Function at 0x4023c0
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Create pipe
Create process on windows
Create process suspended
Create thread
Read file on windows
Resume thread
Spoof parent pid
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xf18
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0xf14], eax
push esi
push edi
push 4
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 0xb
push eax
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xa4]
mov dword [esp + 0xa4], 3
push eax
push 3
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xa8]
mov dword [esp + 0xa8], 1
push eax
push 6
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xac]
mov dword [esp + 0xac], 4
push eax
push 7
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0xb0], 1
push eax
push 9
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xb4]
mov dword [esp + 0xb4], 3
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], 1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 4
lea eax, [esp + 0xbc]
mov dword [esp + 0xbc], 0xf
push eax
push 0xe
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push ecx
mov ecx, str.User32.dll
call fcn.00401ba0
add esp, 4
test al, al
jne 0x4024e9
push 0x10
push 0x41cc4c
push str.Failed_to_load_User32.dll
jmp 0x403fa0
push ecx
mov ecx, str.Shlwapi.dll
call fcn.00401ba0
add esp, 4
test al, al
jne 0x40250c
push 0x10
push 0x41cc4c
push str.Failed_to_load_Shlwapi.dll
jmp 0x403fa0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlImageNtHeaderEx
push esi
mov dword [0x422464], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x422464]
mov dword [0x422468], eax
test esi, esi
je 0x403f94
test eax, eax
je 0x403f94
push 0x422688
push 0x42246c
push 0x422678
mov ecx, esi
call dword [0x4171a8]
call esi
mov eax, dword [0x422688]
and eax, 0x7fff
cmp dword [0x422678], 0xa
mov dword [0x422688], eax
jne 0x40259b
cmp eax, 0x4563
jae 0x40259b
push 0x10
push 0x41cc4c
push str.Update_Windows_10_to_Redstone_5__1809__or_above_
jmp 0x403fa0
push 0x208
lea eax, [esp + 0x2ec]
push 0
push eax
call fcn.00406390
add esp, 0xc
lea eax, [esp + 0x4f0]
push 0x208
push 0
push eax
call fcn.00406390
add esp, 0xc
lea eax, [esp + 0x900]
push 0x410
push 0
push eax
call fcn.00406390
add esp, 0xc
lea eax, [esp + 0x6f8]
push 0x208
push 0
push eax
call fcn.00406390
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x104
lea eax, [esp + 0x2ec]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x402629
push 0x10
push 0x41cc4c
push str.Unable_to_get_ini_path___1_
jmp 0x403fa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x402645
push 0x10
push 0x41cc4c
push str.Unable_to_get_ini_path___2_
jmp 0x403fa0
lea eax, [esp + 0x2e8]
push 0x5c
push eax
call fcn.00405d65
add esp, 8
test eax, eax
je 0x402660
xor ecx, ecx
mov word [eax], cx
lea eax, ds:[esp + 0x2e8]
push eax
push str._sDLLInjector.ini
push 0xffffffffffffffff
lea eax, [esp + 0x4fc]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40269e
push 0x10
push 0x41cc4c
push str.Unable_to_get_ini_path___3_
jmp 0x403fa0
push 0
push 0x80
push 3
push 0
push 0
push 0
lea eax, [esp + 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [eax + eax]
cmp eax, 0xffffffff
jne 0x4026d6
push 0x10
push 0x41cc4c
push str.Unable_to_open_ini_
jmp 0x403fa0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.004046c5
add esp, 4
mov edi, eax
xorps xmm0, xmm0
push 0x208
movq qword [edi], xmm0
call fcn.00404954
add esp, 4
mov esi, eax
push 0x208
push 0
push esi
call fcn.00406390
add esp, 0xc
mov dword [edi], esi
lea eax, [esp + 0x4f0]
push eax
push 0x104
push esi
call fcn.00407b70
add esp, 0xc
test eax, eax
jne 0x402730
mov byte [edi + 4], 1
push 0
push str.AllowMultipleInstancesOfDLLInjector
push ecx
mov ecx, edi
call fcn.004010c0
nop
test eax, eax
jne 0x402785
push 1
push eax
lea edx, [esp + 0x13]
mov byte [esp + 0x13], al
mov ecx, 0x41d5b8
call fcn.00401940
add esp, 8
test eax, eax
je 0x402785
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0xb], 1
jne 0x402785
push 0x10
push 0x41cc4c
