Function at 0x1000abc0
Capabilities:
Create thread
Enumerate process modules
Inject thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1264
call fcn.1001a8e0
mov eax, dword [0x1005fa60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
xorps xmm0, xmm0
push edi
mov word [ebp - 0x24], ax
mov ebx, ecx
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x24]
push 0x10
push eax
push 0x10060df8
movdqu xmmword [ebp - 0x22], xmm0
movq qword [ebp - 0x12], xmm0
call fcn.10012000
push 0x10
lea eax, [ebp - 0x34]
xorps xmm0, xmm0
push eax
push 0x10060d64
movdqu xmmword [ebp - 0x34], xmm0
call fcn.10011ea0
add esp, 0x18
cmp dword [0x10066a64], 0
jne 0x1000ac70
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.10012c90
add esp, 8
mov dword [0x10066a64], eax
test eax, eax
jne 0x1000ac70
push str.InjectNx
push str.SSMpY8rjXSQCOaqOtxRerfPK2gO4clpT31tsMroEELGSQFiDusc8_QU
push eax
call fcn.10011650
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001811f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10066a88]
test al, 1
jne 0x1000acaf
or eax, 1
mov dword [0x10066aa0], 7
mov dword [0x10066a88], eax
xor eax, eax
push 0x10047460
mov dword [0x10066a9c], 0
mov word [0x10066a8c], ax
call fcn.10018f75
mov eax, dword [0x10066a88]
add esp, 4
test al, 2
jne 0x1000ace4
or eax, 2
mov dword [0x10066ab8], 7
mov dword [0x10066a88], eax
xor eax, eax
push 0x10047400
mov dword [0x10066ab4], 0
mov word [0x10066aa4], ax
call fcn.10018f75
add esp, 4
cmp dword [0x10066a9c], 0
mov edi, 0x10066aa4
mov esi, 0x10066a8c
jne 0x1000adb7
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0xa40], ax
lea eax, [ebp - 0xa3e]
push eax
call fcn.1001af60
lea eax, [ebp - 0xa40]
push 0x400
push eax
call fcn.10013240
add esp, 0x14
test eax, eax
jne 0x1000ad54
push str.InjectNx
push str.wuJ8YLXlJXykRLajH7aXVjTQWFc_rRlHAkE
push eax
call fcn.10011650
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001811f
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0xa40], 0
jne 0x1000ad62
xor ecx, ecx
jmp 0x1000ad7f
lea ecx, [ebp - 0xa40]
lea edx, [ecx + 2]
jmp 0x1000ad70
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000ad70
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xa40]
mov ecx, esi
push eax
call fcn.100085a0
cmp dword [0x10066aa0], 8
mov eax, esi
cmovae eax, dword [0x10066a8c]
push eax
push str.7p4zVatVm48BqL4eY8VNbFcAujzBTXi469LgO52y
push 4
call fcn.10011650
add esp, 0xc
cmp dword [0x10066a9c], 0
je 0x1000ae1d
cmp dword [0x10066ab4], 0
jne 0x1000ae26
push 1
sub esp, 8
call fcn.1000c270
cmp eax, 0xffffffff
je 0x1000adfd
push ecx
inc eax
push eax
lea eax, [ebp - 0x1260]
push eax
call fcn.1000c150
push eax
mov ecx, edi
call fcn.10006420
cmp dword [ebp - 0x124c], 8
jb 0x1000adfd
push dword [ebp - 0x1260]
call fcn.10018fac
add esp, 4
cmp dword [0x10066ab8], 8
mov eax, edi
cmovae eax, dword [0x10066aa4]
push eax
push str.d_T23VFBGm0NkJhaTLJFirU3mYJTcZYDHjwLlJ5
push 4
call fcn.10011650
add esp, 0xc
cmp dword [0x10066ab4], 0
je 0x1000aea2
lea eax, [ebp - 0x1244]
push eax
push 0x1000
lea eax, [ebp - 0x1240]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1000aea2
xor esi, esi
test dword [ebp - 0x1244], 0xfffffffc
jbe 0x1000aea2
push 0x208
lea eax, [ebp - 0x240]
push eax
push dword [ebp + esi*4 - 0x1240]
push ebx
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x1000ae94
cmp dword [0x10066ab8], 8
lea ecx, [ebp - 0x240]
mov eax, edi
cmovae eax, dword [0x10066aa4]
push ecx
push eax
call fcn.100181d2
add esp, 8
test eax, eax
je 0x1000aef2
mov eax, dword [ebp - 0x1244]
inc esi
shr eax, 2
cmp esi, eax
jb 0x1000ae52
mov eax, dword [0x10066a9c]
push 4
push 0x1000
lea edi, [eax*2 + 2]
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x1000af1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InjectNx
push str.2n598ZbXxVKThi2LP44Ra_4XbETPucJVyNw9M82heiIP
push esi
call fcn.10011650
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001811f
mov esp, ebp
pop ebp
ret
cmp dword [0x10066ab8], 8
cmovae edi, dword [0x10066aa4]
push edi
push str.InjectNx
push str.AIiONtc98Et65HrzOhoIGOOkiLFaYORDpftY5w
push 0
call fcn.10011650
add esp, 0x10
jmp 0x1000b038
push esi
push str.InjectNx
push str.YWIbaiXabNlJNGqg_Zfwa8958Q3843QQxxdeSwGnEOPJnrNRM
push 4
call fcn.10011650
add esp, 0x10
mov dword [ebp - 0x1248], 0
cmp dword [0x10066aa0], 8
lea ecx, [ebp - 0x1248]
mov eax, 0x10066a8c
cmovae eax, dword [0x10066a8c]
push ecx
push edi
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1000af8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InjectNx
push str.FGrEgQ7KlCp0PpSgVm58ugBL7NQxvNk8qnvQTmTkf7dmXkHRRg
push 0
call fcn.10011650
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001811f
mov esp, ebp
pop ebp
ret
push 0
push 0
push esi
push dword [0x10066a64]
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
jne 0x1000afd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InjectNx
push str.9GFkBdThqLcfWrVVqp4iv5dbQN5Le3gcyjvUTDTnr9e2XGh9A
push esi
call fcn.10011650
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001811f
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x1000b01d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.InjectNx
push str.TdGIwnpYfnXj4x8lWjm2iqwOG6evitsmuXlbfMJQcT3oCS_jkUBVz7fCTxTfONrFHYd9kUFYzKQ
push 0
call fcn.10011650
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001811f
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.InjectNx
push str.tGUxxWQeN6cTIpGlow
push 4
call fcn.10011650
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001811f
mov esp, ebp
pop ebp
ret