Function at 0x402400
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Create pipe
Create process on windows
Create process suspended
Create thread
Read file on windows
Resume thread
Spoof parent pid
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xf18
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0xf14], eax
push esi
push edi
push 0x4023c0
call fcn.00407f9f
add esp, 4
push 0x4023e0
call fcn.0040a40b
add esp, 4
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlImageNtHeaderEx
push esi
mov dword [0x422464], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x422464]
mov dword [0x422468], eax
test esi, esi
je 0x40404c
nop dword [eax]
test eax, eax
je 0x40404c
push 0x422688
push 0x42246c
push 0x422678
mov ecx, esi
call dword [0x4171a8]
nop
call esi
mov eax, dword [0x422688]
and eax, 0x7fff
cmp dword [0x422678], 0xa
mov dword [0x422688], eax
jne 0x4024d8
nop word [eax + eax]
cmp eax, 0x4563
jae 0x4024d8
push 0x10
push 0x41cc5c
push str.Update_Windows_10_to_Redstone_5__1809__or_above_
jmp 0x404058
push 4
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 0xb
push eax
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xa4]
mov dword [esp + 0xa4], 3
push eax
push 3
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xa8]
mov dword [esp + 0xa8], 1
push eax
push 6
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xac]
mov dword [esp + 0xac], 4
push eax
push 7
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0xb0], 1
push eax
push 9
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xb4]
mov dword [esp + 0xb4], 3
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], 1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xbc]
mov dword [esp + 0xbc], 0xf
push eax
push 0xe
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push ecx
mov ecx, str.User32.dll
call fcn.00401ba0
add esp, 4
test al, al
jne 0x4025e9
push 0x10
push 0x41cc5c
push str.Failed_to_load_User32.dll
jmp 0x404058
push ecx
mov ecx, str.Shlwapi.dll
call fcn.00401ba0
add esp, 4
test al, al
jne 0x40260c
push 0x10
push 0x41cc5c
push str.Failed_to_load_Shlwapi.dll
jmp 0x404058
push 0x208
lea eax, [esp + 0x2ec]
push 0
push eax
call fcn.00406450
add esp, 0xc
lea eax, [esp + 0x4f0]
push 0x208
push 0
push eax
call fcn.00406450
add esp, 0xc
lea eax, [esp + 0x900]
push 0x410
push 0
push eax
call fcn.00406450
add esp, 0xc
lea eax, [esp + 0x6f8]
push 0x208
push 0
push eax
call fcn.00406450
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x104
lea eax, [esp + 0x2ec]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40269f
push 0x10
push 0x41cc5c
push str.Unable_to_get_ini_path___1_
jmp 0x404058
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4026bc
push 0x10
push 0x41cc5c
push str.Unable_to_get_ini_path___2_
jmp 0x404058
lea eax, [esp + 0x2e8]
push 0x5c
push eax
call fcn.00405e25
add esp, 8
test eax, eax
je 0x4026d7
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x2e8]
push eax
push str._sDLLInjector.ini
push 0xffffffffffffffff
lea eax, [esp + 0x4fc]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402716
push 0x10
push 0x41cc5c
push str.Unable_to_get_ini_path___3_
jmp 0x404058
push 0
push 0x80
push 3
push 0
push 0
push 0
lea eax, [esp + 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x402749
push 0x10
push 0x41cc5c
push str.Unable_to_open_ini_
jmp 0x404058
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.00404780
add esp, 4
mov edi, eax
xorps xmm0, xmm0
push 0x208
movq qword [edi], xmm0
call fcn.00404a0f
add esp, 4
mov esi, eax
push 0x208
push 0
push esi
call fcn.00406450
add esp, 0xc
mov dword [edi], esi
lea eax, [esp + 0x4f0]
push eax
push 0x104
push esi
call fcn.00407fcf
add esp, 0xc
test eax, eax
jne 0x4027a2
mov byte [edi + 4], 1
push 0
push str.AllowMultipleInstancesOfDLLInjector
push ecx
mov ecx, edi
call fcn.004010c0
test eax, eax
jne 0x4027f0
push 1
push eax
lea edx, [esp + 0x13]
mov byte [esp + 0x13], al
mov ecx, 0x41d6c0
call fcn.00401940
add esp, 8
test eax, eax
