Function at 0x10005e98
Capabilities:
Check if file exists
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006b91
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x118], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp + 0xc]
call fcn.10004110
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10006169
cmp dword [ebp + 8], 0
je 0x10006131
lea ecx, [ebp + 0xc]
call fcn.10006220
lea eax, [eax + eax + 2]
mov dword [ebp - 0x14], eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x100060f9
lea ecx, [ebp + 0xc]
call fcn.10004110
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100060c1
push str.LoadLibraryA
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x10006089
push 0
push 0
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x124]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10006051
push 0x4e20
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x102
je 0x1000600f
mov dword [ebp - 0x11c], 0
jmp 0x10006045
mov eax, 1
test eax, eax
je 0x10006024
mov dword [ebp - 0x130], 0
jmp 0x1000603b
mov ecx, dword [ebp + 0xc]
push ecx
push 0x10009dec
call fcn.10002470
add esp, 8
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x11c], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10006087
mov eax, 1
test eax, eax
je 0x10006066
mov dword [ebp - 0x134], 0
jmp 0x1000607d
mov ecx, dword [ebp + 0xc]
push ecx
push 0x10009e0c
call fcn.10002470
add esp, 8
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x11c], 6
jmp 0x100060bf
mov edx, 1
test edx, edx
je 0x1000609e
mov dword [ebp - 0x138], 0
jmp 0x100060b5
mov eax, dword [ebp + 0xc]
push eax
push 0x10009e30
call fcn.10002470
add esp, 8
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x11c], 5
jmp 0x100060f7
mov ecx, 1
test ecx, ecx
je 0x100060d6
mov dword [ebp - 0x13c], 0
jmp 0x100060ed
mov edx, dword [ebp + 0xc]
push edx
push 0x10009e5c
call fcn.10002470
add esp, 8
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x11c], 4
jmp 0x1000612f
mov eax, 1
test eax, eax
je 0x1000610e
mov dword [ebp - 0x140], 0
jmp 0x10006125
mov ecx, dword [ebp + 0xc]
push ecx
push 0x10009e88
call fcn.10002470
add esp, 8
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x11c], 3
jmp 0x10006167
mov edx, 1
test edx, edx
je 0x10006146
mov dword [ebp - 0x144], 0
jmp 0x1000615d
mov eax, dword [ebp + 0xc]
push eax
push 0x10009eac
call fcn.10002470
add esp, 8
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x11c], 2
jmp 0x1000619f
mov ecx, 1
test ecx, ecx
je 0x1000617e
mov dword [ebp - 0x148], 0
jmp 0x10006195
mov edx, dword [ebp + 0xc]
push edx
push str.__s_DLL
call fcn.10002470
add esp, 8
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x11c], 1
cmp dword [ebp - 0x120], 0
je 0x100061c2
push 0x4000
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x120]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.1000640a
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret