Function at 0x10021fd0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d848
mov eax, dword fs:[0]
push eax
sub esp, 0x93c
mov eax, dword [0x10432764]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x1006062c
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x92c], eax
push str.LoadLibraryW_
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x934], eax
push str.LoadLibraryExA
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x870], eax
push 0x1006066c
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x878], eax
push 0x1006067c
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x880], eax
push 0x10060688
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x888], eax
push str.CreateRemoteThread
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8d4], eax
push str.DbgUiRemoteBreakin
push 0x100606bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x890], eax
push str.LdrLoadDll
push 0x100606bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x898], eax
push str.LdrUnloadDll
push 0x100606bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a0], eax
push 0x100606e4
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a8], eax
push str.VirtualQueryEx
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x948], eax
push 0x10060704
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8b0], eax
push 0x10060720
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8b8], eax
push str.VirtualAllocEx
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8c0], eax
push str.DebugBreak
push 0x1006063c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0x860], 0
mov dword [ebp - 0x864], 0
mov dword [ebp - 0x868], 0
call fcn.10006cf0
movzx eax, al
test eax, eax
je 0x10022256
push str.RtlUserThreadStart
push 0x100606bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x860], eax
push str.NtCreateThread
push 0x100606bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x864], eax
push str.NtCreateThreadEx
push 0x100606bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x868], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8f0], ecx
xor edx, edx
mov dword [ebp - 0x850], edx
mov dword [ebp - 0x84c], edx
mov dword [ebp - 0x848], edx
push 0xc
lea eax, [ebp - 0x850]
push eax
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0xffffffffffffffff
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x8c8], ecx
mov edx, dword [ebp - 0x850]
add edx, dword [ebp - 0x84c]
mov dword [ebp - 0x8cc], edx
xor eax, eax
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], eax
push 0x1c
lea ecx, [ebp - 0x82c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.1003be00
add esp, 0xc
push 0x800
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0xffffffffffffffff
call sub.KERNEL32.dll_K32GetMappedFileNameA
clc
jae 0x1002231e
invalid
pushf
push 0xa