je 0x4027f0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0xb], 1
jne 0x4027f0
push 0x10
push 0x41cc5c
push str.Only_one_instance_of_DLLInjector.exe_is_allowed__close_it_before_trying_to_start_DLLInjector_again_
jmp 0x404058
push 0
push str.UseFullPathsFromIni
push ecx
mov ecx, edi
call fcn.004010c0
push 0x41d7d0
push ecx
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.00401160
mov esi, eax
test esi, esi
jne 0x402827
push 0x10
push 0x41cc5c
push str.Failed_to_get_exe_name_
jmp 0x404058
push esi
push 0x41d808
push 0xffffffffffffffff
push 0x104
push 0x422470
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402857
push 0x10
push 0x41cc5c
push str.Failed_to_get_exe_name___3_
jmp 0x404058
cmp dword [esp + 0x10], 1
jne 0x402869
push 0x422470
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push 1
push 0
xor edx, edx
mov ecx, 0x422470
call fcn.00401940
add esp, 8
test eax, eax
je 0x4028dc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x208
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.00406450
add esp, 0xc
lea eax, [esp + 0xe0]
push 0x422470
push str.There_is_already_a_process_with_the_name__s_running__close_it_before_trying_to_use_DLLInjector_again_
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0xe0]
push 0x10
push 0x41cc5c
push eax
jmp 0x404058
push str.CommandLine
push ecx
mov ecx, edi
call fcn.00401160
mov dword [esp + 0x98], eax
test eax, eax
jne 0x402951
push esi
cmp dword [esp + 0x14], eax
jne 0x40292b
lea eax, [esp + 0x2ec]
push eax
push str.__s_s_
push 0xffffffffffffffff
lea eax, [esp + 0x910]
push 0x208
push eax
call fcn.00401030
add esp, 0x18
mov dword [esp + 0x94], eax
jmp 0x4029b4
push str.__s_
push 0xffffffffffffffff
lea eax, [esp + 0x90c]
push 0x208
push eax
call fcn.00401030
add esp, 0x14
mov dword [esp + 0x94], eax
jmp 0x4029b4
cmp dword [esp + 0x10], 0
push eax
push esi
jne 0x402982
lea eax, [esp + 0x2f0]
push eax
push str.__s_s___s
push 0xffffffffffffffff
lea eax, [esp + 0x914]
push 0x208
push eax
call fcn.00401030
add esp, 0x1c
jmp 0x40299e
push str.__s___s
push 0xffffffffffffffff
lea eax, [esp + 0x910]
push 0x208
push eax
call fcn.00401030
add esp, 0x18
push dword [esp + 0x98]
mov dword [esp + 0x98], eax
call fcn.0040477b
add esp, 4
push esi
call fcn.0040477b
add esp, 4
cmp dword [esp + 0x94], 0xffffffff
jne 0x4029d8
push 0x10
push 0x41cc5c
push str.Unable_to_get_full_exe_path_
jmp 0x404058
push 0
push str.Use4GBPatch
push ecx
mov ecx, edi
call fcn.004010c0
mov dword [esp + 0x1c], eax
test eax, eax
je 0x402aa8
mov esi, 1
inc eax
cmp eax, esi
jbe 0x402aa8
lfence
nop dword [eax + eax]
push 0x208
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.00406450
add esp, 0xc
lea eax, [esp + 0xe0]
push esi
push str.FileToPatch__u
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
je 0x402a98
lea eax, [esp + 0xe0]
push eax
push ecx
mov ecx, edi
call fcn.00401160
mov dword [esp + 0x98], eax
test eax, eax
je 0x402b4d
mov edx, eax
lea ecx, [esp + 0x2e8]
call fcn.00401480
push dword [esp + 0x98]
mov byte [esp + 0xf], al
call fcn.0040477b
add esp, 4
cmp byte [esp + 0xb], 0
je 0x402b3c
mov ecx, dword [esp + 0x1c]
inc esi
lea eax, [ecx + 1]
cmp esi, eax
jb 0x402a10
push 0
push str.EnableFakeParentProcess
push ecx
mov ecx, edi
call fcn.004010c0
mov dword [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x14], 0
movaps xmmword [esp + 0x20], xmm0
test eax, eax
jne 0x403505
push eax
push eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
push 1
push eax
movaps xmmword [esp + 0xe0], xmm0
mov dword [esp + 0x4c], 0xc
mov dword [esp + 0x54], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
mov dword [0x42267c], eax
lea eax, [esp + 0x44]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [0x42267c]
mov dword [0x422680], eax
test ecx, ecx
jne 0x402b5e
push 0x10
push 0x41cc5c
push str.Failed_to_create_patching_event_
jmp 0x404058
push 0x10
push 0x41cc5c
push str.Failed_to_patch_4GB_flag_in_exe_
jmp 0x404058
push 0x10
push 0x41cc5c
push str.Failed_to_get_the_exe_name__4GB_patch__
