Function at 0x104f317
Capabilities:
Create thread
Get common file path
Link many functions at runtime
Move file
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x10667c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x1019234
push edi
push eax
lea eax, [ebp - 0x81c]
push eax
mov dword [ebp - 0x840], ecx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x834], 3
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x830], ebx
call fcn.0105cca6
mov esi, eax
cmp esi, ebx
jl 0x104f44e
push dword [ebp - 0x81c]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call ebx
mov dword [0x1066e94], eax
test eax, eax
jne 0x104f4be
push 0x104
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x104f3ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x104f3d9
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x104f3e0
mov esi, 0x80004005
push 0x10191fc
jmp 0x104f630
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.0105ce90
mov esi, eax
test esi, esi
jge 0x104f414
lea eax, [ebp - 0x414]
push eax
push 0x10191c4
jmp 0x104f4b7
lea eax, [ebp - 0x81c]
push eax
call fcn.0105cf1a
mov esi, eax
test esi, esi
jge 0x104f436
push dword [ebp - 0x81c]
push 0x101918c
jmp 0x104f4b7
push edi
push 0x1018a90
lea eax, [ebp - 0x81c]
push eax
call fcn.0105cca6
mov esi, eax
test esi, esi
jge 0x104f458
push 0x101915c
jmp 0x104f630
push dword [ebp - 0x81c]
call ebx
mov dword [0x1066e94], eax
test eax, eax
jne 0x104f4be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x104f493
push dword [ebp - 0x81c]
xor edi, edi
push 0x1019108
inc edi
push edi
push edi
call fcn.0104e862
add esp, 0x10
mov esi, edi
jmp 0x104fa32
test eax, eax
jle 0x104f4a1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x104f4ac
mov esi, 0x80004005
push dword [ebp - 0x81c]
push 0x10190e4
push 1
jmp 0x104f866
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10190d4
push eax
call esi
xor ebx, ebx
mov dword [0x1066e98], eax
cmp eax, ebx
jne 0x104f500
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x104f4eb
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x104f4f6
mov esi, 0x80004005
push 0x10190a4
jmp 0x104f630
push 0x101908c
push dword [0x1066e94]
call esi
mov dword [0x1066e9c], eax
cmp eax, ebx
jne 0x104f53f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x104f52a
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x104f535
mov esi, 0x80004005
push 0x1019054
jmp 0x104f630
push 0x1019040
push dword [0x1066e94]
call esi
mov dword [0x1066ea0], eax
cmp eax, ebx
jne 0x104f57e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x104f569
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x104f574
mov esi, 0x80004005
push 0x101900c
jmp 0x104f630
push 0x101856c
push dword [0x1066e94]
call esi
mov dword [0x1066ea4], eax
cmp eax, ebx
jne 0x104f5ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x104f5a8
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x104f5b3
mov esi, 0x80004005
push 0x1018538
jmp 0x104f630
push 0x1018520
push dword [0x1066e94]
call esi
mov dword [0x1066ea8], eax
cmp eax, ebx
jne 0x104f5f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x104f5e4
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x104f5ef
mov esi, 0x80004005
push 0x10184e8
jmp 0x104f630
push 0x10184dc
push dword [0x1066e94]
call esi
mov dword [0x1066eac], eax
cmp eax, ebx
jne 0x104f637
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x104f620
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov esi, eax
jl 0x104f62b
mov esi, 0x80004005
push 0x10184b0
push 1
jmp 0x104f9ec
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x82c]
push eax
call fcn.0104e8ee
xor edi, edi
mov esi, eax
inc edi
cmp esi, ebx
jge 0x104f662
push 0x1018fc0
push edi
push esi
call fcn.0104e862
add esp, 0xc
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x828], eax
cmp eax, ebx
jne 0x104f985
xor eax, eax
push 0x3fe
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x812]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x814]
push eax
push 0x1018f78
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x1fe
