Function at 0x101eecb
Capabilities:
Create thread
Get common file path
Link many functions at runtime
Move file
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x102e070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x1003754
push edi
push eax
lea eax, [ebp - 0x81c]
push eax
mov dword [ebp - 0x840], ecx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x834], 3
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x830], ebx
call fcn.0101df39
mov esi, eax
cmp esi, ebx
jl 0x101f002
push dword [ebp - 0x81c]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call ebx
mov dword [0x102e75c], eax
test eax, eax
jne 0x101f072
push 0x104
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x101ef9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x101ef8d
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x101ef94
mov esi, 0x80004005
push 0x100371c
jmp 0x101f1e4
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.0101e123
mov esi, eax
test esi, esi
jge 0x101efc8
lea eax, [ebp - 0x414]
push eax
push 0x10036e4
jmp 0x101f06b
lea eax, [ebp - 0x81c]
push eax
call fcn.0101e1ad
mov esi, eax
test esi, esi
jge 0x101efea
push dword [ebp - 0x81c]
push 0x10036ac
jmp 0x101f06b
push edi
push 0x1002f20
lea eax, [ebp - 0x81c]
push eax
call fcn.0101df39
mov esi, eax
test esi, esi
jge 0x101f00c
push 0x100367c
jmp 0x101f1e4
push dword [ebp - 0x81c]
call ebx
mov dword [0x102e75c], eax
test eax, eax
jne 0x101f072
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x101f047
push dword [ebp - 0x81c]
xor edi, edi
push 0x1003628
inc edi
push edi
push edi
call fcn.0101e48b
add esp, 0x10
mov esi, edi
jmp 0x101f5e6
test eax, eax
jle 0x101f055
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x101f060
mov esi, 0x80004005
push dword [ebp - 0x81c]
push 0x1003604
push 1
jmp 0x101f41a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10035f4
push eax
call esi
xor ebx, ebx
mov dword [0x102e760], eax
cmp eax, ebx
jne 0x101f0b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101f09f
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x101f0aa
mov esi, 0x80004005
push 0x10035c4
jmp 0x101f1e4
push 0x10035ac
push dword [0x102e75c]
call esi
mov dword [0x102e764], eax
cmp eax, ebx
jne 0x101f0f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101f0de
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x101f0e9
mov esi, 0x80004005
push 0x1003574
jmp 0x101f1e4
push 0x1003560
push dword [0x102e75c]
call esi
mov dword [0x102e768], eax
cmp eax, ebx
jne 0x101f132
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101f11d
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x101f128
mov esi, 0x80004005
push 0x100352c
jmp 0x101f1e4
push 0x10029f8
push dword [0x102e75c]
call esi
mov dword [0x102e76c], eax
cmp eax, ebx
jne 0x101f16e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101f15c
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x101f167
mov esi, 0x80004005
push 0x10029c4
jmp 0x101f1e4
push 0x10029ac
push dword [0x102e75c]
call esi
mov dword [0x102e770], eax
cmp eax, ebx
jne 0x101f1aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101f198
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x101f1a3
mov esi, 0x80004005
push 0x1002974
jmp 0x101f1e4
push 0x1002968
push dword [0x102e75c]
call esi
mov dword [0x102e774], eax
cmp eax, ebx
jne 0x101f1eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101f1d4
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x101f1df
mov esi, 0x80004005
push 0x100293c
push 1
jmp 0x101f5a0
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x82c]
push eax
call fcn.0101e517
xor edi, edi
mov esi, eax
inc edi
cmp esi, ebx
jge 0x101f216
push 0x10034e0
push edi
push esi
call fcn.0101e48b
add esp, 0xc
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x828], eax
cmp eax, ebx
jne 0x101f539
xor eax, eax
push 0x3fe
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x812]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x814]
push eax
push 0x1003498
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x1fe
ja 0x101f2d5
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.0101e123
mov esi, eax
cmp esi, ebx
jge 0x101f291
lea eax, [ebp - 0x814]
push eax
push 0x100346c
jmp 0x101f419
mov dword [ebp - 0x828], edi
push 0x9000
push dword [ebp - 0x818]
