Function at 0x413ed0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4810c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f0
push ebx
push esi
push edi
push str.Begin_SR_FakeVEH_n
push 2
call fcn.00428a80
mov ebx, dword [ebp + 8]
add esp, 8
push 0x40
push 0x3000
push 0x100
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x413fd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push esi
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0xc
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push esi
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.VirtualAllocEx_failed:__08X_n
push 2
call fcn.00428a80
add esp, 0x18
mov eax, 0x10600001
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
lea edi, [esi + 0x24]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp + 0xc]
push str.VEH_will_be_called_with:_n
push 2
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0x8bec8b55
mov dword [ebp - 0xb0], 0xc985084d
mov dword [ebp - 0xac], 0x98b6d74
mov dword [ebp - 0xa8], 0x6774c985
mov dword [ebp - 0xa4], 0x13981
mov dword [ebp - 0xa0], 0x5f758000
mov word [ebp - 0x9c], 0xbb53
mov dword [ebp - 0x96], 0x75003b80
mov dword [ebp - 0x92], 0x103c653
mov dword [ebp - 0x8e], 0x187b83
mov dword [ebp - 0x8a], 0x6a0574
mov dword [ebp - 0x86], 0x8b1853ff
mov dword [ebp - 0x82], 0xa8b1c53
mov dword [ebp - 0x7e], 0x1374d139
mov dword [ebp - 0x7a], 0x74204b3b
mov dword [ebp - 0x76], 0xeb098b04
mov dword [ebp - 0x72], 0x8b018bf3
mov dword [ebp - 0x6e], 0x2890451
mov dword [ebp - 0x6a], 0x83045089
mov dword [ebp - 0x66], 0x7400187b
mov dword [ebp - 0x62], 0xff016a05
mov dword [ebp - 0x5e], 0x73ff1853
mov dword [ebp - 0x5a], 0x1053ff0c
mov dword [ebp - 0x56], 0x64044389
mov dword [ebp - 0x52], 0x18a1
mov dword [ebp - 0x4e], 0x34408b00
mov dword [ebp - 0x4a], 0xc6084389
mov dword [ebp - 0x46], 0xc8830203
mov dword [ebp - 0x42], 0x3eb5bff
mov dword [ebp - 0x3e], 0x5dc0315b
mov word [ebp - 0x3a], 0x4c2
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x9a], esi
mov dword [ebp - 0xc8], eax
call fcn.00428a80
push edi
push str.pRoutine___p_n
push 3
call fcn.00428a80
push esi
push str.pArg_______p_n
push 3
call fcn.00428a80
mov eax, dword [0x7ab4f8]
lea ecx, [ebp - 0x34]
add esp, 0x20
add eax, 4
xorps xmm0, xmm0
mov dword [ebp - 0x14], eax
movlpd qword [ebp - 0x34], xmm0
push 0
push 8
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x41423c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0xf0
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.ReadProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
add esp, 0x18
mov eax, 0x10600003
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1fc]
call fcn.00428a90
push ebx
lea ecx, [ebp - 0x1fc]
mov dword [ebp - 4], 0
call fcn.004291d0
test al, al
jne 0x414314
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push edi
mov dword [esi + 0x414], 0xfa
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
push str.Cant_initialize_ProcessInfo_class_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
add esp, 0x14
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10600005
jmp 0x414ff6
lea ecx, [ebp - 0x1fc]
call fcn.00428db0
mov edi, eax
test edi, edi
jne 0x4143d6
mov esi, dword [ebp + 0x1c]
push 0x208
push eax
lea edi, [esi + 4]
mov dword [esi], eax
push edi
mov dword [esi + 0x414], 0x106
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
push str.Failed_to_resolve_process_cookie_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
add esp, 0x14
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10600004
jmp 0x414ff6
push edi
push str.ProcessCookie___08X_n
push 2
call fcn.00428a80
add esp, 0xc
call fcn.00416670
cmp eax, 0x4a61
push 4
sbb eax, eax
and eax, 0xfffffff8
push 0x3000
add eax, 0x18
push eax
push 0
push ebx
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x4144bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x11e
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.VirtualAllocEx_failed:__08X_n
push 2
call fcn.00428a80
add esp, 0x18
mov esi, 0x10600001
jmp 0x414ff6
push str.Allocated_memory_for_VEH_entry:_n
push 2
call fcn.00428a80
push dword [ebp - 0x18]
push str.pNewEntry___p_n
push 3
call fcn.00428a80
mov ecx, edi