push str.Only_one_instance_of_DLLInjector.exe_is_allowed__close_it_before_trying_to_start_DLLInjector_again_
jmp 0x403fa0
push 0
push str.UseFullPathsFromIni
push ecx
mov ecx, edi
call fcn.004010c0
push 0x41d6c8
push ecx
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.00401160
mov esi, eax
test esi, esi
jne 0x4027bc
push 0x10
push 0x41cc4c
push str.Failed_to_get_exe_name_
jmp 0x403fa0
push esi
push 0x41d700
push 0xffffffffffffffff
push 0x104
push 0x422470
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4027ec
push 0x10
push 0x41cc4c
push str.Failed_to_get_exe_name___3_
jmp 0x403fa0
cmp dword [esp + 0x10], 1
jne 0x4027fe
push 0x422470
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push 1
push 0
xor edx, edx
mov ecx, 0x422470
call fcn.00401940
add esp, 8
test eax, eax
je 0x402868
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x208
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.00406390
add esp, 0xc
lea eax, [esp + 0xe0]
push 0x422470
push str.There_is_already_a_process_with_the_name__s_running__close_it_before_trying_to_use_DLLInjector_again_
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0xe0]
push 0x10
push 0x41cc4c
push eax
jmp 0x403fa0
push str.CommandLine
push ecx
mov ecx, edi
call fcn.00401160
mov dword ds:[esp + 0x98], eax
test eax, eax
jne 0x4028e2
push esi
cmp dword [esp + 0x14], eax
jne 0x4028bb
lea eax, [esp + 0x2ec]
push eax
push str.__s_s_
push 0xffffffffffffffff
lea eax, [esp + 0x910]
push 0x208
push eax
call fcn.00401030
add esp, 0x18
mov dword [esp + 0x94], eax
jmp 0x402948
push str.__s_
push 0xffffffffffffffff
lea eax, [esp + 0x90c]
push 0x208
push eax
call fcn.00401030
add esp, 0x14
mov dword [esp + 0x94], eax
jmp 0x402948
cmp dword [esp + 0x10], 0
push eax
push esi
jne 0x402911
lea eax, [esp + 0x2f0]
push eax
push str.__s_s___s
push 0xffffffffffffffff
lea eax, [esp + 0x914]
push 0x208
push eax
call fcn.00401030
add esp, 0x1c
jmp 0x40292d
push str.__s___s
push 0xffffffffffffffff
lea eax, [esp + 0x910]
push 0x208
push eax
call fcn.00401030
add esp, 0x18
push dword ds:[esp + 0x98]
mov dword [esp + 0x98], eax
call fcn.004046c0
add esp, 4
push esi
call fcn.004046c0
add esp, 4
cmp dword [esp + 0x94], 0xffffffff
jne 0x40296c
push 0x10
push 0x41cc4c
push str.Unable_to_get_full_exe_path_
jmp 0x403fa0
push 0
push str.Use4GBPatch
push ecx
mov ecx, edi
call fcn.004010c0
mov dword ds:[esp + 0x1c], eax
test eax, eax
je 0x402a36
mov esi, 1
inc eax
cmp eax, esi
jbe 0x402a36
lfence
nop dword [eax]
push 0x208
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.00406390
add esp, 0xc
lea eax, [esp + 0xe0]
push esi
push str.FileToPatch__u
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
je 0x402a26
lea eax, [esp + 0xe0]
push eax
push ecx
mov ecx, edi
call fcn.00401160
mov dword [esp + 0x98], eax
test eax, eax
je 0x402ada
mov edx, eax
lea ecx, [esp + 0x2e8]
call fcn.00401480
push dword [esp + 0x98]
mov byte [esp + 0xf], al
call fcn.004046c0
add esp, 4
cmp byte [esp + 0xb], 0
je 0x402ac9
mov ecx, dword [esp + 0x1c]
inc esi
lea eax, [ecx + 1]
cmp esi, eax
jb 0x4029a0
push 0
push str.EnableFakeParentProcess
push ecx
mov ecx, edi
call fcn.004010c0
mov dword ds:[esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x14], 0
movaps xmmword [esp + 0x20], xmm0
test eax, eax
jne 0x403485
push eax
push eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
push 1
push eax
movaps xmmword [esp + 0xe0], xmm0
mov dword [esp + 0x4c], 0xc
mov dword [esp + 0x54], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
mov dword [0x42267c], eax
lea eax, [esp + 0x44]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [0x42267c]
mov dword [0x422680], eax
test ecx, ecx
jne 0x402aeb
push 0x10
push 0x41cc4c
push str.Failed_to_create_patching_event_
jmp 0x403fa0
push 0x10
push 0x41cc4c
push str.Failed_to_patch_4GB_flag_in_exe_
jmp 0x403fa0
push 0x10
push 0x41cc4c
push str.Failed_to_get_the_exe_name__4GB_patch__
jmp 0x403fa0
test eax, eax
jne 0x402b07
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc4c
push str.Failed_to_create_fail_event_
jmp 0x403fa0
push 0x12c
