Function at 0x1008c2b
Capabilities:
Create thread
Get common file path
Link many functions at runtime
Move file
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x1009c14
push edi
push eax
lea eax, [ebp - 0x81c]
push eax
mov dword [ebp - 0x840], ecx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x834], 3
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x830], ebx
call fcn.01002243
mov esi, eax
cmp esi, ebx
jl 0x1008d62
push dword [ebp - 0x81c]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call ebx
mov dword [0x102e5cc], eax
test eax, eax
jne 0x1008dd2
push 0x104
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1008cfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1008ced
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x1008cf4
mov esi, 0x80004005
push 0x1009bdc
jmp 0x1008f44
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.010023b5
mov esi, eax
test esi, esi
jge 0x1008d28
lea eax, [ebp - 0x414]
push eax
push 0x1009ba4
jmp 0x1008dcb
lea eax, [ebp - 0x81c]
push eax
call fcn.01009c4c
mov esi, eax
test esi, esi
jge 0x1008d4a
push dword [ebp - 0x81c]
push 0x1009b6c
jmp 0x1008dcb
push edi
push 0x1005950
lea eax, [ebp - 0x81c]
push eax
call fcn.01002243
mov esi, eax
test esi, esi
jge 0x1008d6c
push 0x1009b3c
jmp 0x1008f44
push dword [ebp - 0x81c]
call ebx
mov dword [0x102e5cc], eax
test eax, eax
jne 0x1008dd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x1008da7
push dword [ebp - 0x81c]
xor edi, edi
push 0x1009ae8
inc edi
push edi
push edi
call fcn.01007c51
add esp, 0x10
mov esi, edi
jmp 0x1009346
test eax, eax
jle 0x1008db5
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x1008dc0
mov esi, 0x80004005
push dword [ebp - 0x81c]
push 0x1009ac4
push 1
jmp 0x100917a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1009ab4
push eax
call esi
xor ebx, ebx
mov dword [0x102e5d0], eax
cmp eax, ebx
jne 0x1008e14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1008dff
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x1008e0a
mov esi, 0x80004005
push 0x1009a84
jmp 0x1008f44
push 0x1009a6c
push dword [0x102e5cc]
call esi
mov dword [0x102e5d4], eax
cmp eax, ebx
jne 0x1008e53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1008e3e
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x1008e49
mov esi, 0x80004005
push 0x1009a34
jmp 0x1008f44
push 0x1009a20
push dword [0x102e5cc]
call esi
mov dword [0x102e5d8], eax
cmp eax, ebx
jne 0x1008e92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1008e7d
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x1008e88
mov esi, 0x80004005
push 0x10099ec
jmp 0x1008f44
push 0x10094b4
push dword [0x102e5cc]
call esi
mov dword [0x102e5dc], eax
cmp eax, ebx
jne 0x1008ece
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1008ebc
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x1008ec7
mov esi, 0x80004005
push 0x1009480
jmp 0x1008f44
push 0x1009468
push dword [0x102e5cc]
call esi
mov dword [0x102e5e0], eax
cmp eax, ebx
jne 0x1008f0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1008ef8
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x1008f03
mov esi, 0x80004005
push 0x1009430
jmp 0x1008f44
push 0x1009424
push dword [0x102e5cc]
call esi
mov dword [0x102e5e4], eax
cmp eax, ebx
jne 0x1008f4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1008f34
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x1008f3f
mov esi, 0x80004005
push 0x10093f8
push 1
jmp 0x1009300
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x82c]
push eax
call fcn.01007cdd
xor edi, edi
mov esi, eax
inc edi
cmp esi, ebx
jge 0x1008f76
push 0x10099a0
push edi
push esi
call fcn.01007c51
add esp, 0xc
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x828], eax
cmp eax, ebx
jne 0x1009299
xor eax, eax
push 0x3fe
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x812]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x814]
push eax
push 0x1009958
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x1fe
ja 0x1009035
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.010023b5
mov esi, eax
cmp esi, ebx
jge 0x1008ff1
lea eax, [ebp - 0x814]
push eax
push 0x100992c
jmp 0x1009179
mov dword [ebp - 0x828], edi
push 0x9000
push dword [ebp - 0x818]
call dword [0x102e5d4]
