Function at 0x408ff0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
push ebx
push esi
push str._PROCESS_HOLLOWING__n
call fcn.0051d9a3
add esp, 4
test edi, edi
je 0x409311
push edi
push str.___PE_file_content_:_0x_p_n
call fcn.0051d9a3
mov eax, dword [edi + 0x3c]
add esp, 8
cmp dword [edi + eax], 0x4550
je 0x409050
push str.____The_PE_file_is_not_valid___n
call fcn.0051d9a3
add esp, 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___The_PE_file_is_valid._n
call fcn.0051d9a3
add esp, 4
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.0051f990
mov ecx, dword [ebp + 8]
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 4
push 1
push 0
push 0
push 0
push ecx
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4090cf
push str.____An_error_is_occured_when_trying_to_create_the_target_process___n
call fcn.0051d9a3
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.004088f0
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0xc], 0
je 0x409304
lea esi, [esp + 0x10]
call fcn.00408780
mov esi, edx
test esi, esi
je 0x4092fa
test eax, eax
je 0x4092fa
push eax
push str.___Target_Process_PEB_:_0x_p_n
call fcn.0051d9a3
push esi
push str.___Target_Process_Image_Base_:_0x_p_n
call fcn.0051d9a3
mov ecx, dword [edi + 0x3c]
mov edx, 0x10b
add esp, 0x10
cmp word [ecx + edi + 0x18], dx
jne 0x409139
mov ebx, 1
push str.___Source_PE_Image_architecture_:_x86_n
jmp 0x409140
xor ebx, ebx
push str.___Source_PE_Image_architecture_:_x64_n
call fcn.0051d9a3
add esp, 4
cmp dword [esp + 0xc], 0
je 0x409156
push str.___Target_PE_Image_architecture_:_x86_n
jmp 0x40915b
push str.___Target_PE_Image_architecture_:_x64_n
call fcn.0051d9a3
add esp, 4
test ebx, ebx
je 0x409184
cmp dword [esp + 0xc], 0
jne 0x40918b
push str.____Architecture_are_not_compatible___n
call fcn.0051d9a3
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], 0
jne 0x40916e
push str.___Architecture_are_compatible___n
call fcn.0051d9a3
add esp, 4
test ebx, ebx
je 0x4092e4
mov eax, dword [edi + 0x3c]
movzx ebx, word [eax + edi + 0x5c]
cmp ebx, 0xffffffff
jne 0x4091b7
push str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_source_image._n
jmp 0x4090b3
push ebx
push str.___Source_Image_subsystem_:_0x_X_n
call fcn.0051d9a3
add esp, 8
cmp dword [esp + 0xc], 0
je 0x4092ce
mov ecx, esi
mov esi, dword [esp + 0x10]
call fcn.00408820
mov esi, eax
cmp esi, 0xffffffff
jne 0x4091ec
push str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
jmp 0x4090b3
push esi
push str.___Target_Process_subsystem_:_0x_X_n
call fcn.0051d9a3
add esp, 8
cmp ebx, esi
jne 0x4092c4
push str.___Subsytems_are_compatible._n
call fcn.0051d9a3
mov ecx, dword [edi + 0x3c]
add esp, 4
cmp dword [ecx + edi + 0xa0], 0
jne 0x40925a
push str.___The_source_image_doesnt_have_a_relocation_table._n
call fcn.0051d9a3
add esp, 4
push edi
lea ecx, [esp + 0x14]
call fcn.00408970
add esp, 4
test eax, eax
je 0x409275
push str.___The_injection_has_succeed___n
call fcn.0051d9a3
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.00408930
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___The_source_image_has_a_relocation_table._n
call fcn.0051d9a3
add esp, 4
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00408be0
jmp 0x409233
push str.____The_injection_has_failed___n
call fcn.0051d9a3
add esp, 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4092a3
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409311
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x10]
push eax
call esi
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____Subsytems_are_not_compatible._n
jmp 0x4090b3
push str.____Target_PE_Image_architecture_not_x86_n
call fcn.0051d9a3
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___Source_PE_Image_architecture_not_x86_n
call fcn.0051d9a3
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
jmp 0x4090b3
push str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
call fcn.0051d9a3
add esp, 4
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret