Function at 0x402780
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Create pipe
Create process on windows
Create process suspended
Create thread
Read file on windows
Resume thread
Spoof parent pid
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xd28
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0xd24], eax
push esi
push edi
push 0x402720
call fcn.004083bf
add esp, 4
push 0x402740
call fcn.0040a82b
add esp, 4
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlImageNtHeaderEx
push esi
mov dword [0x422450], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x422450]
mov dword [0x422454], eax
test esi, esi
je 0x404554
nop dword [eax]
test eax, eax
je 0x404554
push 0x422670
push 0x422458
push 0x42245c
mov ecx, esi
call dword [0x4171ac]
nop
call esi
mov eax, dword [0x422670]
and eax, 0x7fff
cmp dword [0x42245c], 0xa
mov dword [0x422670], eax
jne 0x402858
nop word [eax + eax]
cmp eax, 0x4563
jae 0x402858
push 0x10
push 0x41cc78
push str.Update_Windows_10_to_Redstone_5__1809__or_above_
jmp 0x404560
push 4
lea eax, [esp + 0xac]
mov dword [esp + 0xac], 0xb
push eax
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0xb0], 3
push eax
push 3
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xb4]
mov dword [esp + 0xb4], 1
push eax
push 6
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], 1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xbc]
mov dword [esp + 0xbc], 4
push eax
push 7
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xc0]
mov dword [esp + 0xc0], 1
push eax
push 9
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xc4]
mov dword [esp + 0xc4], 3
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xc8]
mov dword [esp + 0xc8], 1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xcc]
mov dword [esp + 0xcc], 0xf
push eax
push 0xe
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0
xor edx, edx
mov ecx, str.User32.dll
call fcn.00401ba0
add esp, 4
test al, al
jne 0x40298c
push 0x10
push 0x41cc78
push str.Failed_to_load_User32.dll
jmp 0x404560
push 0
xor edx, edx
mov ecx, str.Shlwapi.dll
call fcn.00401ba0
add esp, 4
test al, al
jne 0x4029b5
push 0x10
push 0x41cc78
push str.Failed_to_load_Shlwapi.dll
jmp 0x404560
push 0x208
lea eax, [esp + 0x304]
push 0
push eax
call fcn.00406870
add esp, 0xc
lea eax, [esp + 0x508]
push 0x208
push 0
push eax
call fcn.00406870
add esp, 0xc
lea eax, [esp + 0x918]
push 0x410
push 0
push eax
call fcn.00406870
add esp, 0xc
lea eax, [esp + 0x710]
push 0x208
push 0
push eax
call fcn.00406870
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x104
lea eax, [esp + 0x304]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x402a48
push 0x10
push 0x41cc78
push str.Unable_to_get_ini_path___1_
jmp 0x404560
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x402a65
push 0x10
push 0x41cc78
push str.Unable_to_get_ini_path___2_
jmp 0x404560
lea eax, [esp + 0x300]
push 0x5c
push eax
call fcn.00406245
add esp, 8
test eax, eax
je 0x402a80
xor ecx, ecx
mov word [eax], cx
lea eax, ds:[esp + 0x300]
push eax
push str._sDLLInjector.ini
push 0xffffffffffffffff
lea eax, [esp + 0x514]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402abe
push 0x10
push 0x41cc78
push str.Unable_to_get_ini_path___3_
jmp 0x404560
push 0
push 0x80
push 3
push 0
push 0
push 0
lea eax, [esp + 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [eax + eax]
cmp eax, 0xffffffff
jne 0x402af6
push 0x10
push 0x41cc78
push str.Unable_to_open_ini_
jmp 0x404560
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.00404b9a
add esp, 4
mov edi, eax
xorps xmm0, xmm0
push 0x208
movq qword [edi], xmm0
call fcn.00404e29
add esp, 4
mov esi, eax
push 0x208
push 0
push esi
call fcn.00406870
add esp, 0xc
mov dword [edi], esi
lea eax, [esp + 0x508]
push eax
push 0x104
push esi
call fcn.004083ef
add esp, 0xc
test eax, eax
jne 0x402b50
mov byte [edi + 4], 1
push 0
push str.AllowMultipleInstancesOfDLLInjector
push ecx
mov ecx, edi
call fcn.004010c0
nop
test eax, eax
jne 0x402ba5
push 1
push eax
lea edx, [esp + 0x1f]
mov byte [esp + 0x1f], al
mov ecx, 0x41dbe8
call fcn.00401940
add esp, 8
test eax, eax
je 0x402ba5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x17], 1
jne 0x402ba5
push 0x10
push 0x41cc78
push str.Only_one_instance_of_DLLInjector.exe_is_allowed__close_it_before_trying_to_start_DLLInjector_again_
jmp 0x404560
push 0
push str.UseFullPathsFromIni
push ecx
mov ecx, edi
call fcn.004010c0
push 0x41dcf8
push ecx
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.00401160
mov esi, eax
test esi, esi
jne 0x402bdc
push 0x10
push 0x41cc78
push str.Failed_to_get_exe_name_
jmp 0x404560
push esi
push 0x41dd30
push 0xffffffffffffffff
push 0x104
push 0x422460
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402c0c
push 0x10
push 0x41cc78
push str.Failed_to_get_exe_name___3_
jmp 0x404560
cmp dword [esp + 0x1c], 1
jne 0x402c1e
push 0x422460
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push 1
push 0
xor edx, edx
mov ecx, 0x422460
call fcn.00401940
add esp, 8
test eax, eax
je 0x402c88
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x208
lea eax, [esp + 0xfc]
push 0
push eax
call fcn.00406870
add esp, 0xc
lea eax, [esp + 0xf8]
push 0x422460
push str.There_is_already_a_process_with_the_name__s_running__close_it_before_trying_to_use_DLLInjector_again_
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0xf8]
push 0x10
push 0x41cc78
push eax
jmp 0x404560
push str.CommandLine
push ecx
mov ecx, edi
call fcn.00401160
mov dword ds:[esp + 0xa4], eax
test eax, eax
jne 0x402d02
push esi
cmp dword [esp + 0x20], eax
jne 0x402cdb
lea eax, [esp + 0x304]
push eax
push str.__s_s_
push 0xffffffffffffffff
lea eax, [esp + 0x928]
push 0x208
push eax
call fcn.00401030
add esp, 0x18
mov dword [esp + 0xa0], eax
jmp 0x402d68
push str.__s_
push 0xffffffffffffffff
lea eax, [esp + 0x924]
push 0x208
push eax
call fcn.00401030
add esp, 0x14
mov dword [esp + 0xa0], eax
jmp 0x402d68
cmp dword [esp + 0x1c], 0
push eax
push esi
jne 0x402d31
lea eax, [esp + 0x308]
push eax
push str.__s_s___s
push 0xffffffffffffffff
lea eax, [esp + 0x92c]
push 0x208
push eax
call fcn.00401030
add esp, 0x1c
jmp 0x402d4d
push str.__s___s
push 0xffffffffffffffff
lea eax, [esp + 0x928]
push 0x208
push eax
call fcn.00401030
add esp, 0x18
push dword ds:[esp + 0xa4]
mov dword [esp + 0xa4], eax
call fcn.00404b95
add esp, 4
push esi
call fcn.00404b95
add esp, 4
cmp dword [esp + 0xa0], 0xffffffff
jne 0x402d8c
push 0x10
push 0x41cc78
push str.Unable_to_get_full_exe_path_
jmp 0x404560
push 0
push str.Use4GBPatch
push ecx
mov ecx, edi
call fcn.004010c0
mov dword ds:[esp + 0x24], eax
test eax, eax
je 0x402e56
mov esi, 1
inc eax
cmp eax, esi
jbe 0x402e56
lfence
nop dword [eax]
push 0x208
lea eax, [esp + 0xfc]
push 0
push eax
call fcn.00406870
add esp, 0xc
lea eax, [esp + 0xf8]
push esi
push str.FileToPatch__u
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
je 0x402e46
lea eax, [esp + 0xf8]
push eax
push ecx
mov ecx, edi
call fcn.00401160
mov dword [esp + 0xa4], eax
test eax, eax
je 0x402efa
mov edx, eax
lea ecx, [esp + 0x300]
call fcn.00401480
push dword [esp + 0xa4]
mov byte [esp + 0x1b], al
call fcn.00404b95
add esp, 4
cmp byte [esp + 0x17], 0
je 0x402ee9
mov ecx, dword [esp + 0x24]
inc esi
lea eax, [ecx + 1]
cmp esi, eax
jb 0x402dc0
push 0
push str.EnableFakeParentProcess
push ecx
mov ecx, edi
call fcn.004010c0
mov dword ds:[esp + 0x28], 0
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
movaps xmmword [esp + 0x30], xmm0
test eax, eax
jne 0x4038c5
push eax
push eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x54]
push 1
push eax
movaps xmmword [esp + 0xf0], xmm0
mov dword [esp + 0x5c], 0xc
mov dword [esp + 0x64], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
mov dword [0x422668], eax