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x402b57
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc4c
push str.Failed_to_create_pipe_
jmp 0x403fa0
mov eax, dword [0x42267c]
push 0
mov dword [esp + 0xd8], eax
mov eax, dword [0x422680]
push str.EnableMitigationsOnChildProcess
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, edi
mov dword [esp + 0xe8], eax
call fcn.004010c0
push 0x44
push 0
cmp eax, 1
jne 0x403385
lea eax, [esp + 0x54]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0xcc], xmm0
call fcn.00406390
add esp, 0xc
mov dword [esp + 0x94], 0
lea eax, [esp + 0xd0]
mov dword [esp + 0x48], 0x48
mov dword [esp + 0x7c], eax
mov eax, 0x10
mov word [esp + 0x7a], ax
lea eax, [esp + 0x94]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov esi, dword [esp + 0x94]
test esi, esi
jne 0x402c37
push dword [0x42267c]
nop dword [eax + eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc4c
push str.Failed_to_get_size_required_for_attribute_list___Mitigations_
jmp 0x403fa0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x8c], eax
test eax, eax
jne 0x402c8f
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc4c
push str.HeapAlloc_Fatal_Error___Mitigations_
jmp 0x403fa0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x40332b
test esi, esi
je 0x40332b
lea eax, [esp + 0x94]
push eax
push 0
push 1
push dword [esp + 0x98]
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x402d25
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x8c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc4c
push str.InitializeProcThreadAttributeList_Failed___Mitigations_
jmp 0x403fa0
push 0
push 0x41dc18
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402d4e
or dword [esp + 0xc0], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0xc4], eax
push 0
push str.SEHOP
push ecx
mov ecx, edi
call fcn.004010c0
nop dword [eax]
cmp eax, 1
jne 0x402d7b
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 4
mov dword [esp + 0xc4], eax
push 0
push str.HeapTerminate
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402da8
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x1000
mov dword [esp + 0xc4], eax
push 0
push str.ForceRelocateImages
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402dd5
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x100
mov dword [esp + 0xc4], eax
push 0
push str.BottomUpASLR
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402e03
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x10000
mov dword [esp + 0xc4], eax
push 0
push str.HighEntropyASLR
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402e30
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x100000
mov dword [esp + 0xc4], eax
push 0
push str.RelocationsRequired
push ecx
mov ecx, edi
call fcn.004010c0
nop
cmp eax, 1
jne 0x402e5e
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x300
mov dword [esp + 0xc4], eax
push 0
push str.StrictHandleChecks
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402e8b
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x1000000
mov dword [esp + 0xc4], eax
push 0
push str.Win32kSystemCallDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402eb8
mov eax, dword [esp + 0xc4]
or dword [esp + 0xc0], 0x10000000
mov dword [esp + 0xc4], eax
push 0
push str.ExtensionPointDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402ee2
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 1
mov dword [esp + 0xc0], eax
push 0
push 0x41dd58
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402f0f
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x100
mov dword [esp + 0xc0], eax
push 0
push str.CFGExportSuppression
push ecx
mov ecx, edi
call fcn.004010c0
nop
cmp eax, 1
jne 0x402f3e
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x300
mov dword [esp + 0xc0], eax
push 0
push str.StrictCFG
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402f6b
mov eax, dword [esp + 0xcc]
or dword [esp + 0xc8], 0x100
mov dword [esp + 0xcc], eax
push 0
push str.DynamicCodeDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402f95
