Function at 0x10002d60
Capabilities:
Create thread
Get system information on windows
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x10072dc4]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
mov edi, edx
mov byte [esi], 0
push 0
push edi
mov dword [ebp - 0x50], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
nop word [eax + eax]
cmp eax, 0xffffffff
je 0x10002ff1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word ds:[ecx]
add ecx, 2
test ax, ax
jne 0x10002db5
sub ecx, edx
mov dword [ebp - 0x2c], 0
sar ecx, 1
xorps xmm0, xmm0
movups xmmword [ebp - 0x4c], xmm0
movups xmmword [ebp - 0x3c], xmm0
lea eax, [ecx*2 + 2]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10002fee
cmp dword ds:[ebp - 0x30], 0
je 0x10002fee
push 4
push 0x3000
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x10002ff1
push dword [ebp - 0x48]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push dword [ebp - 8]
push dword [ebp - 0x50]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, 1
jne 0x10002fcc
mov eax, dword ds:[ebp - 8]
cmp dword [ebp - 0xc], eax
jne 0x10002fcc
push dword [ebp - 0x48]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 2
push dword [ebp - 0x48]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x10002fcc
cmp dword [ebp - 8], 4
jne 0x10002fcc
push dword [ebp - 0x48]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp eax, 1
jne 0x10002fcc
push str.LoadLibraryW
push str.kernel32.dll
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push edi
push eax
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x10002fcc
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword ds:[ebp - 0x48]
mov dword [ebp - 0x54], eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x10002f16
mov byte [esi], 1
cmp dword ds:[ebp - 0x54], 0xffffffff
je 0x10002fc9
cmp byte [esi], 1
je 0x10002fc9
push 0x1c
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
xorps xmm0, xmm0
push edi
push ebx
movups xmmword [ebp - 0x24], xmm0
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
jne 0x10002f9a
cmp dword [ebp - 0x28], edi
je 0x10002f5d
mov byte [esi], 1
nop dword [eax]
cmp dword [ebp - 0x24], edi
je 0x10002f68
mov byte [esi], 1
cmp dword [ebp - 0x20], 4
je 0x10002f71
mov byte [esi], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x48]
je 0x10002f7c
mov byte [esi], 1
cmp dword [ebp - 0x18], 0x1000
je 0x10002f88
mov byte [esi], 1
cmp dword [ebp - 0x14], 2
je 0x10002f91
mov byte [esi], 1
cmp dword [ebp - 0x10], 0x20000
je 0x10002f9d
mov byte [esi], 1
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
je 0x10002fee
cmp byte ds:[esi], 1
pop edi
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bc62
mov esp, ebp
pop ebp
ret
mov byte [esi], 1
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bc62
mov esp, ebp
pop ebp
ret
mov byte [esi], 1
mov ecx, dword ds:[ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002bc62
mov esp, ebp
pop ebp
ret