Function at 0x40d720
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push 0xffffffffffffffff
push 0x48e307
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b82d8]
xor eax, esp
push eax
lea eax, [esp + 0xcc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x18], 0
call ebx
mov ebp, dword [esp + 0xdc]
cmp ebp, eax
je 0x40da74
mov ecx, dword [edi]
test ecx, ecx
je 0x40d7a8
push 1
push ebp
call fcn.00418530
mov ecx, dword [edi]
mov esi, eax
push ebp
mov dword [esp + 0x1c], esi
call fcn.004186b0
test al, al
jne 0x40da74
test esi, esi
je 0x40d7a8
call ebx
push eax
mov ecx, esi
call fcn.004184d0
test al, al
jne 0x40da74
push 0x495a34
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x495a40
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push 0
push 0x1f0fff
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40da74
mov eax, dword [edi + 0x1c]
push 4
push 0x1000
lea eax, [eax + eax + 2]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x40da74
cmp dword [edi + 0x20], 8
mov ecx, dword [edi + 0x1c]
mov dword [esp + 0x20], 0
jb 0x40d813
mov eax, dword [edi + 0xc]
jmp 0x40d816
lea eax, [edi + 0xc]
lea edx, [esp + 0x20]
push edx
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40d84e
mov edx, dword [edi + 0x1c]
push 0x8000
lea eax, [edx + edx + 2]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40da74
mov eax, dword [edi + 0x1c]
lea ecx, [eax + eax + 2]
cmp dword [esp + 0x20], ecx
je 0x40d879
push 0x8000
lea edx, [eax + eax + 2]
push edx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40da74
push 1
push 2
lea ecx, [esp + 0x54]
call fcn.0040c020
lea eax, [ebp*8]
sub eax, ebp
push eax
push 0x495a50
lea ecx, [ebp + ebp*2]
push ecx
lea edx, [esp + 0x58]
push 0x495a60
push edx
mov dword [esp + 0xe8], 0
call fcn.0040c170
add esp, 8
mov ecx, eax
call fcn.0040c4d0
push eax
call fcn.0040c170
add esp, 8
mov ecx, eax
call fcn.0040c4d0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x50]
call fcn.0040a820
cmp dword [eax + 0x18], 0x10
jb 0x40d8e7
mov eax, dword [eax + 4]
jmp 0x40d8ea
add eax, 4
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebp, eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebp
call fcn.00408f80
test ebp, ebp
jne 0x40d92b
mov edi, dword [edi + 0x1c]
push 0x8000
lea ecx, [edi + edi + 2]
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40da60
mov edx, dword [esp + 0x14]
push 0
push 0
push ebx
push edx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebp, eax
test ebp, ebp
je 0x40da3b
push 0x1388
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40d97e
mov edi, dword [edi + 0x1c]
push 0x8000
lea eax, [edi + edi + 2]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40da60
lea ecx, [esp + 0x14]
push ecx
push ebp
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], 0
je 0x40da16
mov ecx, dword [edi]
test ecx, ecx
je 0x40d9da
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x40d9be
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, ebp
call fcn.00418470
jmp 0x40d9da
mov edx, dword [esp + 0xdc]
mov eax, dword [esp + 0x1c]
push 0x2710
push edx
push eax
call fcn.00418820
cmp eax, 1
jne 0x40da16
mov ebp, dword [edi + 0x40]
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x40d9ee
push 0xffffffffffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xdc]
push ecx
lea edx, [esp + 0x28]
push edx
lea ecx, [edi + 0x58]
mov byte [esp + 0xdc], 1
call fcn.00410b30
test ebp, ebp
je 0x40da16
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [edi + 0x1c]
push 0x8000
lea eax, [edi + edi + 2]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [esp + 0x1c]
push ecx
jmp 0x40da5e
mov edi, dword [edi + 0x1c]
push 0x8000
lea edx, [edi + edi + 2]
push edx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
lea ecx, [esp + 0x4c]
mov dword [esp + 0xd4], 0xffffffff
call fcn.00408f40
mov ecx, dword [esp + 0xcc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret 4