lea eax, [esp + 0x54]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [0x422668]
mov dword [0x42266c], eax
test ecx, ecx
jne 0x402f0b
push 0x10
push 0x41cc78
push str.Failed_to_create_patching_event_
jmp 0x404560
push 0x10
push 0x41cc78
push str.Failed_to_patch_4GB_flag_in_exe_
jmp 0x404560
push 0x10
push 0x41cc78
push str.Failed_to_get_the_exe_name__4GB_patch__
jmp 0x404560
test eax, eax
jne 0x402f27
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc78
push str.Failed_to_create_fail_event_
jmp 0x404560
push 0x12c
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x402f77
push dword [0x422668]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc78
push str.Failed_to_create_pipe_
jmp 0x404560
mov eax, dword [0x422668]
push 0
mov dword [esp + 0xe8], eax
mov eax, dword [0x42266c]
push str.EnableMitigationsOnChildProcess
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, edi
mov dword [esp + 0xf8], eax
call fcn.004010c0
push 0x44
push 0
cmp eax, 1
jne 0x4037c5
lea eax, [esp + 0x64]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0xdc], xmm0
call fcn.00406870
add esp, 0xc
mov dword [esp + 0xa0], 0
lea eax, [esp + 0xe0]
mov dword [esp + 0x58], 0x48
mov dword [esp + 0x8c], eax
mov eax, 0x10
mov word [esp + 0x8a], ax
lea eax, [esp + 0xa0]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov esi, dword [esp + 0xa0]
test esi, esi
jne 0x403058
push dword [0x422668]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc78
push str.Failed_to_get_size_required_for_attribute_list___Mitigations_
jmp 0x404560
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x9c], eax
test eax, eax
jne 0x4030b0
push dword [0x422668]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc78
push str.HeapAlloc_Fatal_Error___Mitigations_
jmp 0x404560
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x40376b
test esi, esi
je 0x40376b
lea eax, [esp + 0xa0]
push eax
push 0
push 1
push dword [esp + 0xa8]
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x40314d
push dword [0x422668]
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x9c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc78
push str.InitializeProcThreadAttributeList_Failed___Mitigations_
jmp 0x404560
push 0
push 0x41e248
push ecx
mov ecx, edi
call fcn.004010c0
nop dword [eax]
cmp eax, 1
jne 0x40317a
or dword [esp + 0xd0], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0xd4], eax
push 0
push str.SEHOP
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4031a4
mov eax, dword [esp + 0xd4]
or dword [esp + 0xd0], 4
mov dword [esp + 0xd4], eax
push 0
push str.HeapTerminate
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4031d1
mov eax, dword [esp + 0xd4]
or dword [esp + 0xd0], 0x1000
mov dword [esp + 0xd4], eax
push 0
push str.ForceRelocateImages
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403203
mov eax, dword [esp + 0xd4]
or dword [esp + 0xd0], 0x100
mov dword [esp + 0xd4], eax
push 0
push str.BottomUpASLR
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403230
mov eax, dword [esp + 0xd4]
or dword [esp + 0xd0], 0x10000
mov dword [esp + 0xd4], eax
push 0
push str.HighEntropyASLR
push ecx
mov ecx, edi
call fcn.004010c0
nop
cmp eax, 1
jne 0x40325e
mov eax, dword [esp + 0xd4]
or dword [esp + 0xd0], 0x100000
mov dword [esp + 0xd4], eax
push 0
push str.RelocationsRequired
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x40328b
mov eax, dword [esp + 0xd4]
or dword [esp + 0xd0], 0x300
mov dword [esp + 0xd4], eax
push 0
push str.StrictHandleChecks
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4032b8
mov eax, dword [esp + 0xd4]
or dword [esp + 0xd0], 0x1000000
mov dword [esp + 0xd4], eax
push 0
push str.Win32kSystemCallDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4032e5
mov eax, dword [esp + 0xd4]
or dword [esp + 0xd0], 0x10000000
mov dword [esp + 0xd4], eax
push 0