jmp 0x404058
nop
test eax, eax
jne 0x402b7c
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc5c
push str.Failed_to_create_fail_event_
jmp 0x404058
push 0x12c
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x402bc5
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc5c
push str.Failed_to_create_pipe_
jmp 0x404058
mov eax, dword [0x42267c]
push 0
mov dword [esp + 0xd8], eax
mov eax, dword [0x422680]
push str.EnableMitigationsOnChildProcess
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, edi
mov dword [esp + 0xe8], eax
call fcn.004010c0
push 0x44
push 0
cmp eax, 1
jne 0x403405
lea eax, [esp + 0x54]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0xcc], xmm0
call fcn.00406450
add esp, 0xc
mov dword [esp + 0x94], 0
lea eax, [esp + 0xd0]
mov dword [esp + 0x48], 0x48
mov dword [esp + 0x7c], eax
mov eax, 0x10
mov word [esp + 0x7a], ax
lea eax, [esp + 0x94]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov esi, dword [esp + 0x94]
test esi, esi
jne 0x402cab
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc5c
push str.Failed_to_get_size_required_for_attribute_list___Mitigations_
jmp 0x404058
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x8c], eax
test eax, eax
jne 0x402d05
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc5c
push str.HeapAlloc_Fatal_Error___Mitigations_
jmp 0x404058
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x4033ab
test esi, esi
je 0x4033ab
lea eax, [esp + 0x94]
push eax
push 0
push 1
push dword [esp + 0x98]
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x402da5
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x8c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc5c
push str.InitializeProcThreadAttributeList_Failed___Mitigations_
jmp 0x404058
push 0
push 0x41dd20
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402dce
or dword [esp + 0xc0], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0xc4], eax
push 0
push str.SEHOP
push ecx
mov ecx, edi
call fcn.004010c0
nop dword [eax]
cmp eax, 1
jne 0x402dfb
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 4
mov dword [esp + 0xc4], eax
push 0
push str.HeapTerminate
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402e28
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x1000
mov dword [esp + 0xc4], eax
push 0
push str.ForceRelocateImages
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402e55
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x100
mov dword [esp + 0xc4], eax
push 0
push str.BottomUpASLR
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402e83
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x10000
mov dword [esp + 0xc4], eax
push 0
push str.HighEntropyASLR
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402eb0
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x100000
mov dword [esp + 0xc4], eax
push 0
push str.RelocationsRequired
push ecx
mov ecx, edi
call fcn.004010c0
nop
cmp eax, 1
jne 0x402ede
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x300
mov dword [esp + 0xc4], eax
push 0
push str.StrictHandleChecks
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402f0b
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x1000000
mov dword [esp + 0xc4], eax
push 0
push str.Win32kSystemCallDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402f38
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x10000000
mov dword [esp + 0xc4], eax
push 0
push str.ExtensionPointDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402f62
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 1
mov dword [esp + 0xc0], eax
push 0
push 0x41de60
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402f8f
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x100
mov dword [esp + 0xc0], eax
push 0
push str.CFGExportSuppression
push ecx
mov ecx, edi
call fcn.004010c0
nop
cmp eax, 1
jne 0x402fbe
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x300
mov dword [esp + 0xc0], eax
push 0
push str.StrictCFG
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402feb
mov eax, dword [esp + 0xcc]
or dword [esp + 0xc8], 0x100
mov dword [esp + 0xcc], eax
push 0
push str.DynamicCodeDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403015
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x10
mov dword [esp + 0xc0], eax
push 0
push str.DynamicCodeAllowOptOut
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403040
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x30
mov dword [esp + 0xc0], eax
push 0
push str.BlockNonMicrosoftBinaries
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x40306d
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x1000
mov dword [esp + 0xc0], eax
push 0
push str.FontDisable
push ecx
mov ecx, edi
call fcn.004010c0
nop dword [eax]
cmp eax, 1
jne 0x40309e
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x10000
mov dword [esp + 0xc0], eax
push 0
push str.NoRemoteImages
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4030cb
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x100000
mov dword [esp + 0xc0], eax
push 0
push str.NoLowLabelImages
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4030f8
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x1000000
mov dword [esp + 0xc0], eax
push 0
push str.PreferSystem32
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403125
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x10000000
mov dword [esp + 0xc0], eax
push 0
push str.RestrictIndirectBranchPrediction
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403152
mov eax, dword [esp + 0xcc]
or dword [esp + 0xc8], 0x10000
mov dword [esp + 0xcc], eax
push 0
push str.SpeculativeStoreBypassDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403183
mov eax, dword [esp + 0xcc]
or dword [esp + 0xc8], 0x1000000
mov dword [esp + 0xcc], eax
push 0
push str.ShadowStack
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4031b0
mov eax, dword [esp + 0xcc]
or dword [esp + 0xc8], 0x10000000
mov dword [esp + 0xcc], eax
push 0
push str.ContextIPValidation
push ecx
mov ecx, edi
call fcn.004010c0
nop
cmp eax, 1
jne 0x4031db
mov eax, dword [esp + 0xc8]
or dword [esp + 0xcc], 1
mov dword [esp + 0xc8], eax
push 0
push str.BlockNonCETEHCONT
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403205
mov eax, dword [esp + 0xc8]
or dword [esp + 0xcc], 0x30
mov dword [esp + 0xc8], eax
push 0
push str.BlockFSCTL
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403232
mov eax, dword [esp + 0xc8]
or dword [esp + 0xcc], 0x1000000
mov dword [esp + 0xc8], eax
push 0
push 0
push 0x10
lea eax, [esp + 0xcc]
push eax
push InitializeSListHead
push 0
push dword [esp + 0xa4]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x403297
push dword [0x42267c]
nop
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc5c
push str.UpdateProcThreadAttribute_Failed___Mitigations_
jmp 0x404058
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x80004
push 1
push 0
push 0
lea eax, [esp + 0x920]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403365
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x403350
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403350
push 0x10
push str.CreateProcess_Error__Mitigations_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc5c
push str.Failed_to_start_exe___Mitigations_
jmp 0x404058
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov eax, dword [esp + 0x8c]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x403380
push dword [esp + 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4037e9
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x8c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc5c
push str.HeapSize_Failed___Mitigations_
jmp 0x404058
lea eax, [esp + 0x50]
push eax
call fcn.00406450
add esp, 0xc
mov dword [esp + 0x48], 0x44
lea eax, [esp + 0xd0]
mov dword [esp + 0x7c], eax
mov eax, 0x10
mov word [esp + 0x7a], ax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 4
push 1
push 0
push 0
lea eax, [esp + 0x920]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [eax]
