Function at 0x408770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439e0d
mov eax, dword fs:[0]
push eax
mov eax, 0x1540
mov dword fs:[0], esp
call fcn.00439c80
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
mov edi, edx
mov dword [ebp - 0x20], ebx
cmp dword [ebx + 0x620], eax
lea ecx, [ebp - 0x68]
mov edx, dword [ebx + 0x618]
sete al
mov dword [ebp - 0x18], edi
lea eax, [eax*2 + 0x438]
push eax
call fcn.00403270
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x64]
jne 0x408928
push 0x208
lea ebx, [edi + 4]
mov dword [edi], 0
push 0
push ebx
mov dword [edi + 0x414], 0x204
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [edi + 0x20c]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.HijackHandle
call edi
mov esi, dword [ebp - 0x18]
add eax, eax
push eax
push str.HijackHandle
lea eax, [esi + 0x20c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea edi, [ebp - 0x4c0]
mov ecx, 0x106
rep movsd dword es:[edi], dword [esi]
push dword [0x459e38]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp - 0x20]
cmp byte [ecx + 0x634], 0
je 0x40891e
lea eax, [ecx + 0x410]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], eax
mov eax, dword [ecx + 0x618]
mov dword [ebp - 0x94], eax
mov eax, dword [ecx + 0x61c]
mov dword [ebp - 0x90], eax
mov eax, dword [ecx + 0x620]
mov dword [ebp - 0x8c], eax
mov eax, dword [ecx + 0x624]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x80], eax
mov eax, dword [ecx + 0x62c]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x84], 0x21
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x6c], eax
call fcn.00422740
mov esi, 0x21
jmp 0x409288
push 0x638
lea eax, [ebp - 0xaf8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebx + 0x628]
lea ecx, [ebp - 0xaf8]
add esp, 0xc
mov dword [ebp - 0x4d0], eax
mov al, byte [ebx + 0x634]
mov esi, 0x4551dc
cmp dword [0x4551f0], 8
mov edx, 0x208
mov byte [ebp - 0x4c4], al
mov eax, ecx
cmovae esi, dword [0x4551dc]
mov dword [ebp - 0x4dc], 1
sub esi, eax
mov dword [ebp - 0x4d8], 0
nop dword [eax]
lea eax, [edx + 0x7ffffdf6]
test eax, eax
je 0x4089ae
movzx eax, word [esi + ecx]
test ax, ax
je 0x4089ae
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x408990
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
test edx, edx
mov word [eax], cx
mov eax, 0x8007007a
cmovne eax, ecx
jne 0x408a73
mov dword [edi + 0x414], 0x214
push 0x208
lea ebx, [edi + 4]
mov dword [edi], eax
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [edi + 0x20c]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call edi
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call esi
add esp, 8
add eax, 2
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.HijackHandle
call edi
mov esi, dword [ebp - 0x18]
add eax, eax
push eax
push str.HijackHandle
lea eax, [esi + 0x20c]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 0x20]
sub esp, 0x40c
mov edi, esp
mov ecx, 0x106
rep movsd dword es:[edi], dword [esi]
push 4
mov ecx, edx
jmp 0x409279
push str.GH_Injector___x86.dll
lea ecx, [ebp - 0xaf8]
call fcn.004094f0
test eax, eax
jns 0x408a96
mov dword [edi + 0x414], 0x21e
jmp 0x4089d5
mov ecx, dword [ebx + 0x624]
mov eax, ecx
mov dword [ebp - 0x44], ecx
test cl, 0x20
je 0x408aaf
xor eax, 0x20
mov dword [ebx + 0x624], eax
test al, 0x10
je 0x408abc
xor eax, 0x10
mov dword [ebx + 0x624], eax
mov esi, dword [ebp - 0x68]
xor eax, eax
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x5c], edx
cmp esi, edx
je 0x40925d
push dword [esi]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x408b89
mov dword [ebp - 0x1c], 7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x414], 0x238
push 0x208
lea esi, [edi + 4]
mov dword [edi], eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add edi, 0x20c
push 0x208
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
add eax, 2
push eax
call ebx
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
add eax, 2
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.HijackHandle
call ebx
add eax, eax
push eax