mov dword [ebp - 0xe4], 0
lea eax, [esi + 0x24]
add esp, 0x14
and ecx, 0x1f
xor edi, eax
xorps xmm0, xmm0
ror edi, cl
movlpd qword [ebp - 0xec], xmm0
call fcn.00416670
mov ecx, dword [ebp - 0x14]
cmp eax, 0x4a61
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], ecx
jb 0x414537
lea eax, [edx + 0x14]
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xe8], edi
jmp 0x414547
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0xec], edi
mov eax, dword [0x7ab4f0]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xf8]
push eax
push edx
push ebx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb8], edx
call edi
test eax, eax
jne 0x41461f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
mov dword [ebx + 0x414], 0x150
push 0x208
lea edi, [ebx + 4]
mov dword [ebx], eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.WriteProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
add esp, 0x18
jmp 0x414b4c
push str.Copied_fake_VEH_entry_into_target_process_n
push 2
call fcn.00428a80
add esp, 8
lea eax, [ebp - 0xd8]
push 0
push 0xa1
push eax
push esi
push ebx
call edi
test eax, eax
jne 0x41465c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
mov dword [ebx + 0x414], 0x15e
jmp 0x41458f
push str.Copied_shellcode_into_target_process_n
push 2
call fcn.00428a80
add esp, 8
lea ecx, [ebp - 0x1fc]
call fcn.00428d60
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x41473d
mov esi, dword [ebp + 0x1c]
push 0x208
push eax
lea edi, [esi + 4]
mov dword [esi], eax
push edi
mov dword [esi + 0x414], 0x16e
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
push str.Failed_to_get_PEB_pointer_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
mov esi, 0x10600006
jmp 0x414ff6
push 0xb0
lea eax, [ebp - 0x1c0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c0]
push 0
push 0xb0
push eax
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x41483b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x17b
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.ReadProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
mov esi, 0x10600003
jmp 0x414ff6
test byte [ebp - 0x198], 4
mov byte [ebp - 0xd], 0
jne 0x414893
push str.Updating_PEB::ProcessUsingVEH_flag_n
push 2
call fcn.00428a80
or dword [ebp - 0x198], 4
lea eax, [ebp - 0x198]
add esp, 8
push 0
push 4
push eax
mov eax, dword [ebp - 0x24]
add eax, 0x28
push eax
push ebx
call edi
test eax, eax
jne 0x41488f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
mov dword [ebx + 0x414], 0x18e
jmp 0x41458f
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 4
push 8
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x41496e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x19f
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.VirtualProtectEx_failed:__08X_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
add esp, 0x18
cmp byte [ebp - 0xd], 0
je 0x414b4c
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x414b30
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push ebx
call edi
test eax, eax
jne 0x414a3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x1b1
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.WriteProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
add esp, 0x18
push eax
push dword [ebp - 0x28]
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 8
push dword [ebp - 0x14]
push edi
call eax
jmp 0x414959
push 0
push 4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
push ebx
call edi
test eax, eax
jne 0x414b76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x1c5
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.WriteProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add esp, 0x18
push eax
push 4
push 8
push dword [ebp - 0x14]
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x34]
push 0
push 4
push eax
push dword [ebp - 0x14]
push edi
call esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
push 8
push dword [ebp - 0x14]
push edi
call ebx
cmp byte [ebp - 0xd], 0
je 0x414b4c
and dword [ebp - 0x198], 0xfffffffb
lea eax, [ebp - 0x198]
push 0
push 4
push eax
mov eax, dword [ebp - 0x24]
add eax, 0x28
push eax
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
mov esi, 0x10600002
jmp 0x414ff6
