Function at 0x1000d856
Capabilities:
Create thread

Disassembly:
push 0x2c
mov eax, 0x10011bdb
call fcn.100105e5
push ecx
mov edx, 0x1000d6aa
mov ecx, 0x4505f5
call fcn.1000e8ce
mov edx, 0x1000d603
mov ecx, 0x40db97
call fcn.1000e8ce
mov edx, 0x1000d5ed
mov ecx, 0x416e98
call fcn.1000e8ce
mov edx, 0x1000d627
mov ecx, 0x415ce3
call fcn.1000e8ce
mov edx, 0x1000d68c
mov ecx, 0x40d962
call fcn.1000e8ce
mov edx, 0x1000d68c
mov ecx, 0x40d689
call fcn.1000e8ce
mov edx, 0x1000c3fb
mov ecx, 0x447e52
call fcn.1000e8ce
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, eax
lea eax, [ebp - 0x20]
mov ebx, 0x59c1c0
push eax
push 4
push 4
push ebx
push edi
call esi
lea eax, [ebp - 0x2c]
mov dword [0x59c1c0], 0x1000c44b
push eax
push dword [ebp - 0x20]
push 4
push ebx
push edi
call esi
push ecx
mov edx, 0x1000cac0
mov ecx, 0x43a145
call fcn.1000e8ce
mov edx, 0x1000cad2
mov ecx, 0x42da7c
call fcn.1000e8ce
mov edx, 0x1000cae4
mov ecx, 0x42c010
call fcn.1000e8ce
mov edx, 0x1000ca02
mov ecx, 0x4bf8a4
call fcn.1000e8ce
pop ecx
xor ebx, ebx
mov ecx, 0x53a1c2
inc ebx
push ebx
push 0xd
pop esi
mov edx, esi
call fcn.1000e95c
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a202
call fcn.1000e95c
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a240
call fcn.1000e95c
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a280
call fcn.1000e95c
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a0ab
call fcn.1000e95c
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a0eb
call fcn.1000e95c
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a129
call fcn.1000e95c
pop ecx
push ebx
mov edx, esi
mov ecx, 0x53a169
call fcn.1000e95c
mov esi, 0x1000c3e6
mov ecx, 0x406d8e
mov edx, esi
call fcn.1000e8ce
mov edx, esi
mov ecx, 0x40722f
call fcn.1000e8ce
mov edx, esi
mov ecx, 0x4075b3
call fcn.1000e8ce
pop ecx
mov esi, 0x320
mov ecx, 0x414c9d
push 2
mov edx, esi
call fcn.1000e95c
pop ecx
push 2
mov edx, esi
mov ecx, 0x415311
call fcn.1000e95c
pop ecx
push 4
pop edi
push edi
call fcn.1000f510
pop ecx
mov dword [ebp - 0x2c], eax
mov dword [eax], 0x1000badd
xor ebx, ebx
lea ecx, [ebp - 0x34]
push ecx
push ebx
push eax
push 0x1000e0af
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x38], eax
test eax, eax
je 0x1000db59
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x34], ebx
jne 0x1000da4e
push ecx
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push dword [ebp - 0x34]
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
pop ecx
pop ecx
test eax, eax
je 0x1000da65
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], ebx
push eax
push edi
push edi
mov esi, 0x5975d4
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov dword [ebp - 0x14], 0x1000c045
call ebx
push edi
mov edi, dword [sym.imp.VCRUNTIME140.dll_memcpy]
lea eax, [ebp - 0x14]
push eax
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push 4
push esi
call ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1000c191
push eax
push 4
push 4
add esi, 0x2c
push esi
call ebx
push 4
lea eax, [ebp - 0x14]
push eax
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push 4
push esi
call ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1000bfc8
push eax
push 4
push 4
mov esi, 0x597578
push esi
call ebx
push 4
lea eax, [ebp - 0x14]
push eax
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push 4
push esi
call ebx
lea eax, [ebp - 0x28]
mov esi, 0x1000c789
push eax
push 0x80
push 4
mov eax, 0x44e846
sub esi, 0x44e84a
push eax
call ebx
push 4
lea eax, [ebp - 0x24]
push 0x44e846
push eax
call edi
mov eax, dword [ebp - 0x24]
add esp, 0xc
add eax, 0x44e84a
mov dword [0x100186c4], eax
mov ecx, 0x44e846
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x28]
mov dword [ecx], esi
push 5
push ecx
call ebx
cmp dword [ebp - 0x34], 0
je 0x1000db63
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov dword [ebp - 0x34], ebx
push 6
jmp 0x1000da48
call fcn.100105c2
ret