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x10
mov dword [esp + 0xc0], eax
push 0
push str.DynamicCodeAllowOptOut
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402fc0
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x30
mov dword [esp + 0xc0], eax
push 0
push str.BlockNonMicrosoftBinaries
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x402fed
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x1000
mov dword [esp + 0xc0], eax
push 0
push str.FontDisable
push ecx
mov ecx, edi
call fcn.004010c0
nop dword [eax]
cmp eax, 1
jne 0x40301e
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x10000
mov dword [esp + 0xc0], eax
push 0
push str.NoRemoteImages
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x40304b
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x100000
mov dword [esp + 0xc0], eax
push 0
push str.NoLowLabelImages
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403078
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x1000000
mov dword [esp + 0xc0], eax
push 0
push str.PreferSystem32
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4030a5
mov eax, dword [esp + 0xc0]
or dword [esp + 0xc4], 0x10000000
mov dword [esp + 0xc0], eax
push 0
push str.RestrictIndirectBranchPrediction
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4030d2
mov eax, dword [esp + 0xcc]
or dword [esp + 0xc8], 0x10000
mov dword [esp + 0xcc], eax
push 0
push str.SpeculativeStoreBypassDisable
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403103
mov eax, dword [esp + 0xcc]
or dword [esp + 0xc8], 0x1000000
mov dword [esp + 0xcc], eax
push 0
push str.ShadowStack
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403130
mov eax, dword [esp + 0xcc]
or dword [esp + 0xc8], 0x10000000
mov dword [esp + 0xcc], eax
push 0
push str.ContextIPValidation
push ecx
mov ecx, edi
call fcn.004010c0
nop
cmp eax, 1
jne 0x40315b
mov eax, dword [esp + 0xc8]
or dword [esp + 0xcc], 1
mov dword [esp + 0xc8], eax
push 0
push str.BlockNonCETEHCONT
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x403185
mov eax, dword [esp + 0xc8]
or dword [esp + 0xcc], 0x30
mov dword [esp + 0xc8], eax
push 0
push str.BlockFSCTL
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4031b2
mov eax, dword [esp + 0xc8]
or dword [esp + 0xcc], 0x1000000
mov dword [esp + 0xc8], eax
push 0
push 0
push 0x10
lea eax, [esp + 0xcc]
push eax
push GetCommandLineW
push 0
push dword [esp + 0xa4]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x403217
push dword [0x42267c]
nop
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc4c
push str.UpdateProcThreadAttribute_Failed___Mitigations_
jmp 0x403fa0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x80004
push 1
push 0
push 0
lea eax, [esp + 0x920]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4032e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x42267c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4032d0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4032d0
push 0x10
push str.CreateProcess_Error__Mitigations_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc4c
push str.Failed_to_start_exe___Mitigations_
jmp 0x403fa0
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov eax, dword [esp + 0x8c]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x403300
push dword [esp + 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x403769
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x8c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc4c
push str.HeapSize_Failed___Mitigations_
jmp 0x403fa0
lea eax, [esp + 0x50]
push eax
call fcn.00406390
add esp, 0xc
mov dword [esp + 0x48], 0x44
lea eax, [esp + 0xd0]
mov dword [esp + 0x7c], eax
mov eax, 0x10
mov word [esp + 0x7a], ax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 4
push 1
push 0
push 0
lea eax, [esp + 0x920]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [eax]
test eax, eax
jne 0x403769
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x42267c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x403470