test eax, eax
jne 0x1009313
push dword [ebp - 0x818]
push dword [ebp - 0x81c]
push 0x10098f4
mov esi, 0x8000ffff
push edi
push esi
call fcn.01007c51
add esp, 0x14
jmp 0x1009346
lea eax, [ebp - 0x828]
push eax
push 0x10098e0
push edi
push 0x1009858
mov ebx, 0x80000002
push ebx
call fcn.0100a45d
test eax, eax
jl 0x10092f5
cmp dword [ebp - 0x828], 0
jbe 0x10092f5
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x10090a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1009097
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x100909e
mov esi, 0x80004005
push 0x1009824
jmp 0x10092ff
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.010023b5
mov esi, eax
test esi, esi
jge 0x10090d2
lea eax, [ebp - 0x20c]
push eax
push 0x10097e8
jmp 0x1009179
lea eax, [ebp - 0x818]
push eax
call fcn.01009c4c
mov esi, eax
test esi, esi
jge 0x10090f4
push dword [ebp - 0x818]
push 0x10097ac
jmp 0x1009179
push 0x1009798
lea eax, [ebp - 0x818]
push eax
call fcn.01001e3a
mov esi, eax
test esi, esi
jge 0x1009118
push dword [ebp - 0x818]
push 0x1009760
jmp 0x1009179
push 0
push dword [ebp - 0x818]
call fcn.01009f94
push dword [ebp - 0x818]
mov esi, eax
test esi, esi
jge 0x1009138
push 0x100972c
jmp 0x1009179
lea eax, [ebp - 0x820]
push eax
call fcn.010023b5
mov esi, eax
test esi, esi
jge 0x1009157
push dword [ebp - 0x818]
push 0x1009704
jmp 0x1009179
push 0x10096f0
lea eax, [ebp - 0x818]
push eax
call fcn.01001e3a
mov esi, eax
test esi, esi
jge 0x1009188
push dword [ebp - 0x818]
push 0x10096c4
push edi
push esi
call fcn.01007c51
add esp, 0x10
jmp 0x1009346
and dword [ebp - 0x83c], 0
and dword [ebp - 0x838], 0
lea eax, [ebp - 0x83c]
push eax
push dword [ebp - 0x818]
call fcn.01009d2a
test eax, eax
jl 0x1009297
cmp dword [ebp - 0x838], 0
ja 0x10091c9
cmp dword [ebp - 0x83c], 0xf00000
jbe 0x1009297
lea eax, [ebp - 0x834]
push eax
push 0x10096b8
push edi
push 0x1009650
push ebx
call fcn.0100a45d
test eax, eax
jl 0x10091f2
cmp dword [ebp - 0x834], 2
je 0x1009297
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x844]
push eax
movzx eax, word [ebp - 0x846]
push eax
movzx eax, word [ebp - 0x848]
push eax
movzx eax, word [ebp - 0x84a]
push eax
movzx eax, word [ebp - 0x84e]
push eax
movzx eax, word [ebp - 0x850]
push eax
push dword [ebp - 0x820]
lea eax, [ebp - 0x824]
push 0x10095f8
push eax
call fcn.01002525
add esp, 0x24
test eax, eax
jl 0x10092de
push edi
push dword [ebp - 0x824]
push dword [ebp - 0x818]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1009297
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100927c
and eax, 0xffff
or eax, 0x80070000
push dword [ebp - 0x824]
push dword [ebp - 0x818]
push 0x10095b8
push edi
push eax
call fcn.01007c51
add esp, 0x14
xor ebx, ebx
cmp dword [ebp - 0x828], ebx
jbe 0x100930b
cmp dword [ebp - 0x82c], ebx
je 0x1008ff7
push dword [ebp - 0x818]
push 0xb000
push dword [ebp - 0x840]
call dword [0x102e5d0]
test eax, eax
jne 0x100930b
push dword [ebp - 0x818]
push dword [ebp - 0x81c]
push 0x1009578
jmp 0x1009021
push dword [ebp - 0x818]
push 0x1009510
push edi
push eax
call fcn.01007c51
add esp, 0x10
jmp 0x1009297
mov esi, 0x80004004
push 0x10094c8
push edi
push esi
call fcn.01007c51
add esp, 0xc
jmp 0x1009346
cmp dword [ebp - 0x82c], ebx
jne 0x1009346
cmp dword [ebp - 0x820], ebx
je 0x100935a
lea eax, [ebp - 0x854]
push eax
push ebx
push dword [ebp - 0x820]
push 0x10082c0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x830], eax
cmp eax, ebx
je 0x1009346
mov dword [ebp - 0x820], ebx
cmp dword [ebp - 0x820], 0
je 0x100935a
push dword [ebp - 0x820]
call fcn.01001c35
xor edi, edi
cmp dword [ebp - 0x824], edi
je 0x100936f
push dword [ebp - 0x824]
call fcn.01001c35
cmp dword [ebp - 0x818], edi
je 0x1009382
push dword [ebp - 0x818]
call fcn.01001c35
cmp dword [ebp - 0x81c], edi
je 0x1009395
push dword [ebp - 0x81c]
call fcn.01001c35
cmp esi, edi
jge 0x10093cf
push dword [0x102e5cc]
mov dword [0x102e5d0], edi
mov dword [0x102e5d4], edi
mov dword [0x102e5d8], edi
mov dword [0x102e5dc], edi
mov dword [0x102e5e0], edi
mov dword [0x102e5e4], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x102e5cc], edi
cmp dword [ebp - 0x830], edi
je 0x10093e3
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01004c85
leave
ret 8