Function at 0x422071
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x80000301
push 0
push 4
push 1
mov ebx, 0x1c
mov eax, 0x42ea60
call fcn.0042ab00
add esp, 0x10
mov dword [ebp - 4], eax
push 6
call fcn.004225d4
mov dword [ebp - 8], eax
push str..dll
push dword [ebp - 8]
push dword [ebp - 4]
mov ecx, 3
call fcn.004010a1
add esp, 0xc
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4220d8
push ebx
call fcn.0042a389
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4220e8
push ebx
call fcn.0042a389
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [0x60ee79]
test ebx, ebx
je 0x4220ff
push ebx
call fcn.0042a389
add esp, 4
pop eax
mov dword [0x60ee79], eax
mov eax, 0x4a7293
test eax, eax
je 0x422121
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0042a383
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [0x60ee7d]
test ebx, ebx
je 0x422135
push ebx
call fcn.0042a389
add esp, 4
pop eax
mov dword [0x60ee7d], eax
push 0x80000005
push 0
mov eax, dword [0x60ee7d]
test eax, eax
jne 0x422150
mov eax, 0x446356
push eax
push 0x80000004
push 0
mov eax, dword [0x60ee79]
test eax, eax
jne 0x422166
mov eax, 0x44630f
push eax
push 2
mov ebx, 0x26c
call fcn.0042c870
add esp, 0x1c
mov dword [ebp - 4], esp
push dword [0x60ee79]
call dword [0x60ef0d]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4221a8
push 0xc8
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60ee81], eax
cmp dword [0x60ee81], 0
jne 0x4221c4
mov eax, 0
jmp 0x4225d0
mov dword [ebp - 4], esp
push str.InsDrv
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4221f8
push 0x14a
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60ee85], eax
mov dword [ebp - 4], esp
push str.UniDrv
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x422231
push 0x18a
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60ee89], eax
mov dword [ebp - 4], esp
push str.HideProcess
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x42226a
push 0x1ca
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60ee8d], eax
mov dword [ebp - 4], esp
push str.AllocMemory
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4222a3
push 0x20f
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60ee91], eax
mov dword [ebp - 4], esp
push str.GetModule
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4222dc
push 0x254
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60ee95], eax
mov dword [ebp - 4], esp
push str.Read
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x422315
push 0x297
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60ee99], eax
mov dword [ebp - 4], esp
push str.Write
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x42234e
push 0x2d5
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60ee9d], eax
mov dword [ebp - 4], esp
push str.GetFunction
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x422387
push 0x314
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eea1], eax
mov dword [ebp - 4], esp
push str.RemoteCall
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4223c0
push 0x359
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eea5], eax
mov dword [ebp - 4], esp
push str.ProcessProtect
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4223f9
push 0x39d
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eea9], eax
mov dword [ebp - 4], esp
push str.CreateThreadw
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x422432
push 0x3e5
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eead], eax
mov dword [ebp - 4], esp
push str.HWNDProcess
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x42246b
push 0x42c
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eeb1], eax
mov dword [ebp - 4], esp
push str.MouseClick
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4224a4
push 0x471
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eeb5], eax
mov dword [ebp - 4], esp
push str.MouseMove
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4224dd
push 0x4b5
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eeb9], eax
mov dword [ebp - 4], esp
push str.KeyboardClick
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x422516
push 0x4f8
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eebd], eax
mov dword [ebp - 4], esp
push str.QueryVirtualMemory
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x42254f
push 0x53f
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eec1], eax
mov dword [ebp - 4], esp
push str.VirtualMemory
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x422588
push 0x58b
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eec5], eax
mov dword [ebp - 4], esp
push str.FreeMemory
push dword [0x60ee81]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4225c1
push 0x5d2
push 0x40511d6
push 6
call fcn.0042a377
add esp, 0xc
mov dword [0x60eec9], eax
mov eax, 1
jmp 0x4225d0
mov esp, ebp
pop ebp
ret