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403470
push 0x10
push str.CreateProcess_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc4c
push str.Failed_to_start_exe_
jmp 0x403fa0
push 0x44
lea eax, [esp + 0x50]
push 0
push eax
call fcn.00406390
add esp, 0xc
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x48], 0x48
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x4034d0
push 0x10
push 0x41cc4c
push str.Failed_to_get_size_required_for_attribute_list___FakeParentProcess_
jmp 0x403fa0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x8c], eax
test eax, eax
jne 0x403505
push 0x10
push 0x41cc4c
push str.HeapAlloc_Fatal_Error___FakeParentProcess_
jmp 0x403fa0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x403f6c
test esi, esi
je 0x403f6c
lea eax, [esp + 0x1c]
push eax
push 0
push 1
push dword [esp + 0x98]
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x403577
push dword [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc4c
push str.InitializeProcThreadAttributeList_Failed___FakeParentProcess_
jmp 0x403fa0
push str.FakeParentProcess
push ecx
mov ecx, edi
call fcn.00401160
mov dword [esp + 0xc], eax
test eax, eax
jne 0x40359e
push 0x10
push 0x41cc4c
push str.Failed_to_get_fake_parent_process_exe_name_
jmp 0x403fa0
lea ecx, [esp + 0x98]
mov dword [esp + 0x98], 0
push 0
push ecx
xor edx, edx
mov ecx, eax
call fcn.00401940
add esp, 8
mov dword [esp + 0x94], eax
test eax, eax
jne 0x403614
push 0xc8
push eax
lea eax, [esp + 0xe8]
push eax
call fcn.00406390
add esp, 0xc
lea eax, [esp + 0xe0]
push dword [esp + 0x98]
push str.Failed_to_get_fake_parent_process_handle__Error:_u
push 0xffffffffffffffff
push 0x64
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0xe0]
push 0x10
push 0x41cc4c
push eax
jmp 0x403fa0
push 0
push 0
push 4
lea eax, [esp + 0xa0]
push eax
push 0x20000
push 0
push dword [esp + 0xa4]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x403658
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41cc4c
push str.UpdateProcThreadAttribute_Failed__FakeParentProcess__
jmp 0x403fa0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x80004
push 0
push 0
push 0
lea eax, [esp + 0x920]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403707
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x94]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4036f6
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4036f6
push 0x10
push str.CreateProcess_Error__FakeParentProcess_
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10
push 0x41cc4c
push str.Failed_to_start_exe__FakeParentProcess__
jmp 0x403fa0
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov eax, dword [esp + 0x8c]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x403720
push dword [esp + 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xc]
call fcn.004046c0
add esp, 4
mov dword [0x422458], 5
push 4
lea eax, [esp + 0xc0]
mov dword [esp + 0xc0], 1
push eax
push 0xd
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0x41e494
push ecx
mov ecx, edi
call fcn.00401160
mov esi, eax
test esi, esi
jne 0x4037aa
push 0x10
push 0x41cc4c
push str.Failed_to_get_dll_name_
jmp 0x403822
cmp dword [esp + 0x10], 0
push esi
jne 0x4037d8
lea eax, [esp + 0x2ec]
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [esp + 0x708]
push 0x104
push eax
call fcn.00401030
add esp, 0x18
jmp 0x4037f4
push 0x41d700
push 0xffffffffffffffff
lea eax, [esp + 0x704]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
push esi
mov dword [esp + 0x9c], eax
call fcn.004046c0
add esp, 4
cmp dword [esp + 0x98], 0xffffffff
jne 0x4038f3
push 0x10
push 0x41cc4c
push str.Unable_to_get_full_dll_path_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x42267c]
test eax, eax
je 0x403852
cmp dword [0x422680], 0
je 0x403852
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403873
cmp dword ds:[esp + 0x14], 0
je 0x403873
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop dword [eax]
cmp eax, 0xffffffff
jne 0x4038a6
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