test eax, eax
jne 0x4037e9
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4034f0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4034f0
push 0x10
push str.CreateProcess_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc5c
push str.Failed_to_start_exe_
jmp 0x404058
push 0x44
lea eax, [esp + 0x50]
push 0
push eax
call fcn.00406450
add esp, 0xc
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x48], 0x48
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x403550
push 0x10
push 0x41cc5c
push str.Failed_to_get_size_required_for_attribute_list___FakeParentProcess_
jmp 0x404058
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x8c], eax
test eax, eax
jne 0x403585
push 0x10
push 0x41cc5c
push str.HeapAlloc_Fatal_Error___FakeParentProcess_
jmp 0x404058
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x404025
test esi, esi
je 0x404025
lea eax, [esp + 0x1c]
push eax
push 0
push 1
push dword [esp + 0x98]
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x4035f7
push dword [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc5c
push str.InitializeProcThreadAttributeList_Failed___FakeParentProcess_
jmp 0x404058
push str.FakeParentProcess
push ecx
mov ecx, edi
call fcn.00401160
mov dword [esp + 0xc], eax
test eax, eax
jne 0x40361e
push 0x10
push 0x41cc5c
push str.Failed_to_get_fake_parent_process_exe_name_
jmp 0x404058
lea ecx, [esp + 0x98]
mov dword [esp + 0x98], 0
push 0
push ecx
xor edx, edx
mov ecx, eax
call fcn.00401940
add esp, 8
mov dword [esp + 0x94], eax
test eax, eax
jne 0x40369c
push 0xc8
push eax
lea eax, [esp + 0xe8]
push eax
call fcn.00406450
add esp, 0xc
lea eax, [esp + 0xe0]
push dword [esp + 0x98]
push str.Failed_to_get_fake_parent_process_handle__Error:_u
push 0xffffffffffffffff
push 0x64
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0xe0]
push 0x10
push 0x41cc5c
push eax
jmp 0x404058
push 0
push 0
push 4
lea eax, [esp + 0xa0]
push eax
push 0x20000
push 0
push dword [esp + 0xa4]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
nop
test eax, eax
jne 0x4036e5
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc5c
push str.UpdateProcThreadAttribute_Failed__FakeParentProcess__
jmp 0x404058
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x80004
push 0
push 0
push 0
lea eax, [esp + 0x920]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40378f
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x40377e
mov eax, dword ds:[esp + 0x10]
test eax, eax
je 0x40377e
push 0x10
push str.CreateProcess_Error__FakeParentProcess_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc5c
push str.Failed_to_start_exe__FakeParentProcess__
jmp 0x404058
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov eax, dword [esp + 0x8c]
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x4037a3
push dword [esp + 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xc]
call fcn.0040477b
add esp, 4
mov dword [0x422458], 5
push 4
lea eax, [esp + 0xc0]
mov dword [esp + 0xc0], 1
push eax
push 0xd
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0x41e59c
push ecx
mov ecx, edi
call fcn.00401160
mov esi, eax
test esi, esi
jne 0x40382a
push 0x10
push 0x41cc5c
push str.Failed_to_get_dll_name_
jmp 0x4038a2
cmp dword [esp + 0x10], 0
push esi
jne 0x403858
lea eax, [esp + 0x2ec]
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [esp + 0x708]
push 0x104
push eax
call fcn.00401030
add esp, 0x18
jmp 0x403874
push 0x41d808
push 0xffffffffffffffff
lea eax, [esp + 0x704]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
push esi
mov dword [esp + 0x9c], eax
call fcn.0040477b
add esp, 4
cmp dword [esp + 0x98], 0xffffffff
jne 0x403973
push 0x10
push 0x41cc5c
push str.Unable_to_get_full_dll_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x42267c]
test eax, eax
je 0x4038d2
cmp dword [0x422680], 0
je 0x4038d2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4038f3
cmp dword ds:[esp + 0x14], 0
je 0x4038f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop dword [eax]
