Function at 0x408e20
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
push ebx
push esi
push str._PROCESS_HOLLOWING__n
call fcn.0051d75e
add esp, 4
test edi, edi
je 0x409166
push edi
push str.___PE_file_content_:_0x_p_n
call fcn.0051d75e
mov eax, dword [edi + 0x3c]
add esp, 8
cmp dword [edi + eax], 0x4550
je 0x408e80
push str.____The_PE_file_is_not_valid___n
call fcn.0051d75e
add esp, 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___The_PE_file_is_valid._n
call fcn.0051d75e
add esp, 4
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.0051f750
mov ecx, dword [ebp + 8]
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 4
push 1
push 0
push 0
push 0
push ecx
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408eff
push str.____An_error_is_occured_when_trying_to_create_the_target_process___n
call fcn.0051d75e
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.00408720
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0xc], 0
je 0x409159
lea esi, [esp + 0x10]
call fcn.004085b0
mov esi, edx
test esi, esi
je 0x40914f
test eax, eax
je 0x40914f
push eax
push str.___Target_Process_PEB_:_0x_p_n
call fcn.0051d75e
push esi
push str.___Target_Process_Image_Base_:_0x_p_n
call fcn.0051d75e
mov ecx, dword [edi + 0x3c]
mov edx, 0x10b
add esp, 0x10
cmp word [ecx + edi + 0x18], dx
jne 0x408f69
mov ebx, 1
push str.___Source_PE_Image_architecture_:_x86_n
jmp 0x408f70
xor ebx, ebx
push str.___Source_PE_Image_architecture_:_x64_n
call fcn.0051d75e
add esp, 4
cmp dword [esp + 0xc], 0
je 0x408f86
push str.___Target_PE_Image_architecture_:_x86_n
jmp 0x408f8b
push str.___Target_PE_Image_architecture_:_x64_n
call fcn.0051d75e
add esp, 4
test ebx, ebx
je 0x408fb4
cmp dword [esp + 0xc], 0
jne 0x408fbb
push str.____Architecture_are_not_compatible___n
call fcn.0051d75e
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], 0
jne 0x408f9e
push str.___Architecture_are_compatible___n
call fcn.0051d75e
add esp, 4
test ebx, ebx
je 0x409139
mov eax, dword [edi + 0x3c]
movzx ebx, word [eax + edi + 0x5c]
cmp ebx, 0xffffffff
jne 0x408fe7
push str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_source_image._n
jmp 0x408ee3
push ebx
push str.___Source_Image_subsystem_:_0x_X_n
call fcn.0051d75e
add esp, 8
cmp dword [esp + 0xc], 0
je 0x409123
mov ecx, esi
mov esi, dword [esp + 0x10]
call fcn.00408650
mov esi, eax
cmp esi, 0xffffffff
jne 0x40901c
push str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
jmp 0x408ee3
push esi
push str.___Target_Process_subsystem_:_0x_X_n
call fcn.0051d75e
add esp, 8
cmp ebx, esi
jne 0x409119
push str.___Subsytems_are_compatible._n
call fcn.0051d75e
mov ecx, dword [edi + 0x3c]
add esp, 4
cmp dword [ecx + edi + 0xa0], 0
jne 0x40908a
push str.___The_source_image_doesnt_have_a_relocation_table._n
call fcn.0051d75e
add esp, 4
push edi
lea ecx, [esp + 0x14]
call fcn.004087a0
add esp, 4
test eax, eax
je 0x4090ca
push 0x57fa0c
call fcn.0051d75e
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.00408760
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___The_source_image_has_a_relocation_table._n
call fcn.0051d75e
lea edx, [esp + 0x14]
add esp, 4
push edx
mov ecx, edi
call fcn.00408a10
add esp, 4
test eax, eax
je 0x4090ca
push str.___The_injection_has_succeed___n
call fcn.0051d75e
add esp, 4
mov eax, edi
lea esi, [esp + 0x10]
call fcn.00408760
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____The_injection_has_failed___n
call fcn.0051d75e
add esp, 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4090f8
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409166
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x10]
push eax
call esi
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____Subsytems_are_not_compatible._n
jmp 0x408ee3
push str.____Target_PE_Image_architecture_not_x86_n
call fcn.0051d75e
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.___Source_PE_Image_architecture_not_x86_n
call fcn.0051d75e
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x57f910
jmp 0x408ee3
push str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
call fcn.0051d75e
add esp, 4
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret