Function at 0x1001eaf0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f673
mov eax, dword fs:[0]
push eax
sub esp, 0xbd4
mov eax, dword [0x1007a274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x10062d30
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb2c], eax
push str.LoadLibraryW_
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb6c], eax
push str.LoadLibraryExA
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb74], eax
push 0x10062d70
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb7c], eax
push 0x10062d80
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb98], eax
push 0x10062d8c
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xba0], eax
push str.CreateRemoteThread
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb30], eax
push str.DbgUiRemoteBreakin
push 0x10062dc0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xba8], eax
push str.LdrLoadDll
push 0x10062dc0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xbb0], eax
push str.LdrUnloadDll
push 0x10062dc0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xafc], eax
push 0x10062de8
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb04], eax
push str.VirtualQueryEx
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xbd8], eax
push 0x10062e08
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb0c], eax
push 0x10062e24
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb14], eax
push str.VirtualAllocEx
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb1c], eax
push str.DebugBreak
push 0x10062d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xae0], 0
mov dword [ebp - 0xae4], 0
mov dword [ebp - 0xae8], 0
mov dword [ebp - 0x9ac], 0x11c
mov dword [ebp - 0x9a8], 0
mov dword [ebp - 0x9a4], 0
mov dword [ebp - 0x9a0], 0
mov dword [ebp - 0x99c], 0
push 0x100
push 0
lea eax, [ebp - 0x998]
push eax
call fcn.10040850
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x898], cx
xor edx, edx
mov word [ebp - 0x896], dx
xor eax, eax
mov dword [ebp - 0x894], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0xb84], eax
mov dword [ebp - 0xb80], edx
mov ecx, 6
movzx edx, cx
mov dword [ebp - 0x9a8], edx
xor eax, eax
movzx ecx, ax
mov dword [ebp - 0x9a4], ecx
xor edx, edx
mov word [ebp - 0x898], dx
mov eax, dword [ebp - 0xb80]
push eax
mov ecx, dword [ebp - 0xb84]
push ecx
push 0x23
lea edx, [ebp - 0x9ac]
push edx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1001edf6
mov dword [ebp - 0xad8], 1
jmp 0x1001ee00
mov dword [ebp - 0xad8], 0
movzx eax, byte [ebp - 0xad8]
test eax, eax
je 0x1001ee62
push str.RtlUserThreadStart
push 0x10062dc0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xae0], eax
push str.NtCreateThread
push 0x10062dc0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xae4], eax
push str.NtCreateThreadEx
push 0x10062dc0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xae8], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xb4c], ecx
xor edx, edx
mov dword [ebp - 0xaf4], edx
mov dword [ebp - 0xaf0], edx
mov dword [ebp - 0xaec], edx
push 0xc
lea eax, [ebp - 0xaf4]
push eax
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0xffffffffffffffff
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0xaf4]
mov dword [ebp - 0xb24], ecx
mov edx, dword [ebp - 0xaf4]
add edx, dword [ebp - 0xaf0]
mov dword [ebp - 0xb28], edx
xor eax, eax
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xbb4], eax
push 0x1c
lea ecx, [ebp - 0xbcc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x800
push 0
lea eax, [ebp - 0x878]
push eax
call fcn.10040850
add esp, 0xc
push 0x800
lea ecx, [ebp - 0x878]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0xffffffffffffffff
call sub.KERNEL32.dll_K32GetMappedFileNameA
clc
jae 0x1001ef2a
invalid
pushf
push 0xa