Function at 0x1001d510
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062ba3
mov eax, dword fs:[0]
push eax
sub esp, 0x914
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x10066e78
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8ec], eax
push str.LoadLibraryW_
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x848], eax
push 0x10066ea8
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x850], eax
push 0x10066eb8
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x858], eax
push 0x10066ec8
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x860], eax
push 0x10066ed4
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x868], eax
push str.CreateRemoteThread
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8b4], eax
push str.DbgUiRemoteBreakin
push 0x10066f08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x870], eax
push str.LdrLoadDll
push 0x10066f08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x878], eax
push str.LdrUnloadDll
push 0x10066f08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x880], eax
push 0x10066f30
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x888], eax
push str.VirtualQueryEx
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x918], eax
push 0x10066f50
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x890], eax
push 0x10066f6c
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x898], eax
push str.VirtualAllocEx
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8a0], eax
push str.DebugBreak
push 0x10066e88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8bc], eax
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x838], 0
call fcn.10005770
movzx eax, al
test eax, eax
je 0x1001d796
push str.RtlUserThreadStart
push 0x10066f08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x830], eax
push str.NtCreateThread
push 0x10066f08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x834], eax
push str.NtCreateThreadEx
push 0x10066f08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x838], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8e8], ecx
xor edx, edx
mov dword [ebp - 0x844], edx
mov dword [ebp - 0x840], edx
mov dword [ebp - 0x83c], edx
push 0xc
lea eax, [ebp - 0x844]
push eax
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0xffffffffffffffff
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x844]
mov dword [ebp - 0x8a8], ecx
mov edx, dword [ebp - 0x844]
add edx, dword [ebp - 0x840]
mov dword [ebp - 0x8ac], edx
xor eax, eax
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x908], eax
mov dword [ebp - 0x904], eax
mov dword [ebp - 0x900], eax
mov dword [ebp - 0x8fc], eax
mov dword [ebp - 0x8f8], eax
mov dword [ebp - 0x8f4], eax
push 0x1c
lea ecx, [ebp - 0x90c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.10040680
add esp, 0xc
push 0x800
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0xffffffffffffffff
call sub.KERNEL32.dll_K32GetMappedFileNameA
clc
jae 0x1001d85e
invalid
pushf
push 0xa