push str.ExtensionPointDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x40330f
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 1
mov dword [esp + 0xd0], eax
push 0
push 0x41e388
push ecx
mov ecx, edi
call fcn.004010c0
nop
cmp eax, 1
jne 0x40333e
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 0x100
mov dword [esp + 0xd0], eax
push 0
push str.CFGExportSuppression
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x40336b
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 0x300
mov dword [esp + 0xd0], eax
push 0
push str.StrictCFG
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403398
mov eax, dword [esp + 0xdc]
or dword [esp + 0xd8], 0x100
mov dword [esp + 0xdc], eax
push 0
push str.DynamicCodeDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4033c2
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 0x10
mov dword [esp + 0xd0], eax
push 0
push str.DynamicCodeAllowOptOut
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4033ec
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 0x30
mov dword [esp + 0xd0], eax
push 0
push str.BlockNonMicrosoftBinaries
push ecx
mov ecx, edi
call fcn.004010c0
nop dword [eax + eax]
cmp eax, 1
jne 0x40341e
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 0x1000
mov dword [esp + 0xd0], eax
push 0
push str.FontDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x40344b
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 0x10000
mov dword [esp + 0xd0], eax
push 0
push str.NoRemoteImages
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403478
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 0x100000
mov dword [esp + 0xd0], eax
push 0
push str.NoLowLabelImages
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4034a5
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 0x1000000
mov dword [esp + 0xd0], eax
push 0
push str.PreferSystem32
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4034d2
mov eax, dword [esp + 0xd0]
or dword [esp + 0xd4], 0x10000000
mov dword [esp + 0xd0], eax
push 0
push str.RestrictIndirectBranchPrediction
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403503
mov eax, dword [esp + 0xdc]
or dword [esp + 0xd8], 0x10000
mov dword [esp + 0xdc], eax
push 0
push str.SpeculativeStoreBypassDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403530
mov eax, dword [esp + 0xdc]
or dword [esp + 0xd8], 0x1000000
mov dword [esp + 0xdc], eax
push 0
push str.ShadowStack
push ecx
mov ecx, edi
call fcn.004010c0
nop
cmp eax, 1
jne 0x40355e
mov eax, dword [esp + 0xdc]
or dword [esp + 0xd8], 0x10000000
mov dword [esp + 0xdc], eax
push 0
push str.ContextIPValidation
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403588
mov eax, dword [esp + 0xd8]
or dword [esp + 0xdc], 1
mov dword [esp + 0xd8], eax
push 0
push str.BlockNonCETEHCONT
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4035b2
mov eax, dword [esp + 0xd8]
or dword [esp + 0xdc], 0x30
mov dword [esp + 0xd8], eax
push 0
push str.BlockFSCTL
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4035e3
mov eax, dword [esp + 0xd8]
or dword [esp + 0xdc], 0x1000000
mov dword [esp + 0xd8], eax
push 0
push 0
push 0x10
lea eax, [esp + 0xdc]
push eax
push WriteFile
push 0
push dword [esp + 0xb4]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x40364b
push dword [0x422668]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc78
push str.UpdateProcThreadAttribute_Failed___Mitigations_
jmp 0x404560
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x5c]
push eax
push 0
push 0
push 0x80004
push 1
push 0
push 0
lea eax, [esp + 0x938]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [eax]
test eax, eax
jne 0x403725
push dword [0x422668]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x403710
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403710
push 0x10
push str.CreateProcess_Error__Mitigations_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc78
