Function at 0x4912f0
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Inject thread
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x681c40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x124
xor edi, edi
lea eax, [ebp - 0x134]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x138], 0x128
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4913bb
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
mov ecx, str.3_m_
call fcn.004943c0
lea eax, [ebp - 0x114]
mov ecx, str.3_m_
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x491395
test dl, dl
je 0x491391
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x491395
add ecx, 2
add eax, 2
test dl, dl
jne 0x491375
xor eax, eax
jmp 0x49139a
sbb eax, eax
or eax, 1
test eax, eax
je 0x4913b5
lea eax, [ebp - 0x138]
push eax
push esi
call edi
test eax, eax
jne 0x491360
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4913c6
mov edi, dword [ebp - 0x130]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x4913fc
mov edx, str.Process_ID_could_not_be_found___Error_code:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004981b0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x498b90
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.The_process_ID_of_target_process_is:
call fcn.004981b0
push edi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x498b90
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push edi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edi, eax
test edi, edi
jne 0x491443
mov edx, str.Failed_to_gain_a_handle_to_the_process___Error_code:
jmp 0x4913d1
mov edx, str.Handle_to_target_process_acquired...
call fcn.004981b0
push 0x498b90
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4914d4
push str.NtOpenFile
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4914d4
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov cl, byte [eax + 4]
push 0
push 5
mov byte [ebp - 8], cl
lea ecx, [ebp - 0xc]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x4914bd
mov edx, str.Failed_to_bypass_Trusted_Mode
call fcn.004981b0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
jmp 0x4914c7
mov edx, str.Trusted_Mode_Bypassed...
call fcn.004981b0
push 0x498b90
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp byte [0x681eeb], 0
mov eax, 0x681ed0
movups xmm2, xmmword [0x673020]
mov ecx, 0x681ed4
mov edx, 0x681ed8
mov esi, 0x681edc
je 0x4915c6
movd xmm0, dword [eax]
movaps xmm1, xmmword [0x672f90]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [eax], xmm1
movd xmm0, dword [ecx]
movaps xmm1, xmmword [0x672fa0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ecx], xmm1
mov ecx, 0x10
movd xmm0, dword [edx]
movaps xmm1, xmmword [0x672fb0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [edx], xmm1
movd xmm0, dword [esi]
movaps xmm1, xmmword [0x672fc0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
nop dword [eax]
lea eax, [ecx + 0x3f]
xor byte [ecx + 0x681ed0], al
inc ecx
cmp ecx, 0x1a
jb 0x4915b0
mov byte [0x681eeb], 0
mov ecx, 0x681ed0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4915d0
sub ecx, edx
push 4
push 0x1000
lea eax, [ecx + 1]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov esi, eax
test esi, esi
jne 0x491603
mov edx, str.Memory_space_could_not_be_allocated___Error_code:
jmp 0x4913d1
mov edx, str.Memory_space_allocated...
call fcn.004981b0
push 0x498b90
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Memory_address_is:
call fcn.004981b0
push esi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
push 0x498b90
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov cl, byte [0x681eeb]
movups xmm3, xmmword [0x672f90]
movups xmm4, xmmword [0x672fa0]
movups xmm5, xmmword [0x672fb0]
movups xmm6, xmmword [0x672fc0]
movups xmm2, xmmword [0x673020]
test cl, cl
je 0x491739
mov eax, 0x681ed0
movaps xmm1, xmm3
mov ecx, 0x10
movd xmm0, dword [eax]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [eax], xmm1
mov eax, 0x681ed4
movaps xmm1, xmm4
movd xmm0, dword [eax]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [eax], xmm1
mov eax, 0x681ed8
movaps xmm1, xmm5
movd xmm0, dword [eax]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [eax], xmm1
mov eax, 0x681edc
movaps xmm1, xmm6
movd xmm0, dword [eax]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [eax], xmm1
lea eax, [ecx + 0x3f]
xor byte [ecx + 0x681ed0], al
inc ecx
cmp ecx, 0x1a
jb 0x491722
xor cl, cl
mov byte [0x681eeb], cl
mov edx, 0x681ed0
lea eax, [edx + 1]
mov dword [ebp - 0xc], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x491744
sub edx, dword [ebp - 0xc]
test cl, cl
je 0x491816
mov eax, 0x681ed0
mov ecx, 0x10
movd xmm0, dword [eax]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm2
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [eax], xmm3
mov eax, 0x681ed4
movd xmm0, dword [eax]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm4, xmm0
andps xmm4, xmm2
packuswb xmm4, xmm4
packuswb xmm4, xmm4
movd dword [eax], xmm4
mov eax, 0x681ed8
movd xmm0, dword [eax]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm5, xmm0
andps xmm5, xmm2
packuswb xmm5, xmm5
packuswb xmm5, xmm5
movd dword [eax], xmm5
mov eax, 0x681edc
movd xmm0, dword [eax]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm6, xmm0
andps xmm6, xmm2
packuswb xmm6, xmm6
packuswb xmm6, xmm6
movd dword [eax], xmm6
nop dword [eax + eax]
lea eax, [ecx + 0x3f]
xor byte [ecx + 0x681ed0], al
inc ecx
cmp ecx, 0x1a
jb 0x491800
mov byte [0x681eeb], 0
push 0
lea eax, [edx + 1]
push eax
push 0x681ed0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x49183d
mov edx, str.Memory_space_could_not_be_written_to___Error_code:
jmp 0x4913d1
mov edx, str.Memory_space_written_to...
call fcn.004981b0
push 0x498b90
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0
push 0
push esi
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x491878
mov edx, str.DLL_could_not_be_injected___Error_code:
jmp 0x4913cb
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push edi
call esi
jmp 0x4913f4