push 0x41cc4c
push str.ResumeThread_Failed___1_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte ds:[edi + 4], 1
jne 0x4038d0
push dword [edi]
mov byte [edi + 4], 0
call fcn.004046c0
add esp, 4
push 8
push edi
call fcn.00404946
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xf14]
xor ecx, esp
call fcn.004046b2
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x41d1ec
push ecx
mov ecx, edi
call fcn.004010c0
test eax, eax
je 0x4039f3
inc eax
mov esi, 1
mov dword [esp + 0xc], eax
cmp eax, esi
jbe 0x4039f3
lfence
push 0x208
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.00406390
add esp, 0xc
lea eax, [esp + 0xe0]
push esi
push str.FileToCreate__zu
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00401030
add esp, 0x14
cmp eax, 0xffffffff
je 0x4039e8
lea eax, [esp + 0xe0]
push eax
push ecx
mov ecx, edi
call fcn.00401160
mov dword [esp + 0x98], eax
test eax, eax
jne 0x403992
push 0x10
push 0x41cc4c
push str.Failed_to_get_the_name_of_the_file_to_create_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4039e8
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word ds:[ecx]
add ecx, 2
test ax, ax
jne 0x403997
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf
jbe 0x4039c8
push 0x10
push 0x41cc4c
push str.Name_of_the_file_to_create_is_too_long_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4039d9
lfence
mov ecx, dword [esp + 0x98]
xor dl, dl
call fcn.004021c0
push dword [esp + 0x98]
call fcn.004046c0
add esp, 4
inc esi
cmp esi, dword [esp + 0xc]
jb 0x403922
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x20]
push eax
lea eax, [esp + 0x98]
mov dword [esp + 0x98], 0
push eax
lea eax, [esp + 0x700]
mov dword [esp + 0x18], 0
push eax
call fcn.00401c80
mov esi, dword [esp + 0xa0]
add esp, 0xc
test al, al
jne 0x403c76
nop word [eax + eax]
test esi, esi
je 0x403adc
push 0
push dword [esp + 0x24]
mov dword [0x422458], 3
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x208
lea eax, [esp + 0xd14]
push 0
push eax
call fcn.00406390
add esp, 0xc
cmp esi, 1
jne 0x403a82
mov eax, str.Failed_to_change_protection_of_allocated_memory_pages
nop
jmp 0x403aaa
cmp esi, 2
jne 0x403a8e
mov eax, str.Failed_to_enable_ACG
jmp 0x403aaa
cmp esi, 3
jne 0x403a9a
mov eax, str.SetThreadContext_Failed
jmp 0x403aaa
cmp esi, 4
mov eax, str.Failed_to_resume_therad
mov ecx, str.Unknown_fatal_error
cmovne eax, ecx
push eax
push str.Failed_to_inject_dll__Fatal_Error:__s_
push 0xffffffffffffffff
lea eax, [esp + 0xd1c]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
lea eax, [esp + 0xd10]
push 0x10
push 0x41cc4c
push eax
jmp 0x403cd7
mov dword [0x422458], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x208
mov esi, eax
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.00406390
add esp, 0xc
test esi, esi
je 0x403bcd
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x403bcd
mov ecx, dword [esp + 0x10]
cmp ecx, 1
jne 0x403b50
mov eax, str.Failed_to_open_dll
jmp 0x403ba0
cmp ecx, 2
jne 0x403b5c
mov eax, str.Failed_to_get_system_info
jmp 0x403ba0
nop dword [eax]
cmp ecx, 3
jne 0x403b6c
mov eax, str.Failed_to_alloc_memory_in_process_for_dll_path
jmp 0x403ba0
cmp ecx, 4
jne 0x403b78
mov eax, str.Failed_to_alloc_memory_in_process_for_dll_loader
jmp 0x403ba0
cmp ecx, 5
jne 0x403b84
mov eax, str.Failed_to_write_dll_path_to_allocated_memory
jmp 0x403ba0
cmp ecx, 6
jne 0x403b90
mov eax, str.GetThreadContext_Failed
jmp 0x403ba0
cmp ecx, 7
mov eax, str.Failed_to_write_dll_loader_to_allocated_memory
mov esi, str.Unknown_error
cmovne eax, esi
push edx
push eax
push str.Failed_to_inject_dll__Error:__s:__s
push 0xffffffffffffffff
lea eax, [esp + 0xf0]
push 0x104
push eax
call fcn.00401030
add esp, 0x18
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x403c53
mov ecx, dword [esp + 0x10]
cmp ecx, 1
jne 0x403be5
mov eax, str.Failed_to_open_dll
nop dword [eax + eax]
jmp 0x403c36
cmp ecx, 2
jne 0x403bf4
mov eax, str.Failed_to_get_system_info
jmp 0x403c36
cmp ecx, 3
jne 0x403c02
mov eax, str.Failed_to_alloc_memory_in_process_for_dll_path
nop
