Function at 0x410f00
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x46b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
test ecx, ecx
jne 0x410f3d
push ecx
push ecx
push 0x465f70
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041150d
mov esp, ebp
pop ebp
ret
push esi
push edi
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x410fac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov esi, eax
lea eax, [ebp - 0x108]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push 0x465f80
lea eax, [ebp - 0x108]
push 0x465ff8
push eax
call fcn.004030b0
add esp, 0x1c
lea eax, [ebp - 0x108]
push 1
push 0x466008
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041150d
mov esp, ebp
pop ebp
ret
push ebx
push 4
push 0x3000
push 0x100
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x411108
mov ecx, 0x46b978
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410fd4
sub ecx, edx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ecx*2 + 2]
push eax
push 0x46b978
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46b978
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411001
sub ecx, edx
cmp dword [ebp - 0x10c], ecx
jb 0x4110e5
push str.LoadLibraryA
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
je 0x411080
lea eax, [ebp - 0x110]
push eax
push 0
push ebx
push ecx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call esi
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041150d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov esi, eax
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push 0x465fac
lea eax, [ebp - 0x108]
push 0x465ff8
push eax
call fcn.004030b0
add esp, 0x1c
lea eax, [ebp - 0x108]
push 1
push 0x466008
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041150d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov esi, eax
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push 0x465fd8
jmp 0x411129
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov esi, eax
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push 0x465fe4
lea eax, [ebp - 0x108]
push 0x465ff8
push eax
call fcn.004030b0
add esp, 0x1c
lea eax, [ebp - 0x108]
push 1
push 0x466008
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0041150d
mov esp, ebp
pop ebp
ret