Function at 0x402a20
Capabilities:
Create thread
Execute command
Inject thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409687
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x208
push 0
push ebx
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe0], 0x32
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov dword [ebp - 0xe8], edi
test edi, edi
jne 0x402ab0
push 0x8000
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004082d8
mov esp, ebp
pop ebp
ret
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402ab5
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx*2 + 2]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push edi
push dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xe4], eax
test eax, eax
jne 0x402b00
push 0x8000
push eax
push edi
jmp 0x402a8d
xor edi, edi
push 0x40a54c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 2
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 1
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, 0x40a550
call fcn.004069b0
test edi, edi
je 0x402bb5
mov esi, edi
nop
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, 0x40a598
call fcn.004069b0
sub esi, 1
jne 0x402ba0
cmp edi, 0x32
jae 0x402be5
mov esi, 0x32
sub esi, edi
nop dword [eax]
nop word [eax + eax]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, 0x40a4fc
call fcn.004069b0
sub esi, 1
jne 0x402bd0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea eax, [edi + edi]
push 0x406be0
push eax
mov edx, 0x40a5a0
call fcn.004069b0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
mov edx, 0x40a59c
mov ecx, eax
call fcn.004069b0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 2
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 3
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
push str.________________________________________
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 4
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
push str..___________________________________._.______._.
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 5
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
push 0x40a6a8
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 6
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
push str.__._____._______.___________________________________
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 7
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
push str.___________________________________________
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 8
call fcn.00402130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.00405fc0
push str._______.____________________________________
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 9
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
push str.______________________________________________________________
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xa
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405fc0
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00406c10
mov ecx, eax
call fcn.00406c30
inc edi
cmp edi, 0x32
jle 0x402b02
mov esi, dword [ebp - 0xe4]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00403130
push dword [ebp - 0xdc]
mov edx, str.C:Users_
lea ecx, [ebp - 0x120]
call fcn.00406cd0
mov edx, eax
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x108]
call fcn.00406e20
sub esp, 8
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc0]
push eax
call fcn.00405780
lea ecx, [ebp - 0x108]
call fcn.00405fc0
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0xf
call fcn.00405fc0
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x10
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xf
call fcn.00405fc0
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x11
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xf
call fcn.00405fc0
mov ecx, 2
call fcn.00402930
push str.The_DLL_has_been_injected_successfully_
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x12
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xf
call fcn.00405fc0
lea ecx, [ebp - 0xc0]
call fcn.00405750
push str.Injected_successfully_completed.
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x13
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xf
call fcn.00405fc0
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xd8]
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xf
call fcn.00405fc0
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x15
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xf
call fcn.00405fc0
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x16
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xf
call fcn.00405fc0
push 0x40a500
lea ecx, [ebp - 0xd8]
call fcn.00406020
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x17
call fcn.00402130
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xf
call fcn.00405fc0
mov ecx, 4
call fcn.00402930
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Injector_Exiting_now....
call fcn.004069b0
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], 3
push eax
lea ecx, [ebp - 0xf0]
call fcn.00406c10
mov ecx, eax
call fcn.00406e80
push 0x8000
push 0
push dword [ebp - 0xe8]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]