cmp eax, 0xffffffff
jne 0x403926
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
push 0x41cc5c
push str.ResumeThread_Failed___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte ds:[edi + 4], 1
jne 0x403950
push dword [edi]
mov byte [edi + 4], 0
call fcn.0040477b
add esp, 4
push 8
push edi
call fcn.00404a01
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xf14]
xor ecx, esp
call fcn.0040476d
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x41d1fc
push ecx
mov ecx, edi
call fcn.004010c0
test eax, eax
je 0x403a73
inc eax
mov esi, 1
mov dword [esp + 0xc], eax
cmp eax, esi
jbe 0x403a73
lfence
push 0x208
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.00406450
add esp, 0xc
lea eax, [esp + 0xe0]
push esi
push str.FileToCreate__zu
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
je 0x403a68
lea eax, [esp + 0xe0]
push eax
push ecx
mov ecx, edi
call fcn.00401160
mov dword [esp + 0x98], eax
test eax, eax
jne 0x403a12
push 0x10
push 0x41cc5c
push str.Failed_to_get_the_name_of_the_file_to_create_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403a68
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word ds:[ecx]
add ecx, 2
test ax, ax
jne 0x403a17
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf
jbe 0x403a48
push 0x10
push 0x41cc5c
push str.Name_of_the_file_to_create_is_too_long_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403a59
lfence
mov ecx, dword [esp + 0x98]
xor dl, dl
call fcn.004021c0
push dword [esp + 0x98]
call fcn.0040477b
add esp, 4
inc esi
cmp esi, dword [esp + 0xc]
jb 0x4039a2
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x20]
push eax
lea eax, [esp + 0x98]
mov dword [esp + 0x98], 0
push eax
lea eax, [esp + 0x700]
mov dword [esp + 0x18], 0
push eax
call fcn.00401c80
mov esi, dword [esp + 0xa0]
add esp, 0xc
test al, al
jne 0x403d0b
nop word [eax + eax]
test esi, esi
je 0x403b5c
push 0
push dword [esp + 0x24]
mov dword [0x422458], 3
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x208
lea eax, [esp + 0xd14]
push 0
push eax
call fcn.00406450
add esp, 0xc
cmp esi, 1
jne 0x403b02
mov eax, str.Failed_to_change_protection_of_allocated_memory_pages
nop
jmp 0x403b2a
cmp esi, 2
jne 0x403b0e
mov eax, str.Failed_to_enable_ACG
jmp 0x403b2a
cmp esi, 3
jne 0x403b1a
mov eax, str.SetThreadContext_Failed
jmp 0x403b2a
cmp esi, 4
mov eax, str.Failed_to_resume_therad
mov ecx, str.Unknown_fatal_error
cmovne eax, ecx
push eax
push str.Failed_to_inject_dll__Fatal_Error:__s_
push 0xffffffffffffffff
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0xd10]
push 0x10
push 0x41cc5c
push eax
jmp 0x403d68
mov dword [0x422458], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x208
mov esi, eax
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.00406450
add esp, 0xc
test esi, esi
je 0x403c57
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x403c57
mov ecx, dword [esp + 0x10]
cmp ecx, 1
jne 0x403bd0
mov eax, str.Failed_to_open_dll
jmp 0x403c28
cmp ecx, 2
jne 0x403bdf
mov eax, str.Failed_to_get_system_info
jmp 0x403c28
nop
cmp ecx, 3
jne 0x403bef
mov eax, str.Failed_to_alloc_memory_in_process_for_dll_path
jmp 0x403c28
cmp ecx, 4
jne 0x403bfe
mov eax, str.Failed_to_alloc_memory_in_process_for_dll_loader
jmp 0x403c28
nop
cmp ecx, 5
jne 0x403c0c
mov eax, str.Failed_to_write_dll_path_to_allocated_memory
jmp 0x403c28
cmp ecx, 6
jne 0x403c18
mov eax, str.GetThreadContext_Failed
jmp 0x403c28
cmp ecx, 7
mov eax, str.Failed_to_write_dll_loader_to_allocated_memory
mov esi, str.Unknown_error
cmovne eax, esi
push edx
push eax
push str.Failed_to_inject_dll__Error:__s:__s
push 0xffffffffffffffff
lea eax, [esp + 0xf0]
push 0x104
push eax
call fcn.00401030
add esp, 0x18
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x403ce8
mov ecx, dword ds:[esp + 0x10]
cmp ecx, 1
jne 0x403c6f
mov eax, str.Failed_to_open_dll
jmp 0x403cc8
cmp ecx, 2
jne 0x403c7e
mov eax, str.Failed_to_get_system_info
jmp 0x403cc8
nop
cmp ecx, 3
jne 0x403c8f
