Function at 0x402620
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push 0xffffffffffffffff
push 0x4281ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
mov eax, dword [0x436250]
push ebx
push esi
push edi
mov dword [esp + 0x134], eax
mov eax, dword [esp + 0x148]
push eax
xor esi, esi
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
call fcn.00401b90
mov ecx, eax
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], esi
mov byte [esp + 0x1c], 0
lea ebx, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x402680
sub ecx, ebx
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004019c0
cmp dword [esp + 0x2c], esi
mov dword [esp + 0x140], esi
jne 0x4026d7
cmp dword [0x437180], esi
jne 0x4026bc
push 0x10
push str.Warning
push str.Invalid_iSpeak_path___
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x30], 0x10
jb 0x4026d0
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0041c075
add esp, 4
xor eax, eax
jmp 0x40287c
mov al, byte [esp + 0x14c]
push ebp
xor ebp, ebp
test al, al
je 0x402719
mov edx, dword [esp + 0x14c]
push edx
lea eax, [esp + 0x3c]
push str.isig.HOOKDLL._u.event
push eax
call fcn.0040eb23
add esp, 0xc
lea ecx, [esp + 0x38]
push ecx
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0xe
mov ebp, eax
push str.isDetector.dll
jmp 0x402720
push 0xc
push str.isigGPGL.dll
lea ecx, [esp + 0x24]
call fcn.004018b0
mov ebx, dword [esp + 0x30]
push 4
push 0x1000
inc ebx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x40276a
test ebp, ebp
je 0x40274f
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x34], 0x10
jb 0x402763
mov edx, dword [esp + 0x20]
push edx
call fcn.0041c075
add esp, 4
xor eax, eax
jmp 0x40287b
cmp dword [esp + 0x34], 0x10
mov eax, dword [esp + 0x20]
jae 0x402779
lea eax, [esp + 0x20]
push 0
push ebx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4027bd
push 0x4000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test ebp, ebp
je 0x4027a2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x34], 0x10
jb 0x402763
mov eax, dword [esp + 0x20]
push eax
call fcn.0041c075
add esp, 4
xor eax, eax
jmp 0x40287b
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x4027f5
push 0x4000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test ebp, ebp
je 0x4027e5
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
call fcn.004013a0
xor eax, eax
jmp 0x40287b
push 0x429758
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4027cc
push 0
push 0
push esi
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
mov dword [esp + 0x10], eax
je 0x40284f
test ebp, ebp
push 0xffffffffffffffff
je 0x40283d
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x402844
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
test ebp, ebp
je 0x40286d
push ebp
call esi
lea ecx, [esp + 0x1c]
call fcn.004013a0
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x138]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x12c]
pop ebx
call fcn.0040e99e
add esp, 0x138
ret