Function at 0x1000e6a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
lea esi, [edi + 8]
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov dword [0x10010ba4], ebx
push dword [esi]
mov dword [ebp - 8], eax
push 0x10012790
push str._s:_Trying_to_inject_new_process__u_n
call dword [fcn.10010bf8]
mov ecx, dword [esi]
add esp, 0xc
mov eax, ecx
mov dword [edi + 4], 0xffffffe0
not eax
shl eax, 5
push ecx
push dword [ebp - 8]
mov dword [edi], eax
call fcn.10009b50
test eax, eax
js 0x1000e9ed
mov ecx, dword [0x10010b90]
mov eax, dword [esi]
cmp eax, dword [ecx]
je 0x1000e714
call fcn.10006970
mov ecx, dword [0x10010b90]
push 1
push 0
push dword [esi]
call fcn.10005320
test eax, eax
js 0x1000e9ed
mov ecx, dword [0x10010b94]
call fcn.10004bb0
mov eax, dword [esi]
mov dword [0x10010bb0], eax
mov dword [0x10010bb4], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0x200
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x214], 0x200
mov dword [ebp - 0x42c], 4
test esi, esi
je 0x1000e792
mov eax, dword [esi]
mov dword [ebp - 0x420], eax
mov ecx, dword [0x10010b90]
lea eax, [ebp - 0x220]
push 0
push eax
lea eax, [ebp - 0x430]
push eax
push 1
push 8
call fcn.100081b0
test eax, eax
js 0x1000e951
mov eax, dword [ebp - 0x21c]
xor esi, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
cmp eax, 4
jae 0x1000e801
mov edx, dword [ebp - 0x218]
cmp edx, dword [ebp - 0x214]
jbe 0x1000e7ed
mov ecx, dword [ebp - 0x220]
call fcn.100088d0
xor edx, edx
mov dword [ebp - 0x218], edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ecx
jmp 0x1000e81e
mov ecx, dword [ebp - 0x220]
add eax, 0xfffffffc
mov dword [ebp - 0x21c], eax
mov ebx, dword [eax + ecx]
cmp eax, 4
jae 0x1000e847
mov edx, dword [ebp - 0x218]
cmp edx, dword [ebp - 0x214]
jbe 0x1000e833
call fcn.100088d0
xor edx, edx
mov dword [ebp - 0x218], edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], ecx
jmp 0x1000e861
add eax, 0xfffffffc
mov dword [ebp - 0x21c], eax
mov edx, dword [eax + ecx]
mov dword [ebp - 0xc], edx
cmp eax, 4
jae 0x1000e88a
mov edx, dword [ebp - 0x218]
cmp edx, dword [ebp - 0x214]
jbe 0x1000e876
call fcn.100088d0
xor edx, edx
mov dword [ebp - 0x218], edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], ecx
jmp 0x1000e8a7
add eax, 0xfffffffc
mov dword [ebp - 0x21c], eax
mov edi, dword [ecx + eax]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
cmp eax, 4
jae 0x1000e8d0
mov edx, dword [ebp - 0x218]
cmp edx, dword [ebp - 0x214]
jbe 0x1000e8bc
call fcn.100088d0
xor edx, edx
mov dword [ebp - 0x218], edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], ecx
jmp 0x1000e8e7
add eax, 0xfffffffc
mov dword [ebp - 0x21c], eax
mov esi, dword [ecx + eax]
cmp eax, 4
jae 0x1000e91b
mov edx, dword [ebp - 0x218]
cmp edx, dword [ebp - 0x214]
jbe 0x1000e8fe
call fcn.100088d0
mov dword [ebp - 0x218], 0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x220], eax
xor eax, eax
mov dword [ebp - 0x21c], 0
jmp 0x1000e927
add eax, 0xfffffffc
mov dword [ebp - 0x21c], eax
mov eax, dword [eax + ecx]
push 1
push 0
push esi
push edx
push dword [ebp - 4]
mov dword [edi], eax
mov dword [edi + 4], esi
mov ecx, dword [0x10010b94]
call fcn.10004910
call fcn.1000a450
test ebx, ebx
je 0x1000e951
mov eax, dword [ebp - 0x10]
mov dword [0x10010ba4], eax
mov edx, dword [ebp - 0x218]
cmp edx, dword [ebp - 0x214]
jbe 0x1000e974
mov ecx, dword [ebp - 0x220]
call fcn.100088d0
mov dword [ebp - 0x218], 0
mov esi, dword [ebp - 0x428]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], eax
cmp esi, dword [ebp - 0x424]
jbe 0x1000e9e9
mov eax, dword [ebp - 0x430]
test eax, eax
je 0x1000e9e9
add esi, 0xffff
mov dword [ebp + 8], eax
and esi, 0xffff0000
add esi, eax
cmp eax, esi
jae 0x1000e9e9
mov edi, dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
nop dword [eax]
push 0x8000
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
call edi
test eax, eax
jne 0x1000e9e9
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [ebp + 8], eax
cmp eax, esi
jb 0x1000e9c0
test ebx, ebx
jne 0x1000ea05
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x1000ea0b
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call esi
push 0x10012790
push str._s:_New_process_injection_succeeded_n
call dword [fcn.10010bf8]
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4