Function at 0x10015f20
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1006d04c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1006dbd0], 1
push ebx
push esi
push edi
mov esi, ecx
jne 0x10015f56
mov edx, str._HIJACKER_:_Openning_process...
mov ecx, 0x1006ed98
call fcn.1000d350
push eax
call fcn.1000d5f0
add esp, 4
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1006dbd0]
cmp eax, 1
jne 0x10015fc5
push esi
push ecx
mov edx, str._HIJACKER_:_HANDLE:
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008d70
push eax
call fcn.1000d5f0
add esp, 4
call edi
push eax
push ecx
mov edx, str._HIJACKER_:_Get_last_error_:
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008f10
push eax
call fcn.1000d5f0
mov eax, dword [0x1006dbd0]
add esp, 4
cmp esi, 0xffffffff
je 0x10016280
cmp eax, 1
jne 0x10015feb
mov edx, str._HIJACKER_:_Open_process_success___
mov ecx, 0x1006ed98
call fcn.1000d350
push eax
call fcn.1000d5f0
add esp, 4
push 4
push 0x3000
push 0x104
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x1001623b
cmp dword [0x1006dbd0], 1
jne 0x1001605a
mov edx, str._HIJACKER_:_Virtual_Allocation_success___
mov ecx, 0x1006ed98
call fcn.1000d350
push eax
call fcn.1000d5f0
add esp, 4
cmp dword [0x1006dbd0], 1
jne 0x1001605a
call edi
push eax
push ecx
mov edx, str._HIJACKER_:_Error_code_for_now:
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008f10
push eax
call fcn.1000d5f0
add esp, 4
mov ecx, 0x1006dac8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016062
sub ecx, edx
lea eax, [ebp - 8]
push eax
lea eax, [ecx + 1]
push eax
push 0x1006dac8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100161f6
cmp dword [0x1006dbd0], 1
jne 0x100160cf
push dword [ebp - 8]
mov edx, str._HIJACKER_:_Write_Process_memory_Success___Write_result:
push eax
push ecx
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10009250
push ecx
mov edx, str._Bytes_written:
mov ecx, eax
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008f10
push eax
call fcn.1000d5f0
add esp, 4
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100161b1
cmp dword [0x1006dbd0], 1
jne 0x10016168
push dword [ebp - 0xc]
mov edx, str._HIJACKER_:_Remote_thread_successfully_created___Write_result:_0x
push ebx
push ecx
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008d70
push ecx
mov edx, str._Bytes_written:
mov ecx, eax
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008f10
push eax
call fcn.1000d5f0
add esp, 4
cmp dword [0x1006dbd0], 1
jne 0x10016168
call edi
push eax
push ecx
mov edx, str._HIJACKER_:_Error_code_for_now:
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008f10
push eax
call fcn.1000d5f0
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov ecx, 0x1006dac8
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016180
sub ecx, edx
push 0x8000
lea eax, [ecx + 1]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push ebx
call edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002e0f2
mov esp, ebp
pop ebp
ret
cmp dword [0x1006dbd0], 1
jne 0x100161e0
call edi
push eax
push ecx
mov edx, str.__HIJACKER_:_Remote_thread_creation_failed__Error:
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008f10
push eax
call fcn.1000d5f0
add esp, 4
mov eax, 0xdf420
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002e0f2
mov esp, ebp
pop ebp
ret
cmp dword [0x1006dbd0], 1
jne 0x10016225
call edi
push eax
push ecx
mov edx, str.__HIJACKER_:_Write_process_memory_failed__Error:
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008f10
push eax
call fcn.1000d5f0
add esp, 4
mov eax, 0xff93
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002e0f2
mov esp, ebp
pop ebp
ret
cmp dword [0x1006dbd0], 1
jne 0x1001626a
call edi
push eax
push ecx
mov edx, str.__HIJACKER_:_Virtual_allocation_failed__error:
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008f10
push eax
call fcn.1000d5f0
add esp, 4
mov eax, 0x385f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002e0f2
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x100162ab
call edi
push eax
push ecx
mov edx, str.__HIJACKER_:_Open_process_failed..._Error:
mov ecx, 0x1006ed98
call fcn.1000d350
add esp, 4
mov ecx, eax
call fcn.10008f10
push eax
call fcn.1000d5f0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 0x47b
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002e0f2
mov esp, ebp
pop ebp
ret