Function at 0x1000ddc7
Capabilities:
Create thread

Disassembly:
push 0x2c
mov eax, 0x10012245
call fcn.10010b55
push ecx
mov edx, 0x1000dc1b
mov ecx, 0x4505f5
call fcn.1000ee3f
mov edx, 0x1000db74
mov ecx, 0x40db97
call fcn.1000ee3f
mov edx, 0x1000db5e
mov ecx, 0x416e98
call fcn.1000ee3f
mov edx, 0x1000db98
mov ecx, 0x415ce3
call fcn.1000ee3f
mov edx, 0x1000dbfd
mov ecx, 0x40d962
call fcn.1000ee3f
mov edx, 0x1000dbfd
mov ecx, 0x40d689
call fcn.1000ee3f
mov edx, 0x1000c96c
mov ecx, 0x447e52
call fcn.1000ee3f
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, eax
lea eax, [ebp - 0x20]
mov ebx, 0x59c1c0
push eax
push 4
push 4
push ebx
push edi
call esi
lea eax, [ebp - 0x2c]
mov dword [0x59c1c0], 0x1000c9bc
push eax
push dword [ebp - 0x20]
push 4
push ebx
push edi
call esi
push ecx
mov edx, 0x1000d031
mov ecx, 0x43a145
call fcn.1000ee3f
mov edx, 0x1000d043
mov ecx, 0x42da7c
call fcn.1000ee3f
mov edx, 0x1000d055
mov ecx, 0x42c010
call fcn.1000ee3f
mov edx, 0x1000cf73
mov ecx, 0x4bf8a4
call fcn.1000ee3f
pop ecx
xor ebx, ebx
mov ecx, 0x53a1c2
inc ebx
push ebx
push 0xd
pop esi
mov edx, esi
call fcn.1000eecd
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a202
call fcn.1000eecd
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a240
call fcn.1000eecd
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a280
call fcn.1000eecd
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a0ab
call fcn.1000eecd
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a0eb
call fcn.1000eecd
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a129
call fcn.1000eecd
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a169
call fcn.1000eecd
mov esi, 0x1000c957
mov ecx, 0x406d8e
mov edx, esi
call fcn.1000ee3f
mov edx, esi
mov ecx, 0x40722f
call fcn.1000ee3f
mov edx, esi
mov ecx, 0x4075b3
call fcn.1000ee3f
pop ecx
mov esi, 0x320
mov ecx, 0x414c9d
push 2
mov edx, esi
call fcn.1000eecd
pop ecx
push 2
mov edx, esi
mov ecx, 0x415311
call fcn.1000eecd
pop ecx
push 4
pop edi
push edi
call fcn.1000fa81
pop ecx
mov dword [ebp - 0x2c], eax
mov dword [eax], 0x1000c04e
xor ebx, ebx
lea ecx, [ebp - 0x34]
push ecx
push ebx
push eax
push 0x1000e620
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x38], eax
test eax, eax
je 0x1000e0ca
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x34], ebx
jne 0x1000dfbf
push ecx
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push dword [ebp - 0x34]
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
pop ecx
pop ecx
test eax, eax
je 0x1000dfd6
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], ebx
push eax
push edi
push edi
mov esi, 0x5975d4
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov dword [ebp - 0x14], 0x1000c5b6
call ebx
push edi
mov edi, dword [sym.imp.VCRUNTIME140.dll_memcpy]
lea eax, [ebp - 0x14]
push eax
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push 4
push esi
call ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1000c702
push eax
push 4
push 4
add esi, 0x2c
push esi
call ebx
push 4
lea eax, [ebp - 0x14]
push eax
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push 4
push esi
call ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1000c539
push eax
push 4
push 4
mov esi, 0x597578
push esi
call ebx
push 4
lea eax, [ebp - 0x14]
push eax
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push 4
push esi
call ebx
lea eax, [ebp - 0x28]
mov esi, 0x1000ccfa
push eax
push 0x80
push 4
mov eax, 0x44e846
sub esi, 0x44e84a
push eax
call ebx
push 4
lea eax, [ebp - 0x24]
push 0x44e846
push eax
call edi
mov eax, dword [ebp - 0x24]
add esp, 0xc
add eax, 0x44e84a
mov dword [0x100196c4], eax
mov ecx, 0x44e846
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x28]
mov dword [ecx], esi
push 5
push ecx
call ebx
cmp dword [ebp - 0x34], 0
je 0x1000e0d4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov dword [ebp - 0x34], ebx
push 6
jmp 0x1000dfb9
call fcn.10010b32
ret