push str.HijackHandle
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x40923f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4091a2
lea eax, [ebp - 0x48]
mov dword [ebp - 0x3c], 0
push eax
push 4
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x48], 0
push eax
push 0x14
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3c], 0
je 0x4091a2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x14], 0
jne 0x4091a2
push dword [0x459e38]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi]
mov dword [ebp - 0x4e0], eax
lea eax, [ebp - 0xaf8]
push eax
call sym.GH_Injector___x86.exe_InjectW
push dword [0x459e38]
mov esi, eax
mov dword [ebp - 0x38], esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
test esi, esi
jne 0x40918d
mov esi, dword [ebp - 0x4c8]
mov dword [ebp - 0x28], esi
test esi, esi
je 0x40918a
push 0x40
push 0x3000
push 0x638
mov eax, sym.GH_Injector___x86.exe_InjectW
sub eax, dword [0x459944]
push 0
add eax, esi
push ebx
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, eax
mov dword [ebp - 0x14], edx
test edx, edx
jne 0x408d87
mov dword [ebp - 0x1c], 0x24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
lea esi, [edi + 4]
mov dword [edi], eax
push 0
push esi
mov dword [edi + 0x414], 0x269
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add edi, 0x20c
push 0x208
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
add eax, 2
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.HijackHandle
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push str.HijackHandle
push edi
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x4c0]
add esp, 0xc
mov dword [ebp - 0x24], 0
mov edx, esi
mov ecx, ebx
sub edx, dword [0x459944]
add edx, sym.GH_Injector___x86.exe_InterruptDownloadEx
push eax
push 0xc8
lea eax, [ebp - 0x24]
push eax
push 0
push 0
call fcn.0041bd60
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push esi
push str.hModule___p_n
push 4
call fcn.0040e7c0
mov edx, dword [0x459940]
lea eax, [ebp - 0xf10]
add esp, 0xc
mov dword [ebp - 0x4c], 0
mov ecx, ebx
push eax
push 0xc8
lea eax, [ebp - 0x4c]
push eax
push 0
push esi
call fcn.0041bd60
add esp, 0x14
jmp 0x409238
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
push 0
push 0x638
push ecx
movzx eax, word [eax + 4]
push edx
push ebx
mov dword [ecx + 0x62c], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x408ed4
mov dword [ebp - 0x1c], 0x25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
lea esi, [edi + 4]
mov dword [edi], eax
push 0
push esi
mov dword [edi + 0x414], 0x278
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add edi, 0x20c
push 0x208
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
add eax, 2
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.HijackHandle
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push str.HijackHandle
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x8000
push 0
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0xf10]
push eax
push 0xc8
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
mov edx, esi
mov ecx, ebx
sub edx, dword [0x459944]
push 0
add edx, sym.GH_Injector___x86.exe_InterruptDownloadEx
push 0
call fcn.0041bd60
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push esi
push str.hModule___p_n
push 4
call fcn.0040e7c0
mov edx, dword [0x459940]
lea eax, [ebp - 0x4c0]
add esp, 0xc
mov dword [ebp - 0x50], 0
mov ecx, ebx
push eax
push 0xc8
lea eax, [ebp - 0x50]
push eax
push 0
push esi
call fcn.0041bd60
add esp, 0x14
jmp 0x409238
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0xd], 0
mov dword [eax + 0x62c], 0
mov eax, esi
sub eax, dword [0x459944]
add eax, sym.GH_Injector___x86.exe_g_LibraryState
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x28]
sbb edx, dword [ebp - 0x24]
test edx, edx
ja 0x408fa4
jb 0x408f22
cmp eax, 0xfa
jae 0x408fa4
push 0
push 1
lea eax, [ebp - 0xd]
push eax
push dword [ebp - 0x34]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x408fa4
cmp byte [ebp - 0xd], 0
jne 0x40903f
push 0xa
