Function at 0x41db40
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Suspend thread
Terminate process
Use process replacement

Disassembly:
sub esp, 0x84c
mov eax, dword [0x4a3f4c]
xor eax, esp
mov dword [esp + 0x848], eax
mov eax, dword [esp + 0x864]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x85c]
push edi
mov edi, dword [esp + 0x864]
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0x9090feeb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x86c]
push ecx
push edi
push esi
push str.InjectSuspended:_exe__s__dir__s__commit_x_n
mov dword [esp + 0x44], eax
xor ebx, ebx
call fcn.0041f800
add esp, 0x10
push str.DxWndInjectCompleted
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x41dbef
call ebp
cmp eax, 0xb7
jne 0x41dbda
push str.DxWndInjectCompleted
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x41dbef
call ebp
push eax
push str.DxWndInjectCompleted
push str.CreateEvent__s_failed:_err_d_n
call fcn.0041f800
add esp, 0xc
push 0x44
lea edx, [esp + 0x48]
push 0
push edx
call fcn.0045af40
mov eax, dword [esp + 0x3c]
add eax, 0x156
add esp, 0xc
mov dword [esp + 0x44], 0x44
cmp byte [eax], bl
je 0x41dc17
mov ebx, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
push ecx
push edi
push 0
push 4
push 0
push 0
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41dca7
call ebp
mov ecx, eax
sub ecx, 2
je 0x41dc57
sub ecx, 0x109
je 0x41dc50
mov ecx, 0x48d4b1
jmp 0x41dc5c
mov ecx, str._invalid_directory_name_
jmp 0x41dc5c
mov ecx, str._file_not_found_
push ecx
push eax
push esi
lea edx, [esp + 0x360]
push str.CreateProcess___s___nerror_d__s
push edx
call fcn.0045a121
add esp, 0x14
push 0
push 0x30
push 0x483018
lea eax, [esp + 0x360]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExA]
lea ecx, [esp + 0x354]
push ecx
push 0x47c9d8
call fcn.0041f800
add esp, 8
jmp 0x41e233
mov edx, dword [esp + 0x1c]
push edx
push 0
push 0xc38
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push edi
push str.Target_handle_x_n
mov dword [esp + 0x18], edi
call fcn.0041f800
mov eax, dword [esp + 0x20]
push eax
call sub.dxwnd.dll_Ordinal_8
mov ebx, dword [sym.imp.USER32.dll_MessageBoxExA]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41de58
lea ecx, [esp + 0x40]
push ecx
push 0x40
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x41dd4b
call ebp
push eax
lea edx, [esp + 0x358]
push str.VirtualProtectEx_error_d
push edx
call fcn.0045a121
add esp, 0xc
push 0
push 0x30
push 0x483018
lea eax, [esp + 0x360]
push eax
push 0
call ebx
lea ecx, [esp + 0x354]
push ecx
push 0x47c9d8
call fcn.0041f800
add esp, 8
jmp 0x41e1ee
lea edx, [esp + 0x2c]
push edx
push 4
lea eax, [esp + 0x44]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x41ddae
call ebp
push eax
lea ecx, [esp + 0x358]
push str.ReadProcessMemory_error_d
push ecx
call fcn.0045a121
add esp, 0xc
push 0
push 0x30
push 0x483018
lea edx, [esp + 0x360]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxExA]
lea eax, [esp + 0x354]
push eax
push 0x47c9d8
call fcn.0041f800
add esp, 8
jmp 0x41e1ee
lea ecx, [esp + 0x2c]
push ecx
push 4
lea edx, [esp + 0x40]
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x41de11
call ebp
push eax
push str.WriteProcessMemory_error_d
lea eax, [esp + 0x35c]
push eax
call fcn.0045a121
add esp, 0xc
push 0
push 0x30
push 0x483018
lea ecx, [esp + 0x360]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxExA]
lea edx, [esp + 0x354]
push edx
push 0x47c9d8
call fcn.0041f800
add esp, 8
jmp 0x41e1ee
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x41de29
call ebp
push eax
push str.FlushInstructionCache_error_d
jmp 0x41ddce
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x41de97
push 0x6f
call ebp
push eax
lea ecx, [esp + 0x35c]
push str.ResumeThread_error_d_at:_d
push ecx
call fcn.0045a121
add esp, 0x10
jmp 0x41dd7b
lea ecx, [esp + 0x354]
push str.GetThreadStartAddress_failed
push ecx
call fcn.0045a121
add esp, 8
push 0
push 0x30
push 0x483018
lea edx, [esp + 0x360]
push edx
push 0
call ebx
lea eax, [esp + 0x354]
push eax
push 0x47c9d8
call fcn.0041f800
add esp, 8
cmp dword [esp + 0x868], 0
mov dword [esp + 0x140], 0
je 0x41df31
push 0
push str.debug
