Function at 0x1000b940
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x1002e0fc], 0
je 0x1000b94c
xor eax, eax
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002954c
push eax
mov dword [0x1002e100], eax
call edi
push str.CopyFileA
push dword [0x1002e100]
mov dword [0x1002e120], eax
call edi
push str.GlobalLock
push dword [0x1002e100]
mov dword [0x1002e124], eax
call edi
push str.GlobalAlloc
push dword [0x1002e100]
mov dword [0x1002e128], eax
call edi
push str.GlobalUnlock
push dword [0x1002e100]
mov dword [0x1002e12c], eax
call edi
push 0x1002958c
push dword [0x1002e100]
mov dword [0x1002e130], eax
call edi
push 0x100295a0
push dword [0x1002e100]
mov dword [0x1002e134], eax
call edi
push 0x100294e8
push dword [0x1002e100]
mov dword [0x1002e138], eax
call edi
push str.DuplicateHandle
push dword [0x1002e100]
mov dword [0x1002e13c], eax
call edi
push 0x100295c4
push dword [0x1002e100]
mov dword [0x1002e140], eax
call edi
push 0x100294dc
push dword [0x1002e100]
mov dword [0x1002e144], eax
call edi
push 0x100290c8
push dword [0x1002e100]
mov dword [0x1002e148], eax
call edi
push 0x100295d8
push dword [0x1002e100]
mov dword [0x1002e14c], eax
call edi
push str.SetThreadPriority
push dword [0x1002e100]
mov dword [0x1002e150], eax
call edi
push str.QueryFullProcessImageNameA
push dword [0x1002e100]
mov dword [0x1002e154], eax
call edi
push 0x1002961c
push dword [0x1002e100]
mov dword [0x1002e158], eax
call edi
push 0x10029638
push dword [0x1002e100]
mov dword [0x1002e15c], eax
call edi
push str.SetFileAttributesA
push dword [0x1002e100]
mov dword [0x1002e160], eax
call edi
push str.DefineDosDeviceA
push dword [0x1002e100]
mov dword [0x1002e168], eax
call edi
push str.GetVersion
push dword [0x1002e100]
mov dword [0x1002e16c], eax
call edi
push 0x10029680
push dword [0x1002e100]
mov dword [0x1002e170], eax
call edi
push 0x10029690
push dword [0x1002e100]
mov dword [0x1002e174], eax
call edi
push 0x100296a0
push dword [0x1002e100]
mov dword [0x1002e164], eax
call edi
push 0x100296b4
push dword [0x1002e100]
mov dword [0x1002e178], eax
call edi
push 0x100296c4
push dword [0x1002e100]
mov dword [0x1002e17c], eax
call edi
push 0x100291c8
push dword [0x1002e100]
mov dword [0x1002e180], eax
call edi
push 0x100296d4
push dword [0x1002e100]
mov dword [0x1002e184], eax
call edi
push 0x100296e0
push dword [0x1002e100]
mov dword [0x1002e188], eax
call edi
push 0x100296e8
push dword [0x1002e100]
mov dword [0x1002e18c], eax
call edi
push 0x100296f4
push dword [0x1002e100]
mov dword [0x1002e190], eax
call edi
push 0x100294f0
push dword [0x1002e100]
mov dword [0x1002e194], eax
call edi
push 0x10029704
push dword [0x1002e100]
mov dword [0x1002e198], eax
call edi
push 0x10029718
push dword [0x1002e100]
mov dword [0x1002e19c], eax
call edi
push 0x10029728
push dword [0x1002e100]
mov dword [0x1002e1a0], eax
call edi
push 0x10029734
push dword [0x1002e100]
mov dword [0x1002e1a4], eax
call edi
push 0x10029740
push dword [0x1002e100]
mov dword [0x1002e1a8], eax
call edi
push 0x1002974c
