Function at 0x100117f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049d78
mov eax, dword fs:[0]
push eax
sub esp, 0xc10
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x100591e0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xbf4], eax
push str.LoadLibraryW_
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xbf8], eax
push str.LoadLibraryExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xbfc], eax
push 0x10059220
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc00], eax
push 0x10059230
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc04], eax
push 0x1005923c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc08], eax
push str.CreateRemoteThread
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xba4], eax
push str.DbgUiRemoteBreakin
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb80], eax
push str.LdrLoadDll
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb84], eax
push str.LdrUnloadDll
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb88], eax
push 0x10059298
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb8c], eax
push str.VirtualQueryEx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc14], eax
push 0x100592b8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb90], eax
push str.VirtualAlloc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb94], eax
push str.VirtualAllocEx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb98], eax
push str.DebugBreak
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xb64], 0
mov dword [ebp - 0xb68], 0
mov dword [ebp - 0xb6c], 0
mov dword [ebp - 0x9c0], 0x11c
mov dword [ebp - 0x9bc], 0
mov dword [ebp - 0x9b8], 0
mov dword [ebp - 0x9b4], 0
mov dword [ebp - 0x9b0], 0
push 0x100
push 0
lea eax, [ebp - 0x9ac]
push eax
call fcn.10029440
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x8ac], cx
xor edx, edx
mov word [ebp - 0x8aa], dx
xor eax, eax
mov dword [ebp - 0x8a8], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xbd8], edx
mov ecx, 6
movzx edx, cx
mov dword [ebp - 0x9bc], edx
xor eax, eax
movzx ecx, ax
mov dword [ebp - 0x9b8], ecx
xor edx, edx
mov word [ebp - 0x8ac], dx
mov eax, dword [ebp - 0xbd8]
push eax
mov ecx, dword [ebp - 0xbdc]
push ecx
push 0x23
lea edx, [ebp - 0x9c0]
push edx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x10011af6
mov dword [ebp - 0xb74], 1
jmp 0x10011b00
mov dword [ebp - 0xb74], 0
movzx eax, byte [ebp - 0xb74]
test eax, eax
je 0x10011b62
push str.RtlUserThreadStart
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb64], eax
push str.NtCreateThread
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb68], eax
push str.NtCreateThreadEx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb6c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xbac], ecx
xor edx, edx
mov dword [ebp - 0xae8], edx
mov dword [ebp - 0xae4], edx
mov dword [ebp - 0xae0], edx
push 0xc
lea eax, [ebp - 0xae8]
push eax
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0xffffffffffffffff
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xb9c], ecx
mov edx, dword [ebp - 0xae8]
add edx, dword [ebp - 0xae4]
mov dword [ebp - 0xba0], edx
xor eax, eax
mov dword [ebp - 0x88c], eax
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x880], eax
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x874], eax
push 0x1c
lea ecx, [ebp - 0x88c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x800
push 0
lea eax, [ebp - 0x870]
push eax
call fcn.10029440
add esp, 0xc
push 0x800
lea ecx, [ebp - 0x870]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0xffffffffffffffff
call dword [sym.imp.PSAPI.DLL_GetMappedFileNameA]
clc
jae 0x10011c2c
invalid
pushf
push 0xa