Function at 0x401980
Capabilities:
Enumerate process modules
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1644
call fcn.00404f60
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x163c], edx
mov dword [ebp - 0x1634], esi
push edi
test esi, esi
je 0x401b5d
push 0x1000
xor edi, edi
lea eax, [ebp - 0x1210]
push edi
push eax
xor ebx, ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1214], ebx
nop
test ebx, ebx
je 0x4019dc
test edi, edi
jne 0x401ab5
lea eax, [ebp - 0x1214]
push eax
push 0x1000
lea eax, [ebp - 0x1210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x401a84
mov eax, dword [ebp - 0x1214]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1638], eax
test eax, eax
je 0x401a7e
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x103
push eax
push dword [ebp + esi*4 - 0x1210]
push dword [ebp - 0x1634]
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x401a75
movzx eax, word [ebp - 0x210]
cmp eax, 0x6e
jne 0x401a65
test ebx, ebx
jne 0x401a75
mov ebx, dword [ebp + esi*4 - 0x1210]
jmp 0x401a75
cmp eax, 0x4b
jne 0x401a75
test edi, edi
jne 0x401a75
mov edi, dword [ebp + esi*4 - 0x1210]
inc esi
cmp esi, dword [ebp - 0x1638]
jb 0x401a13
mov esi, dword [ebp - 0x1634]
test ebx, ebx
je 0x401a90
test edi, edi
jne 0x4019d0
push dword [ebp - 0x163c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x163c]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4019d0
push 0x408
lea eax, [ebp - 0x1620]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
push str.NtFlushInstructionCache
push ebx
call esi
push str.VirtualAlloc
push edi
mov dword [ebp - 0x1630], eax
call esi
push 0x4068d8
push edi
mov dword [ebp - 0x162c], eax
call esi
push str.LoadLibraryA
push edi
mov dword [ebp - 0x1628], eax
call esi
mov dword [ebp - 0x1624], eax
lea edx, [ebp - 0x1638]
lea eax, [ebp - 0x1640]
mov dword [ebp - 0x1638], 0
push eax
lea eax, [ebp - 0x1644]
mov dword [ebp - 0x1644], 0
push eax
mov dword [ebp - 0x1640], 0
call fcn.004017f0
add esp, 8
test al, al
jne 0x401b70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__FileRead___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004041fe
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1644]
lea eax, [ebp - 0x1630]
mov edx, dword [ebp - 0x163c]
mov ecx, dword [ebp - 0x1634]
push eax
push dword [ebp - 0x1640]
push esi
call fcn.00401520
add esp, 0xc
test al, al
jne 0x401bc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__InjectLibrary___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004041fe
mov esp, ebp
pop ebp
ret
push str.___Library_injected__n
push 0xa
call fcn.00403690
push dword [ebp - 0x1620]
push str.______Base__0x_08X_n
push 0xa
call fcn.00403690
add esp, 0x14
push dword [ebp - 0x161c]
push str.______Size__0x_08X_n
push 0xa
call fcn.00403690
add esp, 0xc
push esi
push 0
push dword [ebp - 0x1638]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x401c37
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed__HeapFree___LastError__0x_08X__n
push 0xc
call fcn.00403690
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004041fe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004041fe
mov esp, ebp
pop ebp
ret