call dword [0x102e764]
test eax, eax
jne 0x101f5b3
push dword [ebp - 0x818]
push dword [ebp - 0x81c]
push 0x1003434
mov esi, 0x8000ffff
push edi
push esi
call fcn.0101e48b
add esp, 0x14
jmp 0x101f5e6
lea eax, [ebp - 0x828]
push eax
push 0x1003420
push edi
push 0x1003398
mov ebx, 0x80000002
push ebx
call fcn.0102c83e
test eax, eax
jl 0x101f595
cmp dword [ebp - 0x828], 0
jbe 0x101f595
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x101f348
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x101f337
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x101f33e
mov esi, 0x80004005
push 0x1003364
jmp 0x101f59f
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.0101e123
mov esi, eax
test esi, esi
jge 0x101f372
lea eax, [ebp - 0x20c]
push eax
push 0x1003328
jmp 0x101f419
lea eax, [ebp - 0x818]
push eax
call fcn.0101e1ad
mov esi, eax
test esi, esi
jge 0x101f394
push dword [ebp - 0x818]
push 0x10032ec
jmp 0x101f419
push 0x10032d8
lea eax, [ebp - 0x818]
push eax
call fcn.0101de63
mov esi, eax
test esi, esi
jge 0x101f3b8
push dword [ebp - 0x818]
push 0x10032a0
jmp 0x101f419
push 0
push dword [ebp - 0x818]
call fcn.0102cb61
push dword [ebp - 0x818]
mov esi, eax
test esi, esi
jge 0x101f3d8
push 0x100326c
jmp 0x101f419
lea eax, [ebp - 0x820]
push eax
call fcn.0101e123
mov esi, eax
test esi, esi
jge 0x101f3f7
push dword [ebp - 0x818]
push 0x1003244
jmp 0x101f419
push 0x1003230
lea eax, [ebp - 0x818]
push eax
call fcn.0101de63
mov esi, eax
test esi, esi
jge 0x101f428
push dword [ebp - 0x818]
push 0x1003204
push edi
push esi
call fcn.0101e48b
add esp, 0x10
jmp 0x101f5e6
and dword [ebp - 0x83c], 0
and dword [ebp - 0x838], 0
lea eax, [ebp - 0x83c]
push eax
push dword [ebp - 0x818]
call fcn.0102c989
test eax, eax
jl 0x101f537
cmp dword [ebp - 0x838], 0
ja 0x101f469
cmp dword [ebp - 0x83c], 0xf00000
jbe 0x101f537
lea eax, [ebp - 0x834]
push eax
push 0x10031f8
push edi
push 0x1003190
push ebx
call fcn.0102c83e
test eax, eax
jl 0x101f492
cmp dword [ebp - 0x834], 2
je 0x101f537
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x844]
push eax
movzx eax, word [ebp - 0x846]
push eax
movzx eax, word [ebp - 0x848]
push eax
movzx eax, word [ebp - 0x84a]
push eax
movzx eax, word [ebp - 0x84e]
push eax
movzx eax, word [ebp - 0x850]
push eax
push dword [ebp - 0x820]
lea eax, [ebp - 0x824]
push 0x1003138
push eax
call fcn.0101e219
add esp, 0x24
test eax, eax
jl 0x101f57e
push edi
push dword [ebp - 0x824]
push dword [ebp - 0x818]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x101f537
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101f51c
and eax, 0xffff
or eax, 0x80070000
push dword [ebp - 0x824]
push dword [ebp - 0x818]
push 0x10030f8
push edi
push eax
call fcn.0101e48b
add esp, 0x14
xor ebx, ebx
cmp dword [ebp - 0x828], ebx
jbe 0x101f5ab
cmp dword [ebp - 0x82c], ebx
je 0x101f297
push dword [ebp - 0x818]
push 0xb000
push dword [ebp - 0x840]
call dword [0x102e760]
test eax, eax
jne 0x101f5ab
push dword [ebp - 0x818]
push dword [ebp - 0x81c]
push 0x10030b8
jmp 0x101f2c1
push dword [ebp - 0x818]
push 0x1003050
push edi
push eax
call fcn.0101e48b
add esp, 0x10
jmp 0x101f537
mov esi, 0x80004004
push 0x1003008
push edi
push esi
call fcn.0101e48b
add esp, 0xc
jmp 0x101f5e6
cmp dword [ebp - 0x82c], ebx
jne 0x101f5e6
cmp dword [ebp - 0x820], ebx
je 0x101f5fa
lea eax, [ebp - 0x854]
push eax
push ebx
push dword [ebp - 0x820]
push 0x101e911
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x830], eax
cmp eax, ebx
je 0x101f5e6
mov dword [ebp - 0x820], ebx
cmp dword [ebp - 0x820], 0
je 0x101f5fa
push dword [ebp - 0x820]
call fcn.0101db34
xor edi, edi
cmp dword [ebp - 0x824], edi
je 0x101f60f
push dword [ebp - 0x824]
call fcn.0101db34
cmp dword [ebp - 0x818], edi
je 0x101f622
push dword [ebp - 0x818]
call fcn.0101db34
cmp dword [ebp - 0x81c], edi
je 0x101f635
push dword [ebp - 0x81c]
call fcn.0101db34
cmp esi, edi
jge 0x101f66f
push dword [0x102e75c]
mov dword [0x102e760], edi
mov dword [0x102e764], edi
mov dword [0x102e768], edi
mov dword [0x102e76c], edi
mov dword [0x102e770], edi
mov dword [0x102e774], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x102e75c], edi
cmp dword [ebp - 0x830], edi
je 0x101f683
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101ce8b
leave
ret 8