Function at 0x10003160
Capabilities:
Create thread
Get system information on windows
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x10073f94]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
mov edi, edx
mov byte [esi], 0
push 0
push edi
mov dword [ebp - 0x50], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
nop word [eax + eax]
cmp eax, 0xffffffff
je 0x100033f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word ds:[ecx]
add ecx, 2
test ax, ax
jne 0x100031b5
sub ecx, edx
mov dword [ebp - 0x2c], 0
sar ecx, 1
xorps xmm0, xmm0
movups xmmword [ebp - 0x4c], xmm0
movups xmmword [ebp - 0x3c], xmm0
lea eax, [ecx*2 + 2]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x100033ee
cmp dword ds:[ebp - 0x30], 0
je 0x100033ee
push 4
push 0x3000
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x100033f1
push dword [ebp - 0x48]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push dword [ebp - 8]
push dword [ebp - 0x50]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, 1
jne 0x100033cc
mov eax, dword ds:[ebp - 8]
cmp dword [ebp - 0xc], eax
jne 0x100033cc
push dword [ebp - 0x48]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 2
push dword [ebp - 0x48]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x100033cc
cmp dword [ebp - 8], 4
jne 0x100033cc
push dword [ebp - 0x48]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp eax, 1
jne 0x100033cc
push str.LoadLibraryW
push str.kernel32.dll
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push edi
push eax
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x100033cc
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword ds:[ebp - 0x48]
mov dword [ebp - 0x54], eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x10003316
mov byte [esi], 1
cmp dword ds:[ebp - 0x54], 0xffffffff
je 0x100033c9
cmp byte [esi], 1
je 0x100033c9
push 0x1c
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
xorps xmm0, xmm0
push edi
push ebx
movups xmmword [ebp - 0x24], xmm0
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
jne 0x1000339a
cmp dword [ebp - 0x28], edi
je 0x1000335d
mov byte [esi], 1
nop dword [eax]
cmp dword [ebp - 0x24], edi
je 0x10003368
mov byte [esi], 1
cmp dword [ebp - 0x20], 4
je 0x10003371
mov byte [esi], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x48]
je 0x1000337c
mov byte [esi], 1
cmp dword [ebp - 0x18], 0x1000
je 0x10003388
mov byte [esi], 1
cmp dword [ebp - 0x14], 2
je 0x10003391
mov byte [esi], 1
cmp dword [ebp - 0x10], 0x20000
je 0x1000339d
mov byte [esi], 1
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
je 0x100033ee
cmp byte ds:[esi], 1
pop edi
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d566
mov esp, ebp
pop ebp
ret
mov byte [esi], 1
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d566
mov esp, ebp
pop ebp
ret
mov byte [esi], 1
mov ecx, dword ds:[ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002d566
mov esp, ebp
pop ebp
ret