
push edi
push str.___PE_file_content_:_0x_p_n
call fcn.0051d8c5
mov eax, dword [edi + 0x3c]
add esp, 8
cmp dword [edi + eax], 0x4550
je 0x408e70
push str.____The_PE_file_is_not_valid___n
call fcn.0051d8c5
add esp, 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___The_PE_file_is_valid._n
call fcn.0051d8c5
add esp, 4
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.0051f8c0
mov ecx, dword [ebp + 8]
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 4
push 1
push 0
push 0
push 0
push ecx
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408eef
push str.____An_error_is_occured_when_trying_to_create_the_target_process___n
call fcn.0051d8c5
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.00408710
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0xc], 0
je 0x409124
lea esi, [esp + 0x10]
call fcn.004085a0
mov esi, edx
test esi, esi
je 0x40911a
test eax, eax
je 0x40911a
push eax
push str.___Target_Process_PEB_:_0x_p_n
call fcn.0051d8c5
push esi
push str.___Target_Process_Image_Base_:_0x_p_n
call fcn.0051d8c5
mov ecx, dword [edi + 0x3c]
mov edx, 0x10b
add esp, 0x10
cmp word [ecx + edi + 0x18], dx
jne 0x408f59
mov ebx, 1
push str.___Source_PE_Image_architecture_:_x86_n
jmp 0x408f60
xor ebx, ebx
push str.___Source_PE_Image_architecture_:_x64_n
call fcn.0051d8c5
add esp, 4
cmp dword [esp + 0xc], 0
je 0x408f76
push str.___Target_PE_Image_architecture_:_x86_n
jmp 0x408f7b
push str.___Target_PE_Image_architecture_:_x64_n
call fcn.0051d8c5
add esp, 4
test ebx, ebx
je 0x408fa4
cmp dword [esp + 0xc], 0
jne 0x408fab
push str.____Architecture_are_not_compatible___n
call fcn.0051d8c5
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], 0
jne 0x408f8e
push str.___Architecture_are_compatible___n
call fcn.0051d8c5
add esp, 4
test ebx, ebx
je 0x409104
mov eax, dword [edi + 0x3c]
movzx ebx, word [eax + edi + 0x5c]
cmp ebx, 0xffffffff
jne 0x408fd7
push str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_source_image._n
jmp 0x408ed3
push ebx
push str.___Source_Image_subsystem_:_0x_X_n
call fcn.0051d8c5
add esp, 8
cmp dword [esp + 0xc], 0
je 0x4090ee
mov ecx, esi
mov esi, dword [esp + 0x10]
call fcn.00408640
mov esi, eax
cmp esi, 0xffffffff
jne 0x40900c
push str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
jmp 0x408ed3
push esi
push str.___Target_Process_subsystem_:_0x_X_n
call fcn.0051d8c5
add esp, 8
cmp ebx, esi
jne 0x4090e4
push str.___Subsytems_are_compatible._n
call fcn.0051d8c5
mov ecx, dword [edi + 0x3c]
add esp, 4
cmp dword [ecx + edi + 0xa0], 0
jne 0x40907a
push str.___The_source_image_doesnt_have_a_relocation_table._n
call fcn.0051d8c5
add esp, 4
push edi
lea ecx, [esp + 0x14]
call fcn.00408790
add esp, 4
test eax, eax
je 0x409095
push str.___The_injection_has_succeed___n
call fcn.0051d8c5
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.00408750
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___The_source_image_has_a_relocation_table._n
call fcn.0051d8c5
add esp, 4
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00408a00
jmp 0x409053
push str.____The_injection_has_failed___n
call fcn.0051d8c5
add esp, 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4090c3
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409131
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x10]
push eax
call esi
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____Subsytems_are_not_compatible._n
jmp 0x408ed3
push str.____Target_PE_Image_architecture_not_x86_n
call fcn.0051d8c5
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___Source_PE_Image_architecture_not_x86_n
call fcn.0051d8c5
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
jmp 0x408ed3
push str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
call fcn.0051d8c5
add esp, 4
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret