Function at 0x102c543
Capabilities:
Create thread
Get common file path
Link many functions at runtime
Move file
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x103e550]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x100948c
push edi
push eax
lea eax, [ebp - 0x81c]
push eax
mov dword [ebp - 0x840], ecx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x834], 3
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x830], ebx
call fcn.01039f3d
mov esi, eax
cmp esi, ebx
jl 0x102c67a
push dword [ebp - 0x81c]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call ebx
mov dword [0x103eb7c], eax
test eax, eax
jne 0x102c6ea
push 0x104
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x102c616
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x102c605
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x102c60c
mov esi, 0x80004005
push 0x1009454
jmp 0x102c85c
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.0103a127
mov esi, eax
test esi, esi
jge 0x102c640
lea eax, [ebp - 0x414]
push eax
push 0x100941c
jmp 0x102c6e3
lea eax, [ebp - 0x81c]
push eax
call fcn.0103a1b1
mov esi, eax
test esi, esi
jge 0x102c662
push dword [ebp - 0x81c]
push 0x10093e4
jmp 0x102c6e3
push edi
push 0x1008ce8
lea eax, [ebp - 0x81c]
push eax
call fcn.01039f3d
mov esi, eax
test esi, esi
jge 0x102c684
push 0x10093b4
jmp 0x102c85c
push dword [ebp - 0x81c]
call ebx
mov dword [0x103eb7c], eax
test eax, eax
jne 0x102c6ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x102c6bf
push dword [ebp - 0x81c]
xor edi, edi
push 0x1009360
inc edi
push edi
push edi
call fcn.0102ba8e
add esp, 0x10
mov esi, edi
jmp 0x102cc5e
test eax, eax
jle 0x102c6cd
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x102c6d8
mov esi, 0x80004005
push dword [ebp - 0x81c]
push 0x100933c
push 1
jmp 0x102ca92
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100932c
push eax
call esi
xor ebx, ebx
mov dword [0x103eb80], eax
cmp eax, ebx
jne 0x102c72c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102c717
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x102c722
mov esi, 0x80004005
push 0x10092fc
jmp 0x102c85c
push 0x10092e4
push dword [0x103eb7c]
call esi
mov dword [0x103eb84], eax
cmp eax, ebx
jne 0x102c76b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102c756
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x102c761
mov esi, 0x80004005
push 0x10092ac
jmp 0x102c85c
push 0x1009298
push dword [0x103eb7c]
call esi
mov dword [0x103eb88], eax
cmp eax, ebx
jne 0x102c7aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102c795
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x102c7a0
mov esi, 0x80004005
push 0x1009264
jmp 0x102c85c
push 0x10087c0
push dword [0x103eb7c]
call esi
mov dword [0x103eb8c], eax
cmp eax, ebx
jne 0x102c7e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102c7d4
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x102c7df
mov esi, 0x80004005
push 0x100878c
jmp 0x102c85c
push 0x1008774
push dword [0x103eb7c]
call esi
mov dword [0x103eb90], eax
cmp eax, ebx
jne 0x102c822
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102c810
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x102c81b
mov esi, 0x80004005
push 0x100873c
jmp 0x102c85c
push 0x1008730
push dword [0x103eb7c]
call esi
mov dword [0x103eb94], eax
cmp eax, ebx
jne 0x102c863
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102c84c
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x102c857
mov esi, 0x80004005
push 0x1008704
push 1
jmp 0x102cc18
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x82c]
push eax
call fcn.0102bb1a
xor edi, edi
mov esi, eax
inc edi
cmp esi, ebx
jge 0x102c88e
push 0x1009218
push edi
push esi
call fcn.0102ba8e
add esp, 0xc
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x828], eax
cmp eax, ebx
jne 0x102cbb1
xor eax, eax
push 0x3fe
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x812]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x814]
push eax
push 0x10091d0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x1fe
ja 0x102c94d
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.0103a127
mov esi, eax
cmp esi, ebx
jge 0x102c909
lea eax, [ebp - 0x814]
push eax
push 0x10091a8
jmp 0x102ca91
mov dword [ebp - 0x828], edi
push 0x9000
push dword [ebp - 0x818]
call dword [0x103eb84]
test eax, eax
jne 0x102cc2b
push dword [ebp - 0x818]
push dword [ebp - 0x81c]
push 0x1009170
mov esi, 0x8000ffff
push edi
push esi
call fcn.0102ba8e
add esp, 0x14
jmp 0x102cc5e
lea eax, [ebp - 0x828]
push eax
push 0x100915c
push edi
push 0x1005288
mov ebx, 0x80000002
push ebx
call fcn.01039b48
test eax, eax
jl 0x102cc0d
cmp dword [ebp - 0x828], 0
jbe 0x102cc0d
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x102c9c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x102c9af
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x102c9b6
mov esi, 0x80004005
push 0x100912c
jmp 0x102cc17
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.0103a127
mov esi, eax
test esi, esi
jge 0x102c9ea
lea eax, [ebp - 0x20c]
push eax
push 0x10090f0
jmp 0x102ca91
lea eax, [ebp - 0x818]
push eax
call fcn.0103a1b1
mov esi, eax
test esi, esi
jge 0x102ca0c
push dword [ebp - 0x818]
push 0x10090b4
jmp 0x102ca91
push 0x10090a0
lea eax, [ebp - 0x818]
push eax
call fcn.01039e67
mov esi, eax
test esi, esi
jge 0x102ca30
push dword [ebp - 0x818]
push 0x1009068
jmp 0x102ca91
push 0
push dword [ebp - 0x818]
call fcn.0103a3b4
push dword [ebp - 0x818]
mov esi, eax
test esi, esi
jge 0x102ca50
push 0x1009034
jmp 0x102ca91
lea eax, [ebp - 0x820]
push eax
call fcn.0103a127
mov esi, eax
test esi, esi
jge 0x102ca6f
push dword [ebp - 0x818]
push 0x100900c
jmp 0x102ca91
push 0x1008ff8
lea eax, [ebp - 0x818]
push eax
call fcn.01039e67
mov esi, eax
test esi, esi
jge 0x102caa0
push dword [ebp - 0x818]
push 0x1008fcc
push edi
push esi
call fcn.0102ba8e
add esp, 0x10
jmp 0x102cc5e
and dword [ebp - 0x83c], 0
and dword [ebp - 0x838], 0
lea eax, [ebp - 0x83c]
push eax
push dword [ebp - 0x818]
call fcn.0103a25f
test eax, eax
jl 0x102cbaf
cmp dword [ebp - 0x838], 0
ja 0x102cae1
cmp dword [ebp - 0x83c], 0xf00000
jbe 0x102cbaf
lea eax, [ebp - 0x834]
push eax
push 0x1008fc0
push edi
push 0x1008f58
push ebx
call fcn.01039b48
test eax, eax
jl 0x102cb0a
cmp dword [ebp - 0x834], 2
je 0x102cbaf
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x844]
push eax
movzx eax, word [ebp - 0x846]
push eax
movzx eax, word [ebp - 0x848]
push eax
movzx eax, word [ebp - 0x84a]
push eax
movzx eax, word [ebp - 0x84e]
push eax
movzx eax, word [ebp - 0x850]
push eax
push dword [ebp - 0x820]
lea eax, [ebp - 0x824]
push 0x1008f00
push eax
call fcn.0103a21d
add esp, 0x24
test eax, eax
jl 0x102cbf6
push edi
push dword [ebp - 0x824]
push dword [ebp - 0x818]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x102cbaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102cb94
and eax, 0xffff
or eax, 0x80070000
push dword [ebp - 0x824]
push dword [ebp - 0x818]
push 0x1008ec0
push edi
push eax
call fcn.0102ba8e
add esp, 0x14
xor ebx, ebx
cmp dword [ebp - 0x828], ebx
jbe 0x102cc23
cmp dword [ebp - 0x82c], ebx
je 0x102c90f
push dword [ebp - 0x818]
push 0xb000
push dword [ebp - 0x840]
call dword [0x103eb80]
test eax, eax
jne 0x102cc23
push dword [ebp - 0x818]
push dword [ebp - 0x81c]
push 0x1008e80
jmp 0x102c939
push dword [ebp - 0x818]
push 0x1008e18
push edi
push eax
call fcn.0102ba8e
add esp, 0x10
jmp 0x102cbaf
mov esi, 0x80004004
push 0x1008dd0
push edi
push esi
call fcn.0102ba8e
add esp, 0xc
jmp 0x102cc5e
cmp dword [ebp - 0x82c], ebx
jne 0x102cc5e
cmp dword [ebp - 0x820], ebx
je 0x102cc72
lea eax, [ebp - 0x854]
push eax
push ebx
push dword [ebp - 0x820]
push 0x102bf89
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x830], eax
cmp eax, ebx
je 0x102cc5e
mov dword [ebp - 0x820], ebx
cmp dword [ebp - 0x820], 0
je 0x102cc72
push dword [ebp - 0x820]
call fcn.01039c87
xor edi, edi
cmp dword [ebp - 0x824], edi
je 0x102cc87
push dword [ebp - 0x824]
call fcn.01039c87
cmp dword [ebp - 0x818], edi
je 0x102cc9a
push dword [ebp - 0x818]
call fcn.01039c87
cmp dword [ebp - 0x81c], edi
je 0x102ccad
push dword [ebp - 0x81c]
call fcn.01039c87
cmp esi, edi
jge 0x102cce7
push dword [0x103eb7c]
mov dword [0x103eb80], edi
mov dword [0x103eb84], edi
mov dword [0x103eb88], edi
mov dword [0x103eb8c], edi
mov dword [0x103eb90], edi
mov dword [0x103eb94], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x103eb7c], edi
cmp dword [ebp - 0x830], edi
je 0x102ccfb
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102aec7
leave
ret 8