It should also be storing address of GetProcAddress() at <lpparm+4>
it should store a string the name of module at <lpparam+14>
it should store a string the name of proc for getProcAddress at <lpparm+46>
at [esp+8]
it accesses the lpparam which was written to the remote process so you may need to find this WriteProcessMemory Also
and look at the local Buffer to Know the data
ie name of dll and name of Proc
or you may need to attach to the Remote process and Break on Thread CreateEvent
and single Step through the BaseThreadStartThunk()
Routine in this routine you will notice ebp is Zeored in there and Eax and Ebx holds LpStart and lpParam and that is how lpStart gets Executed
push [ebp+c] lpparam
call [enp+8] lpStart
esi gets the lpparm via mov esi [esp+8] which in your case holds the Address of LoadLibrary as you correctly observed but you have not observed what is at
assuming [esp+8 ] holds 403000 <lpparam>
[[esp+8] + 0 ] [403000] holds Address of LoadLibrary as you observed
[[esp+8] + 4] [403004] will hold Address of GetProcAddress
[[esp+8] + 14] [403014] will hold a string the dll name
[[esp+8] + 46] [403046] will hold the name of Proc in the Loaded Dll
[[esp+8] + 10] [403010] gets the Result of LoadLibrary Return in your above snippet
edit
added the annotated snippet for referance
push esi
mov esi, [esp+8] <lpparameter> assuming 403000
lea eax, [esi+14h] lpparameter+14> should be a string the name of dll 403014
push eax push 403014
call dword ptr[esi] DWORD [ lpparmeter+0 ] = [403000] = Address Of LoadLib so calling loadlib
test eax, eax
mov [esi+10h], eax [lpparam+10] [403010] store LoadLibResult here
jz short loc_402B80 failure
lea ecx, [esi+46h] [403046] = <lpparm+46> again a string name of Proc for GetProcAddress()
push ecx processname
push eax HandletoLoadedmod
call dword ptr [esi+4] Must be Address of GetProcAddress from the looks check your code
capture local buffer when Writing to ProcessMemory or Break on Create new Thread in the RemoteProcess
by attaching a debugger Executing the RemoteDebugge and when a new Thread Create Event is triggered
single step to find the contents of lpparam
test eax, eax
jz short_loc402B80
call eax <calls the functions that was just getproc'ed>
push 0
call