push dword [0x459958]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x408f6b
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x28]
sbb edx, dword [ebp - 0x24]
jne 0x408fa4
cmp eax, 0xfa
jb 0x408f22
jmp 0x408fa4
push dword [0x459954]
mov dword [ebp - 0x1c], 0x45
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x8000
push 0
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 1
mov edx, esi
mov ecx, ebx
call fcn.00401d70
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xd], 0
jne 0x40903f
push 0x8000
push 0
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
lea eax, [ebp - 0xf10]
mov dword [ebp - 0x34], 0
push eax
push 0xc8
lea eax, [ebp - 0x34]
mov edx, esi
sub edx, dword [0x459944]
mov ecx, ebx
push eax
push 0
add edx, sym.GH_Injector___x86.exe_InterruptDownloadEx
push 0
call fcn.0041bd60
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push esi
push str.hModule___p_n
push 4
call fcn.0040e7c0
mov edx, dword [0x459940]
lea eax, [ebp - 0x4c0]
add esp, 0xc
mov dword [ebp - 0x54], 0
mov ecx, ebx
push eax
push 0xc8
lea eax, [ebp - 0x54]
push eax
push 0
push esi
call fcn.0041bd60
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409242
mov eax, dword [ebp - 0x20]
mov ecx, ebx
mov edx, dword [ebp - 0x38]
push edi
mov dword [ebp - 0x40], 0
push dword [eax + 0x628]
lea eax, [ebp - 0x40]
push eax
push 0
push dword [ebp - 0x14]
call fcn.0041bd60
add esp, 0x14
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1548]
push 0x638
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1548]
push 0
push 0x638
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10100009
je 0x4090f8
cmp eax, 0x10000004
jne 0x4090c0
push dword [0x459958]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x459954]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0xf10]
mov dword [ebp - 0x2c], 0
push eax
push 0xc8
lea eax, [ebp - 0x2c]
mov edx, esi
sub edx, dword [0x459944]
mov ecx, ebx
push eax
push 0
push 0
push 0xc8
add edx, sym.GH_Injector___x86.exe_InterruptInjectionEx
call fcn.0041ef40
add esp, 0x18
push 0x8000
push 0
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push esi
push str.hModule___p_n
push 4
call fcn.0040e7c0
mov edx, dword [0x459940]
lea eax, [ebp - 0xf10]
add esp, 0xc
mov dword [ebp - 0x58], 0
mov ecx, ebx
push eax
push 0xc8
lea eax, [ebp - 0x58]
push eax
push 0
push esi
call fcn.0041bd60
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x409242
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x409174
mov ecx, dword [ebp - 0xf18]
test ecx, ecx
jne 0x4092a3
mov dword [ebp - 0x1c], 0x27
mov dword [edi + 0x414], 0x2eb
jmp 0x408b05
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x1c], 0x23
mov dword [edi], esi
mov dword [edi + 0x414], 0x257
jmp 0x4091b9
mov dword [ebp - 0x1c], 0x22
mov dword [edi], 0
mov dword [edi + 0x414], 0x244
push 0x208
push 0
lea esi, [edi + 4]
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add edi, 0x20c
push 0x208
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push 0x5c
push str.D:Univsersity_Study_ProjectsESP_tiatnHack_InjectorGH_Injector_LibraryInjection.cpp
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
add eax, 2
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push str.HijackHandle
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push str.HijackHandle
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
add esi, 0xc
mov dword [ebp - 0x30], esi
cmp esi, dword [ebp - 0x5c]
jne 0x408ad5
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x44]
mov dword [ebx + 0x624], ecx
sub esp, 0x418
mov esi, edi
mov ecx, 0x106
mov edi, esp
mov edx, ebx
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, ebx
push 1
call fcn.004071b0
add esp, 0x420
mov esi, eax
lea ecx, [ebp - 0x68]
call fcn.00403420
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push str.Hijack_injection_succeeded_nImagebase___p_n
push 1
call fcn.0040e7c0
mov ebx, dword [ebp - 0x20]
add esp, 0xc
mov eax, dword [ebp - 0xf18]
mov dword [ebx + 0x630], eax
xor eax, eax
jmp 0x40925a