push str.Failed_to_start_exe___Mitigations_
jmp 0x404560
push dword [esp + 0x9c]
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov eax, dword [esp + 0x9c]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x403740
push dword [esp + 0x9c]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x403ba9
push dword [0x422668]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x9c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc78
push str.HeapSize_Failed___Mitigations_
jmp 0x404560
lea eax, [esp + 0x60]
push eax
call fcn.00406870
add esp, 0xc
mov dword [esp + 0x58], 0x44
lea eax, [esp + 0xe0]
mov dword [esp + 0x8c], eax
mov eax, 0x10
mov word [esp + 0x8a], ax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, ds:[esp + 0x30]
push eax
lea eax, [esp + 0x5c]
push eax
push 0
push 0
push 4
push 1
push 0
push 0
lea eax, [esp + 0x938]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403ba9
push dword [0x422668]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4038b0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4038b0
push 0x10
push str.CreateProcess_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc78
push str.Failed_to_start_exe_
jmp 0x404560
push 0x44
lea eax, [esp + 0x60]
push 0
push eax
call fcn.00406870
add esp, 0xc
mov dword [esp + 0x24], 0
lea eax, [esp + 0x24]
mov dword [esp + 0x58], 0x48
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov esi, dword [esp + 0x24]
test esi, esi
jne 0x403910
push 0x10
push 0x41cc78
push str.Failed_to_get_size_required_for_attribute_list___FakeParentProcess_
jmp 0x404560
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x9c], eax
test eax, eax
jne 0x403945
push 0x10
push 0x41cc78
push str.HeapAlloc_Fatal_Error___FakeParentProcess_
jmp 0x404560
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x40452d
test esi, esi
je 0x40452d
lea eax, [esp + 0x24]
push eax
push 0
push 1
push dword [esp + 0xa8]
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x4039b7
push dword [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc78
push str.InitializeProcThreadAttributeList_Failed___FakeParentProcess_
jmp 0x404560
push str.FakeParentProcess
push ecx
mov ecx, edi
call fcn.00401160
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4039de
push 0x10
push 0x41cc78
push str.Failed_to_get_fake_parent_process_exe_name_
jmp 0x404560
lea ecx, [esp + 0xa4]
mov dword [esp + 0xa4], 0
push 0
push ecx
xor edx, edx
mov ecx, eax
call fcn.00401940
add esp, 8
mov dword [esp + 0xa0], eax
test eax, eax
jne 0x403a54
push 0xc8
push eax
lea eax, [esp + 0x100]
push eax
call fcn.00406870
add esp, 0xc
lea eax, [esp + 0xf8]
push dword [esp + 0xa4]
push str.Failed_to_get_fake_parent_process_handle__Error:_u
push 0xffffffffffffffff
push 0x64
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0xf8]
push 0x10
push 0x41cc78
push eax
jmp 0x404560
push 0
push 0
push 4
lea eax, [esp + 0xac]
push eax
push 0x20000
push 0
push dword [esp + 0xb4]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x403a98
push dword [esp + 0xa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc78
push str.UpdateProcThreadAttribute_Failed__FakeParentProcess__
jmp 0x404560
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x5c]
push eax
push 0
push 0
push 0x80004
push 0
push 0
push 0
lea eax, [esp + 0x938]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403b47
push dword ds:[esp + 0xa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x403b36
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403b36
push 0x10
push str.CreateProcess_Error__FakeParentProcess_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc78
push str.Failed_to_start_exe__FakeParentProcess__
jmp 0x404560
push dword [esp + 0x9c]
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov eax, dword [esp + 0x9c]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x403b60
push dword [esp + 0x9c]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0xa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call fcn.00404b95
add esp, 4
mov dword [0x422448], 1
push 4
lea eax, [esp + 0xd0]
mov dword [esp + 0xd0], 1
push eax
push 0xd
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0x41eac4
push ecx
mov ecx, edi
call fcn.00401160
mov esi, eax
test esi, esi
jne 0x403bea
push 0x10
push 0x41cc78
push str.Failed_to_get_dll_name_
jmp 0x403c62
cmp dword [esp + 0x1c], 0
push esi
jne 0x403c18
lea eax, [esp + 0x304]
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [esp + 0x720]
push 0x104
push eax
call fcn.00401030
add esp, 0x18
jmp 0x403c34
push 0x41dd30
push 0xffffffffffffffff
lea eax, [esp + 0x71c]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
push esi
mov dword [esp + 0xa8], eax
call fcn.00404b95
add esp, 4
cmp dword [esp + 0xa4], 0xffffffff
jne 0x403d33
push 0x10
push 0x41cc78
push str.Unable_to_get_full_dll_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x422668]
test eax, eax
je 0x403c92
cmp dword [0x42266c], 0
je 0x403c92
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x403cb3
cmp dword ds:[esp + 0x20], 0
je 0x403cb3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop dword [eax]
cmp eax, 0xffffffff
jne 0x403ce6
push 0
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
push 0x41cc78
push str.ResumeThread_Failed___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte ds:[edi + 4], 1
jne 0x403d10
push dword [edi]
mov byte [edi + 4], 0
call fcn.00404b95
add esp, 4
push 8
push edi
call fcn.00404e1b
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xd24]
xor ecx, esp
call fcn.00404b87
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x41d724
push ecx
mov ecx, edi
call fcn.004010c0
test eax, eax
je 0x403e3b
inc eax
mov esi, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], esi
cmp eax, esi
jbe 0x403e3b
lfence
nop dword [eax + eax]
push 0x208
lea eax, [esp + 0xfc]
push 0
push eax
call fcn.00406870
add esp, 0xc
lea eax, [esp + 0xf8]
push esi
push str.FileToCreate__zu
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
je 0x403e2c
lea eax, ds:[esp + 0xf8]
push eax
push ecx
mov ecx, edi
call fcn.00401160
mov esi, eax
test esi, esi
jne 0x403de2
push 0x10
push 0x41cc78
push str.Failed_to_get_the_name_of_the_file_to_create_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
nop
jmp 0x403e28
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403de7
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf
jbe 0x403e11
push 0x10
push 0x41cc78
push str.Name_of_the_file_to_create_is_too_long_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403e1d
xor dl, dl
mov ecx, esi
lfence
call fcn.00402520
push esi
call fcn.00404b95
add esp, 4
mov esi, dword [esp + 0x24]
inc esi
mov dword [esp + 0x24], esi
cmp esi, dword [esp + 0x18]
jb 0x403d70
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
lea edx, [esp + 0x718]
mov dword [esp + 0x50], 0
call fcn.00401c80
add esp, 8
test al, al
jne 0x4042d4
cmp dword [esp + 0x2c], 0
je 0x403f11
push 0
push dword [esp + 0x34]
mov dword [0x422448], 3
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x208
lea eax, [esp + 0xfc]
push 0
push eax
call fcn.00406870
mov ecx, dword [esp + 0x38]
add esp, 0xc
cmp ecx, 1
jne 0x403eb8
mov eax, str.Failed_to_create_thread_in_process
jmp 0x403ee0
cmp ecx, 2
jne 0x403ec4
mov eax, str.Failed_to_close_thread_in_process
jmp 0x403ee0
cmp ecx, 3
jne 0x403ed0
mov eax, str.Failed_to_wait_for_thread_in_process
jmp 0x403ee0
cmp ecx, 4
mov eax, str.Failed_to_free_memory_in_thread
mov edx, str.Unknown_fatal_error
cmovne eax, edx
push eax
push str.Failed_to_inject_dll__Fatal_Error:__s_
push 0xffffffffffffffff
lea eax, [esp + 0x104]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0xf8]
push 0x10
push 0x41cc78
push eax
jmp 0x404337
mov dword [0x422448], 1
nop dword [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x208
mov esi, eax
lea eax, [esp + 0xfc]
push 0
push eax
call fcn.00406870
add esp, 0xc
test esi, esi
je 0x404119
mov edx, dword [esp + 0x24]
test edx, edx
je 0x404119
mov ecx, dword [esp + 0x48]
cmp ecx, 1
jne 0x403f8f
mov eax, str.Failed_to_open_dll
jmp 0x4040ec
cmp ecx, 2
jne 0x403f9e
mov eax, str.Failed_to_get_dll_file_size
jmp 0x4040ec
nop
cmp ecx, 3
jne 0x403faf
mov eax, str.Dll_file_size_is_too_big
jmp 0x4040ec
cmp ecx, 4
jne 0x403fbe
mov eax, str.Dll_file_size_is_too_small
jmp 0x4040ec
nop
cmp ecx, 5
jne 0x403fcf
mov eax, str.Failed_to_read_dll_file
jmp 0x4040ec
cmp ecx, 6
jne 0x403fde
mov eax, str.ReadFile_did_not_return_the_correct_size
jmp 0x4040ec
nop
cmp ecx, 7
jne 0x403fef
mov eax, str.Failed_to_get_the_dll_NT_header
jmp 0x4040ec
cmp ecx, 8
jne 0x403ffe
mov eax, str.Dll_CPU_architecture_does_not_match_architecture_of_DllInjector
jmp 0x4040ec
nop
cmp ecx, 9
jne 0x40400f
mov eax, str.Dll_is_not_executable
jmp 0x4040ec
cmp ecx, 0xa
jne 0x40401e
mov eax, str.Dll_is_not_a_dll
jmp 0x4040ec
nop
cmp ecx, 0xb
jne 0x40402f
mov eax, str.Failed_to_get_system_info
jmp 0x4040ec
cmp ecx, 0xc
jne 0x40403e
mov eax, str.Failed_to_load_bcryptprimitives.dll
jmp 0x4040ec
nop
cmp ecx, 0xd
jne 0x40404f
mov eax, str.Failed_to_load_Bcrypt.dll
jmp 0x4040ec
cmp ecx, 0xe
jne 0x40405e
mov eax, str.BCryptGenRandom_Failed
jmp 0x4040ec
nop
cmp ecx, 0xf
jne 0x40406f
mov eax, str.Failed_to_get_random_location_for_dll_path
jmp 0x4040ec
cmp ecx, 0x10
jne 0x40407e
mov eax, str.Failed_to_alloc_memory_in_process
jmp 0x4040ec
nop
cmp ecx, 0x11
jne 0x40408f
mov eax, str.VirtualQueryEx_returned_incorrect_size
jmp 0x4040ec
cmp ecx, 0x12
jne 0x40409e
mov eax, str.Memory_was_not_allocated_as_PAGE_READWRITE
jmp 0x4040ec
nop
cmp ecx, 0x13
jne 0x4040ac
mov eax, str.Memory_is_not_the_size_of_a_page
jmp 0x4040ec
cmp ecx, 0x14
jne 0x4040b8
mov eax, str.Memory_is_not_PAGE_READWRITE
jmp 0x4040ec
cmp ecx, 0x15
jne 0x4040c4
mov eax, str.Failed_to_write_dll_path_to_allocated_memory
jmp 0x4040ec
cmp ecx, 0x16
jne 0x4040d0
mov eax, str.Failed_to_change_protection_of_allocated_memory_to_PAGE_READONLY
jmp 0x4040ec
cmp ecx, 0x17
jne 0x4040dc
mov eax, str.Failed_to_read_allocated_memory
jmp 0x4040ec
cmp ecx, 0x18
mov eax, str.Dll_path_in_allocated_memory_does_not_match_path_in_DllInjector
mov esi, str.Unknown_error
cmovne eax, esi
push edx
push eax
push str.Failed_to_inject_dll__Error:__s:__s
push 0xffffffffffffffff
lea eax, [esp + 0x108]
push 0x104
push eax
call fcn.00401030
add esp, 0x18
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4042b1
mov ecx, dword ds:[esp + 0x48]
cmp ecx, 1
jne 0x40412f
mov eax, str.Failed_to_open_dll
jmp 0x404294
cmp ecx, 2
jne 0x40413e
mov eax, str.Failed_to_get_dll_file_size
jmp 0x404294
nop
cmp ecx, 3
jne 0x40414f
mov eax, str.Dll_file_size_is_too_big
jmp 0x404294
cmp ecx, 4
jne 0x40415e
mov eax, str.Dll_file_size_is_too_small
jmp 0x404294
nop
cmp ecx, 5
jne 0x40416f
mov eax, str.Failed_to_read_dll_file
jmp 0x404294
cmp ecx, 6
jne 0x40417e
mov eax, str.ReadFile_did_not_return_the_correct_size
jmp 0x404294
nop
cmp ecx, 7
jne 0x40418f
mov eax, str.Failed_to_get_the_dll_NT_header
jmp 0x404294
cmp ecx, 8
jne 0x40419e
mov eax, str.Dll_CPU_architecture_does_not_match_architecture_of_DllInjector
jmp 0x404294
nop
cmp ecx, 9
jne 0x4041af
mov eax, str.Dll_is_not_executable
jmp 0x404294
cmp ecx, 0xa
jne 0x4041be
mov eax, str.Dll_is_not_a_dll
jmp 0x404294
nop
cmp ecx, 0xb
jne 0x4041cf
mov eax, str.Failed_to_get_system_info
jmp 0x404294
cmp ecx, 0xc
jne 0x4041de
mov eax, str.Failed_to_load_bcryptprimitives.dll
jmp 0x404294
nop
cmp ecx, 0xd
jne 0x4041ef
mov eax, str.Failed_to_load_Bcrypt.dll
jmp 0x404294
cmp ecx, 0xe
jne 0x4041fe
mov eax, str.BCryptGenRandom_Failed
jmp 0x404294
nop
cmp ecx, 0xf
jne 0x40420f
mov eax, str.Failed_to_get_random_location_for_dll_path
jmp 0x404294
cmp ecx, 0x10
jne 0x40421e