push str.VEH_handler_linked_to_LdrpVectorHandlerList_n
push 2
call fcn.00428a80
add esp, 8
lea eax, [ebp - 0x20]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0x120
push 1
push dword [0x7ab4f4]
push ebx
call eax
test eax, eax
jne 0x414cd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x1df
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.VirtualProtectEx_failed:__08X_n
push 2
call fcn.00428a80
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add esp, 0x18
push eax
push 4
push 8
push dword [ebp - 0x14]
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x14]
push 0
push 4
push eax
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
push edi
call esi
push 0
push 4
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x14]
push edi
call esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
push 8
push dword [ebp - 0x14]
push edi
call ebx
cmp byte [ebp - 0xd], 0
je 0x414caf
and dword [ebp - 0x198], 0xfffffffb
lea eax, [ebp - 0x198]
push 0
push 4
push eax
mov eax, dword [ebp - 0x24]
add eax, 0x28
push eax
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
mov esi, 0x10600007
jmp 0x414ff6
push str.Entering_wait_state_n
push 2
call fcn.00428a80
add esp, 8
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0xdc]
sbb edx, dword [ebp - 0x2c]
test edx, edx
ja 0x414da7
jb 0x414d60
cmp eax, edi
jae 0x414da7
nop word [eax + eax]
push 0xa
push dword [0x7ab4e8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x18
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0x110]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x414e65
cmp dword [ebp - 0x110], 2
jne 0x414d3e
push str.Shelldata_retrieved_n
push 2
call fcn.00428a80
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x18]
push ebx
call edi
cmp dword [ebp - 0x110], 2
je 0x414fc9
mov esi, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push edi
mov dword [esi + 0x414], 0x23a
call sub.VCRUNTIME140.dll_memset
push 0x208
lea ebx, [esi + 0x20c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
push str.Shell_timed_out_n
push 2
call fcn.00428a80
add esp, 0x14
mov esi, 0x10600008
jmp 0x414ff6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x1c]
push 0x208
push 0
lea edi, [ebx + 4]
mov dword [ebx], eax
push edi
mov dword [ebx + 0x414], 0x210
call sub.VCRUNTIME140.dll_memset
push 0x208
add ebx, 0x20c
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
add eax, 2
push eax
call esi
add eax, eax
push eax
push 0x5c
push str.E:Dworkinjector_srshope_externlGH_Injector_LibraryFakeVEH.cpp
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
add eax, 2
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.SR_FakeVEH
call esi
add eax, eax
push eax
push str.SR_FakeVEH
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [ebp - 0xe0]
add esp, 0xc
test ebx, ebx
jne 0x414f0a
push str.Interrupt__n
push 2
call fcn.00428a80
add esp, 8
jmp 0x414f1e
mov eax, dword [ebp + 0x1c]
push dword [eax]
push str.ReadProcessMemory_failed:__08X_n
push 2
call fcn.00428a80
add esp, 0xc
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
push 4
push 8
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x14]
push 0
push 4
push eax
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
push edi
call esi
push 0
push 4
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x14]
push edi
call esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
push 8
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp byte [ebp - 0xd], 0
je 0x414f8e
and dword [ebp - 0x198], 0xfffffffb
lea eax, [ebp - 0x198]
push 0
push 4
push eax
mov eax, dword [ebp - 0x24]
add eax, 0x28
push eax
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [ebp - 0x18]
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x1c]
push edi
call esi
test ebx, ebx
jne 0x414831
push dword [0x7ab4ec]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, 0x10000004
jmp 0x414ff6
push 0x8000
push 0
push esi
push ebx
call edi
push dword [ebp - 0x10c]
push str.pRoutine_returned:__08X_n
push 2
call fcn.00428a80
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov eax, dword [ebp - 0x10c]
xor esi, esi
mov dword [ecx], eax
lea ecx, [ebp - 0x1fc]
call fcn.00428c10
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret