Function at 0x4042d8
Capabilities:
Allocate or change rwx memory
Suspend thread

Disassembly:
push 0x40b108
push 0x40
push 1
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0
push 1
push 0x410157
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_WriteProcessMemory
push 0x40b108
push dword [0x40b108]
push 1
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0x40b108
push 0x40
push 1
push dword [0x40f82c]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0
push 1
push 0x410157
push dword [0x40f82c]
push dword [0x40f910]
call sub.kernel32.dll_WriteProcessMemory
push 0x40b108
push dword [0x40b108]
push 1
push dword [0x40f82c]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push dword [0x40f904]
call sub.kernel32.dll_ResumeThread
push 0xffffffffffffffff
push 0x40f920
call sub.kernel32.dll_WaitForDebugEvent
mov eax, dword [0x40f920]
cmp eax, 1
je 0x404306
push 0x80010001
push dword [0x40f928]
push dword [0x40f924]
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x4042d8
mov eax, dword [0x40f92c]
cmp eax, 0x80000003
jne 0x4042ee
mov eax, dword [0x40f938]
cmp eax, dword [0x40f834]
je 0x40465f
cmp eax, dword [0x40f82c]
jne 0x4042ee
push 0x410570
push dword [0x40f914]
call sub.kernel32.dll_GetThreadContext
push 0x40b108
push 0x40
push 1
push dword [0x40f82c]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0
push 1
push 0x40f838
push dword [0x40f82c]
push dword [0x40f910]
call sub.kernel32.dll_WriteProcessMemory
push 0x40b108
push dword [0x40b108]
push 1
push dword [0x40f82c]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0x40b108
push 0x40
push 1
push dword [0x40f830]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0
push 1
push 0x410157
push dword [0x40f830]
push dword [0x40f910]
call sub.kernel32.dll_WriteProcessMemory
push 0x40b108
push dword [0x40b108]
push 1
push dword [0x40f830]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
mov eax, dword [0x40f82c]
mov dword [0x410628], eax
push 0x410570
push dword [0x40f914]
call sub.kernel32.dll_SetThreadContext
push 0x10002
push dword [0x40f928]
push dword [0x40f924]
call sub.kernel32.dll_ContinueDebugEvent
push 0xffffffffffffffff
push 0x40f920
call sub.kernel32.dll_WaitForDebugEvent
mov eax, dword [0x40f920]
cmp eax, 1
je 0x40443d
push 0x80010001
push dword [0x40f928]
push dword [0x40f924]
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x40440f
mov eax, dword [0x40f92c]
cmp eax, 0x80000003
jne 0x404425
mov eax, dword [0x40f938]
cmp eax, dword [0x40f830]
je 0x404462
cmp eax, dword [0x40f834]
je 0x404595
push dword [0x40f904]
call sub.kernel32.dll_SuspendThread
push 0x410570
push dword [0x40f914]
call sub.kernel32.dll_GetThreadContext
push 0x40b108
push 0x40
push 1
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0
push 1
push 0x40f840
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_WriteProcessMemory
push 0x40b108
push dword [0x40b108]
push 1
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0x40b108
push 0x40
push 1
push dword [0x40f830]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0
push 1
push 0x40f83c
push dword [0x40f830]
push dword [0x40f910]
call sub.kernel32.dll_WriteProcessMemory
push 0x40b108
push dword [0x40b108]
push 1
push dword [0x40f830]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
mov eax, dword [0x40f830]
mov dword [0x410628], eax
mov eax, dword [0x410634]
add eax, 8
push 0
push 4
push 0x40f850
push eax
push dword [0x40f910]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x40f850]
add eax, 0xb8
push 0
push 4
push 0x40f850
push eax
push dword [0x40f910]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x40f850]
push eax
push 0x410570
push dword [0x40f914]
call sub.kernel32.dll_SetThreadContext
push 0x10002
push dword [0x40f928]
push dword [0x40f924]
call sub.kernel32.dll_ContinueDebugEvent
pop eax
ret
push dword [0x40f904]
call sub.kernel32.dll_SuspendThread
pushal
push str.____No_Nanomite
push dword [0x40f1d4]
call sub.kernel32.dll_lstrcatA
call fcn.00401fc4
push 0x410c76
push dword [0x40f1d4]
call sub.kernel32.dll_lstrcatA
popal
push 0x40b108
push 0x40
push 1
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0
push 1
push 0x40f840
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_WriteProcessMemory
push 0x40b108
push dword [0x40b108]
push 1
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0x410570
push dword [0x40f914]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [0x40f834]
mov dword [0x410628], eax
push 0x410570
push dword [0x40f914]
call sub.kernel32.dll_SetThreadContext
push 0x10002
push dword [0x40f928]
push dword [0x40f924]
call sub.kernel32.dll_ContinueDebugEvent
mov eax, 0xffffffff
ret
push dword [0x40f904]
call sub.kernel32.dll_SuspendThread
pushal
push str.____No_Nanomites_Used...
push dword [0x40f1d4]
call sub.kernel32.dll_lstrcatA
push 0x410c76
push dword [0x40f1d4]
call sub.kernel32.dll_lstrcatA
push str.Aborting_Nanomite_Scan...
push dword [0x40f1d4]
call sub.kernel32.dll_lstrcatA
call fcn.00401fc4
push 0x410c76
push dword [0x40f1d4]
call sub.kernel32.dll_lstrcatA
popal
push 0x40b108
push 0x40
push 1
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0
push 1
push 0x40f840
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_WriteProcessMemory
push 0x40b108
push dword [0x40b108]
push 1
push dword [0x40f834]
push dword [0x40f910]
call sub.kernel32.dll_VirtualProtectEx
push 0x410570
push dword [0x40f914]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [0x40f834]
mov dword [0x410628], eax
push 0x410570
push dword [0x40f914]
call sub.kernel32.dll_SetThreadContext
push 0x10002
push dword [0x40f928]
push dword [0x40f924]
call sub.kernel32.dll_ContinueDebugEvent
xor eax, eax
ret