mov eax, str.Failed_to_alloc_memory_in_process
jmp 0x404294
nop
cmp ecx, 0x11
jne 0x40422f
mov eax, str.VirtualQueryEx_returned_incorrect_size
jmp 0x404294
cmp ecx, 0x12
jne 0x40423e
mov eax, str.Memory_was_not_allocated_as_PAGE_READWRITE
jmp 0x404294
nop
cmp ecx, 0x13
jne 0x40424f
mov eax, str.Memory_is_not_the_size_of_a_page
jmp 0x404294
cmp ecx, 0x14
jne 0x40425e
mov eax, str.Memory_is_not_PAGE_READWRITE
jmp 0x404294
nop
cmp ecx, 0x15
jne 0x40426c
mov eax, str.Failed_to_write_dll_path_to_allocated_memory
jmp 0x404294
cmp ecx, 0x16
jne 0x404278
mov eax, str.Failed_to_change_protection_of_allocated_memory_to_PAGE_READONLY
jmp 0x404294
cmp ecx, 0x17
jne 0x404284
mov eax, str.Failed_to_read_allocated_memory
jmp 0x404294
cmp ecx, 0x18
mov eax, str.Dll_path_in_allocated_memory_does_not_match_path_in_DllInjector
mov edx, str.Unknown_error
cmovne eax, edx
push eax
push str.Failed_to_inject_dll__Error:__s_
push 0xffffffffffffffff
lea eax, [esp + 0x104]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
push 0x10
push 0x41cc78
lea eax, [esp + 0x100]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.004025e0
jmp 0x40433f
cmp dword [0x422668], 0
nop dword [eax + eax]
je 0x40438b
cmp dword [0x42266c], 0
je 0x40433f
push 0
push 0
push 0
push 0x401ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x404313
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push 0
push 0x422668
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x40433f
push 0x10
push 0x41cc78
push str.Error_while_waiting_for_events_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [0x422668], 0
je 0x40438b
cmp dword [0x42266c], 0
je 0x40438b
cmp dword [0x422448], 0
jne 0x404373
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x422448], 0
je 0x404362
push dword [0x422668]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42266c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x422448]
cmp eax, 1
jne 0x4043eb
push dword ds:[esp + 0x34]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x4044ac
push 0
push dword [esp + 0x34]
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
call fcn.004025e0
push 0x10
push 0x41cc78
push str.ResumeThread_Failed___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4044ac
cmp eax, 2
jne 0x404498
push 0
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
push 0x41cc78
push str.Injected_dll_signaled_that_an_error_occurred_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword ds:[esp + 0x28]
test esi, esi
je 0x4044d0
push 0x12c
lea eax, [esp + 0xfc]
mov dword [esp + 0xa8], 0
push 0
push eax
call fcn.00406870
add esp, 0xc
lea eax, [esp + 0xa4]
push 0
push eax
push 0x12b
lea eax, [esp + 0x104]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x4044ac
cmp dword [esp + 0xa4], 0
je 0x4044ac
push 0x10
push str.Message_from_dll
lea eax, [esp + 0x100]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4044ac
cmp eax, 3
jne 0x4044ac
mov ecx, edi
mov dword [esp + 0x2c], 1
call fcn.004025e0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4044d0
cmp dword [esp + 0x20], 0
je 0x4044d0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c], 0
jne 0x403ce6
push 1
push str.WaitForProcessTermination
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403ce6
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
cmp eax, 0xffffffff
jne 0x403ce6
push 0
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
call fcn.004025e0
push 0x10
push 0x41cc78
push str.Fatal_Error_while_waiting_for_the_process_to_close_
jmp 0x403cdd
push dword [esp + 0x9c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc78
push str.HeapSize_Failed___FakeParentProcess_
jmp 0x404560
push 0x10
push 0x41cc78
push str.Unable_to_get_RtlGetNtVersionNumbers_or_RtlImageNtHeaderEx_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0xd2c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00404b87
mov esp, ebp
pop ebp
ret 0x10