jmp 0x403c36
cmp ecx, 4
jne 0x403c0e
mov eax, str.Failed_to_alloc_memory_in_process_for_dll_loader
jmp 0x403c36
cmp ecx, 5
jne 0x403c1a
mov eax, str.Failed_to_write_dll_path_to_allocated_memory
jmp 0x403c36
cmp ecx, 6
jne 0x403c26
mov eax, str.GetThreadContext_Failed
jmp 0x403c36
cmp ecx, 7
mov eax, str.Failed_to_write_dll_loader_to_allocated_memory
mov edx, str.Unknown_error
cmovne eax, edx
push eax
push str.Failed_to_inject_dll__Error:__s_
push 0xffffffffffffffff
lea eax, [esp + 0xec]
push 0x104
push eax
call fcn.00401030
add esp, 0x14
push 0x10
push 0x41cc4c
lea eax, [esp + 0xe8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.00402280
jmp 0x403cdf
cmp dword [0x42267c], 0
nop dword [eax]
je 0x403d2b
cmp dword [0x422680], 0
je 0x403cdf
push 0
push 0
push 0
push 0x401ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x403cb3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push 0
push 0x42267c
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x403cdf
push 0x10
push 0x41cc4c
push str.Error_while_waiting_for_events_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [0x42267c], 0
je 0x403d2b
cmp dword [0x422680], 0
je 0x403d2b
cmp dword [0x422458], 0
jne 0x403d13
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x422458], 0
je 0x403d02
push dword [0x42267c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x422680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x422458]
cmp eax, 1
je 0x403e9f
nop dword [eax]
cmp eax, 2
jne 0x403deb
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
push 0x41cc4c
push str.Injected_dll_signaled_that_an_error_occurred_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword [esp + 0x18]
test esi, esi
je 0x403f08
push 0x12c
lea eax, [esp + 0xe4]
mov dword [esp + 0x9c], 0
push 0
push eax
call fcn.00406390
add esp, 0xc
lea eax, [esp + 0x98]
push 0
push eax
push 0x12b
lea eax, [esp + 0xec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x403ed6
cmp dword [esp + 0x98], 0
je 0x403ed6
push 0x10
push str.Message_from_dll
lea eax, [esp + 0xe8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403ed6
cmp eax, 3
jne 0x403dff
mov ecx, edi
lea esi, [eax - 2]
call fcn.00402280
jmp 0x403edd
nop
cmp eax, 4
jne 0x403e8b
mov eax, dword [0x42245c]
test eax, eax
je 0x403e26
push 0x8000
push 0
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [0x422684]
test eax, eax
je 0x403e46
push 0x8000
push 0
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x403ed6
push 0
push dword [esp + 0x24]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
call fcn.00402280
push 0x10
push 0x41cc4c
push str.ResumeThread_Failed___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403edd
cmp eax, 5
jne 0x403ed6
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x42245c]
test eax, eax
je 0x403eba
push 0x8000
push 0
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [0x422684]
nop
test eax, eax
je 0x403ed6
push 0x8000
push 0
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, dword [esp + 0x94]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403f0f
cmp dword [esp + 0x14], 0
je 0x403f0f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword ds:[esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403f0f
mov esi, dword [esp + 0x94]
test esi, esi
jne 0x4038a6
push 1
push str.WaitForProcessTermination
push ecx
mov ecx, edi
call fcn.004010c0
cmp eax, 1
jne 0x4038a6
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [eax + eax]
cmp eax, 0xffffffff
jne 0x4038a6
push esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
call fcn.00402280
push 0x10
push 0x41cc4c
push str.Fatal_Error_while_waiting_for_the_process_to_close_
jmp 0x40389d
push dword [esp + 0x8c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x10
push 0x41cc4c
push str.HeapSize_Failed___FakeParentProcess_
jmp 0x403fa0
push 0x10
push 0x41cc4c
push str.Unable_to_get_RtlGetNtVersionNumbers_or_RtlImageNtHeaderEx_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0xf1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.004046b2
mov esp, ebp
pop ebp
ret 0x10