mov eax, str.Failed_to_alloc_memory_in_process_for_dll_path
jmp 0x403cc8
cmp ecx, 4
jne 0x403c9e
mov eax, str.Failed_to_alloc_memory_in_process_for_dll_loader
jmp 0x403cc8
nop
cmp ecx, 5
jne 0x403cac
mov eax, str.Failed_to_write_dll_path_to_allocated_memory
jmp 0x403cc8
cmp ecx, 6
jne 0x403cb8
mov eax, str.GetThreadContext_Failed
jmp 0x403cc8
cmp ecx, 7
mov eax, str.Failed_to_write_dll_loader_to_allocated_memory
mov edx, str.Unknown_error
cmovne eax, edx
push eax
push str.Failed_to_inject_dll__Error:__s_
push 0xffffffffffffffff
lea eax, [esp + 0xec]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
push 0x10
push 0x41cc5c
lea eax, [esp + 0xe8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.00402280
jmp 0x403d70
cmp dword [0x42267c], 0
je 0x403dbc
cmp dword [0x422680], 0
nop
je 0x403d70
push 0
push 0
push 0
push 0x401ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x403d46
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push 0
push 0x42267c
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x403d70
push 0x10
push 0x41cc5c
push str.Error_while_waiting_for_events_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [0x42267c], 0
je 0x403dbc
cmp dword [0x422680], 0
je 0x403dbc
cmp dword [0x422458], 0
jne 0x403da4
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x422458], 0
je 0x403d93
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x422458]
cmp eax, 1
je 0x403f3f
cmp eax, 2
jne 0x403e73
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
push 0x41cc5c
push str.Injected_dll_signaled_that_an_error_occurred_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword [esp + 0x18]
test esi, esi
je 0x403fb5
push 0x12c
lea eax, [esp + 0xe4]
mov dword [esp + 0x9c], 0
push 0
push eax
call fcn.00406450
add esp, 0xc
lea eax, [esp + 0x98]
push 0
push eax
push 0x12b
lea eax, [esp + 0xec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
cmp eax, 1
jne 0x403f7d
cmp dword [esp + 0x98], 0
je 0x403f7d
push 0x10
push str.Message_from_dll
lea eax, [esp + 0xe8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403f7d
cmp eax, 3
jne 0x403e8b
mov ecx, edi
lea esi, [eax - 2]
call fcn.00402280
jmp 0x403f84
cmp eax, 4
jne 0x403f2b
mov eax, dword [0x42245c]
nop dword [eax]
test eax, eax
je 0x403eba
push 0x8000
push 0
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [0x422684]
nop
test eax, eax
je 0x403eda
push 0x8000
push 0
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword ds:[esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x403f7d
push 0
push dword [esp + 0x24]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
call fcn.00402280
push 0x10
push 0x41cc5c
push str.ResumeThread_Failed___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403f84
cmp eax, 5
jne 0x403f7d
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x42245c]
test eax, eax
je 0x403f5e
push 0x8000
push 0
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [0x422684]
test eax, eax
je 0x403f7d
push 0x8000
push 0
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, dword [esp + 0x94]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403fbc
cmp dword [esp + 0x14], 0
je 0x403fbc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403fbc
mov esi, dword [esp + 0x94]
nop dword [eax]
test esi, esi
jne 0x403926
push 1
push str.WaitForProcessTermination
push ecx
mov ecx, edi
call fcn.004010c0
nop word [eax + eax]
cmp eax, 1
jne 0x403926
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x403926
push esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
call fcn.00402280
push 0x10
push 0x41cc5c
push str.Fatal_Error_while_waiting_for_the_process_to_close_
jmp 0x40391d
push dword [esp + 0x8c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc5c
push str.HeapSize_Failed___FakeParentProcess_
jmp 0x404058
push 0x10
push 0x41cc5c
push str.Unable_to_get_RtlGetNtVersionNumbers_or_RtlImageNtHeaderEx_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0xf1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040476d
mov esp, ebp
pop ebp
ret 0x10