push str.Click_when_the_debugger_is_attached
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x88]
push ecx
push edx
mov dword [esp + 0x90], 0x10001
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x41df99
call ebp
push eax
lea eax, [esp + 0x358]
push str.GetThreadContext_error_d
push eax
call fcn.0045a121
add esp, 0xc
push 0
push 0x30
push 0x483018
lea ecx, [esp + 0x360]
push ecx
push 0
call ebx
lea edx, [esp + 0x354]
push edx
push 0x47c9d8
call fcn.0041f800
add esp, 8
jmp 0x41e1ee
mov ebp, dword [sym.imp.KERNEL32.dll_GetThreadContext]
xor edi, edi
lea esp, [esp]
cmp dword [esp + 0x140], esi
je 0x41e043
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x88]
push eax
push ecx
mov dword [esp + 0x90], 0x10001
call ebp
test eax, eax
je 0x41dfee
mov edx, dword [esp + 0x140]
push edx
push edi
push str.wait_cycle__d_eip_x_n
call fcn.0041f800
inc edi
add esp, 0xc
cmp edi, 0x50
jb 0x41df40
mov edi, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x140]
cmp eax, esi
je 0x41e04d
push esi
push eax
push str.thread_blocked_eip_x_addr_x
lea eax, [esp + 0x360]
push eax
call fcn.0045a121
add esp, 0x10
push 0
push 0x30
push 0x483018
lea ecx, [esp + 0x360]
push ecx
push 0
call ebx
lea edx, [esp + 0x354]
push edx
push 0x47c9d8
call fcn.0041f800
add esp, 8
jmp 0x41e1ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x358]
push str.GetThreadContext_error_d
push eax
call fcn.0045a121
add esp, 0xc
push 0
push 0x30
push 0x483018
lea ecx, [esp + 0x360]
push ecx
push 0
call ebx
lea edx, [esp + 0x354]
push edx
push 0x47c9d8
call fcn.0041f800
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
jmp 0x41e1ee
mov edi, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
lea eax, [esp + 0x758]
push eax
push 0x104
push 0x482ed0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp dword [esp + 0x86c], 0
je 0x41e09a
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x788]
mov edx, dword [eax + 0x784]
push ecx
mov ecx, dword [esp + 0x20]
push edx
lea eax, [esp + 0x75c]
push eax
push ecx
call sub.dxwnd.dll_Ordinal_14
add esp, 0x10
jmp 0x41e0af
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x754]
push edx
push eax
call sub.dxwnd.dll_Ordinal_7
add esp, 8
test eax, eax
jne 0x41e0ca
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x754]
push ecx
push edx
push str.Injection_error:_pid_x_dll_s
jmp 0x41dfaf
mov eax, dword [esp + 0x24]
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41e0f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x34]
push eax
push str.WaitForSingleObject_ok_after__d_mSec_n
jmp 0x41e0f6
push eax
push str.WaitForSingleObject_returns__d_n
call fcn.0041f800
mov ecx, dword [esp + 0x20]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x41e140
call ebp
push eax
lea edx, [esp + 0x358]
push str.SuspendThread_error_d
push edx
call fcn.0045a121
add esp, 0xc
push 0
push 0x30
push 0x483018
lea eax, [esp + 0x360]
push eax
push 0
call ebx
jmp 0x41dd31
lea edx, [esp + 0x2c]
push edx
push 4
lea eax, [esp + 0x44]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x41e19c
call ebp
push eax
push str.WriteProcessMemory_error_d
lea ecx, [esp + 0x35c]
push ecx
call fcn.0045a121
add esp, 0xc
push 0
push 0x30
push 0x483018
lea edx, [esp + 0x360]
push edx
push 0
call ebx
lea eax, [esp + 0x354]
push eax
push 0x47c9d8
call fcn.0041f800
add esp, 8
jmp 0x41e1ee
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x41e1b4
call ebp
push eax
push str.FlushInstructionCache_error_d
jmp 0x41e160
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x41e1e6
push 0xd8
call ebp
push eax
lea edx, [esp + 0x35c]
push str.ResumeThread_error_d_at:_d
push edx
call fcn.0045a121
add esp, 0x10
jmp 0x41e126
mov dword [esp + 0x28], 0
test edi, edi
je 0x41e1f9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], 0
je 0x41e226
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x41e226
call ebp
push eax
mov eax, dword [esp + 0x18]
push eax
push str.failed_to_kill_hproc_x_err_d_n
call fcn.0041f800
add esp, 0xc
push str.InjectSuspended_done__n
call fcn.0041f800
add esp, 4
mov ecx, dword [esp + 0x858]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045a1dd
add esp, 0x84c
ret