push dword [0x1002e100]
mov dword [0x1002e1ac], eax
call edi
push 0x1002975c
push dword [0x1002e100]
mov dword [0x1002e1b0], eax
call edi
push str.GetExitCodeProcess
push dword [0x1002e100]
mov dword [0x1002e1b4], eax
call edi
push 0x10029780
push dword [0x1002e100]
mov dword [0x1002e1b8], eax
call edi
push 0x1002979c
push dword [0x1002e100]
mov dword [0x1002e1bc], eax
call edi
push str.GetSystemDirectoryA
push dword [0x1002e100]
mov dword [0x1002e1c0], eax
call edi
push str.MoveFileA
push dword [0x1002e100]
mov dword [0x1002e1c4], eax
call edi
push str.MoveFileExA
push dword [0x1002e100]
mov dword [0x1002e1c8], eax
call edi
push str.WTSGetActiveConsoleSessionId
push dword [0x1002e100]
mov dword [0x1002e1cc], eax
call edi
push 0x100291a4
push dword [0x1002e100]
mov dword [0x1002e1d0], eax
call edi
push str.User32.dll
mov dword [0x1002e1d4], eax
call esi
push str.SetClipboardData
push eax
mov dword [0x1002e104], eax
call edi
push str.EmptyClipboard
push dword [0x1002e104]
mov dword [0x1002e1d8], eax
call edi
push str.CloseClipboard
push dword [0x1002e104]
mov dword [0x1002e1dc], eax
call edi
push str.GetClipboardData
push dword [0x1002e104]
mov dword [0x1002e1e0], eax
call edi
push str.OpenClipboard
push dword [0x1002e104]
mov dword [0x1002e1e4], eax
call edi
push 0x1002985c
push dword [0x1002e104]
mov dword [0x1002e1e8], eax
call edi
push 0x10029868
push dword [0x1002e104]
mov dword [0x1002e1ec], eax
call edi
push 0x10029878
push dword [0x1002e104]
mov dword [0x1002e1f0], eax
call edi
push 0x10029884
push dword [0x1002e104]
mov dword [0x1002e1f4], eax
call edi
push 0x10029894
push dword [0x1002e104]
mov dword [0x1002e1f8], eax
call edi
push 0x100298a4
push dword [0x1002e104]
mov dword [0x1002e1fc], eax
call edi
push 0x100298b0
push dword [0x1002e104]
mov dword [0x1002e200], eax
call edi
mov dword [0x1002e204], eax
push 0x100298c4
push dword [0x1002e104]
call edi
push 0x100298d4
push dword [0x1002e104]
mov dword [0x1002e208], eax
call edi
push str.MSVCRT.dll
mov dword [0x1002e20c], eax
call esi
push str.strcmp
push eax
mov dword [0x1002e110], eax
call edi
push str.strlen
push dword [0x1002e110]
mov dword [0x1002e258], eax
call edi
push str.memcpy
push dword [0x1002e110]
mov dword [0x1002e25c], eax
call edi
push str.memset
push dword [0x1002e110]
mov dword [0x1002e260], eax
call edi
push str.strstr
push dword [0x1002e110]
mov dword [0x1002e264], eax
call edi
push str.ws2_32.dll
mov dword [0x1002e268], eax
call esi
push str.WSAStartup
push eax
mov dword [0x1002e10c], eax
call edi
push str.WSACleanup
push dword [0x1002e10c]
mov dword [0x1002e26c], eax
call edi
push str.socket
push dword [0x1002e10c]
mov dword [0x1002e270], eax
call edi
push str.gethostbyname
push dword [0x1002e10c]
mov dword [0x1002e274], eax
call edi
push str.htons
push dword [0x1002e10c]
mov dword [0x1002e278], eax
call edi
push str.connect
push dword [0x1002e10c]
mov dword [0x1002e27c], eax
call edi
push str.send
push dword [0x1002e10c]
mov dword [0x1002e280], eax
call edi
push str.recv
push dword [0x1002e10c]
mov dword [0x1002e284], eax
call edi
push str.closesocket
push dword [0x1002e10c]
mov dword [0x1002e288], eax
call edi
push str.setsockopt
push dword [0x1002e10c]
mov dword [0x1002e28c], eax
call edi
push 0x10029988
push dword [0x1002e10c]
mov dword [0x1002e290], eax
call edi
push str.select
push dword [0x1002e10c]
mov dword [0x1002e294], eax
call edi
mov dword [0x1002e298], eax
push str.getsockname
push dword [0x1002e10c]
call edi
push str.gethostname
push dword [0x1002e10c]
mov dword [0x1002e29c], eax
call edi
push 0x10029150
mov dword [0x1002e2a0], eax
call esi
push str.StartServiceCtrlDispatcherA
push eax
mov dword [0x1002e108], eax
call edi
push str.SetServiceStatus
push dword [0x1002e108]
mov dword [0x1002e210], eax
call edi
push str.RegisterServiceCtrlHandlerA
push dword [0x1002e108]
mov dword [0x1002e214], eax
call edi
push 0x10029a00
push dword [0x1002e108]
mov dword [0x1002e218], eax
call edi
push 0x10029a10
push dword [0x1002e108]
mov dword [0x1002e21c], eax
call edi
push 0x10029a20
push dword [0x1002e108]
mov dword [0x1002e220], eax
call edi
push 0x10029a30
push dword [0x1002e108]
mov dword [0x1002e224], eax
call edi
push str.QueryServiceStatus
push dword [0x1002e108]
mov dword [0x1002e228], eax
call edi
push str.ControlService
push dword [0x1002e108]
mov dword [0x1002e22c], eax
call edi
push str.CreateServiceA
push dword [0x1002e108]
mov dword [0x1002e230], eax
call edi
push str.ChangeServiceConfig2A
push dword [0x1002e108]
mov dword [0x1002e234], eax
call edi
push str.DeleteService
push dword [0x1002e108]
mov dword [0x1002e238], eax
call edi
push 0x10029160
push dword [0x1002e108]
mov dword [0x1002e23c], eax
call edi
push str.DuplicateTokenEx
push dword [0x1002e108]
mov dword [0x1002e240], eax
call edi
push str.SetTokenInformation
push dword [0x1002e108]
mov dword [0x1002e244], eax
call edi
push str.CreateProcessAsUserA
push dword [0x1002e108]
mov dword [0x1002e248], eax
call edi
push 0x1002918c
push dword [0x1002e108]
mov dword [0x1002e24c], eax
call edi
push 0x10029174
push dword [0x1002e108]
mov dword [0x1002e250], eax
call edi
push str.Shell32.dll
mov dword [0x1002e254], eax
call esi
push str.SHGetSpecialFolderPathA
push eax
mov dword [0x1002e118], eax
call edi
push 0x10029b04
push dword [0x1002e118]
mov dword [0x1002e2a4], eax
call edi
push str.SHLWAPI.dll
mov dword [0x1002e2a8], eax
call esi
push str.PathRemoveBackslashA
push eax
mov dword [0x1002e11c], eax
call edi
push str.PathFileExistsA
push dword [0x1002e11c]
mov dword [0x1002e2ac], eax
call edi
push str.PathRemoveFileSpecA
push dword [0x1002e11c]
mov dword [0x1002e2b0], eax
call edi
push str.PathAddBackslashA
push dword [0x1002e11c]
mov dword [0x1002e2b4], eax
call edi
push str.PathStripPathA
push dword [0x1002e11c]
mov dword [0x1002e2b8], eax
call edi
push str.PathStripToRootA
push dword [0x1002e11c]
mov dword [0x1002e2bc], eax
call edi
push str.SHSetValueA
push dword [0x1002e11c]
mov dword [0x1002e2c0], eax
call edi
pop edi
mov dword [0x1002e2c4], eax
mov eax, 1
mov dword [0x1002e0fc], 1
pop esi
ret