ja 0x104f721
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.0105ce90
mov esi, eax
cmp esi, ebx
jge 0x104f6dd
lea eax, [ebp - 0x814]
push eax
push 0x1018f50
jmp 0x104f865
mov dword [ebp - 0x828], edi
push 0x9000
push dword [ebp - 0x818]
call dword [0x1066e9c]
test eax, eax
jne 0x104f9ff
push dword [ebp - 0x818]
push dword [ebp - 0x81c]
push 0x1018f18
mov esi, 0x8000ffff
push edi
push esi
call fcn.0104e862
add esp, 0x14
jmp 0x104fa32
lea eax, [ebp - 0x828]
push eax
push 0x1018f04
push edi
push 0x1003900
mov ebx, 0x80000002
push ebx
call fcn.0105c908
test eax, eax
jl 0x104f9e1
cmp dword [ebp - 0x828], 0
jbe 0x104f9e1
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x104f794
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x104f783
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x104f78a
mov esi, 0x80004005
push 0x1018ed4
jmp 0x104f9eb
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.0105ce90
mov esi, eax
test esi, esi
jge 0x104f7be
lea eax, [ebp - 0x20c]
push eax
push 0x1018e98
jmp 0x104f865
lea eax, [ebp - 0x818]
push eax
call fcn.0105cf1a
mov esi, eax
test esi, esi
jge 0x104f7e0
push dword [ebp - 0x818]
push 0x1018e5c
jmp 0x104f865
push 0x1018e48
lea eax, [ebp - 0x818]
push eax
call fcn.0105cbd0
mov esi, eax
test esi, esi
jge 0x104f804
push dword [ebp - 0x818]
push 0x1018e10
jmp 0x104f865
push 0
push dword [ebp - 0x818]
call fcn.0105d11d
push dword [ebp - 0x818]
mov esi, eax
test esi, esi
jge 0x104f824
push 0x1018ddc
jmp 0x104f865
lea eax, [ebp - 0x820]
push eax
call fcn.0105ce90
mov esi, eax
test esi, esi
jge 0x104f843
push dword [ebp - 0x818]
push 0x1018db4
jmp 0x104f865
push 0x1018da0
lea eax, [ebp - 0x818]
push eax
call fcn.0105cbd0
mov esi, eax
test esi, esi
jge 0x104f874
push dword [ebp - 0x818]
push 0x1018d74
push edi
push esi
call fcn.0104e862
add esp, 0x10
jmp 0x104fa32
and dword [ebp - 0x83c], 0
and dword [ebp - 0x838], 0
lea eax, [ebp - 0x83c]
push eax
push dword [ebp - 0x818]
call fcn.0105cfc8
test eax, eax
jl 0x104f983
cmp dword [ebp - 0x838], 0
ja 0x104f8b5
cmp dword [ebp - 0x83c], 0xf00000
jbe 0x104f983
lea eax, [ebp - 0x834]
push eax
push 0x1018d68
push edi
push 0x1018d00
push ebx
call fcn.0105c908
test eax, eax
jl 0x104f8de
cmp dword [ebp - 0x834], 2
je 0x104f983
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x844]
push eax
movzx eax, word [ebp - 0x846]
push eax
movzx eax, word [ebp - 0x848]
push eax
movzx eax, word [ebp - 0x84a]
push eax
movzx eax, word [ebp - 0x84e]
push eax
movzx eax, word [ebp - 0x850]
push eax
push dword [ebp - 0x820]
lea eax, [ebp - 0x824]
push 0x1018ca8
push eax
call fcn.0105cf86
add esp, 0x24
test eax, eax
jl 0x104f9ca
push edi
push dword [ebp - 0x824]
push dword [ebp - 0x818]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x104f983
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x104f968
and eax, 0xffff
or eax, 0x80070000
push dword [ebp - 0x824]
push dword [ebp - 0x818]
push 0x1018c68
push edi
push eax
call fcn.0104e862
add esp, 0x14
xor ebx, ebx
cmp dword [ebp - 0x828], ebx
jbe 0x104f9f7
cmp dword [ebp - 0x82c], ebx
je 0x104f6e3
push dword [ebp - 0x818]
push 0xb000
push dword [ebp - 0x840]
call dword [0x1066e98]
test eax, eax
jne 0x104f9f7
push dword [ebp - 0x818]
push dword [ebp - 0x81c]
push 0x1018c28
jmp 0x104f70d
push dword [ebp - 0x818]
push 0x1018bc0
push edi
push eax
call fcn.0104e862
add esp, 0x10
jmp 0x104f983
mov esi, 0x80004004
push 0x1018b78
push edi
push esi
call fcn.0104e862
add esp, 0xc
jmp 0x104fa32
cmp dword [ebp - 0x82c], ebx
jne 0x104fa32
cmp dword [ebp - 0x820], ebx
je 0x104fa46
lea eax, [ebp - 0x854]
push eax
push ebx
push dword [ebp - 0x820]
push 0x104ed5d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x830], eax
cmp eax, ebx
je 0x104fa32
mov dword [ebp - 0x820], ebx
cmp dword [ebp - 0x820], 0
je 0x104fa46
push dword [ebp - 0x820]
call fcn.0105ca47
xor edi, edi
cmp dword [ebp - 0x824], edi
je 0x104fa5b
push dword [ebp - 0x824]
call fcn.0105ca47
cmp dword [ebp - 0x818], edi
je 0x104fa6e
push dword [ebp - 0x818]
call fcn.0105ca47
cmp dword [ebp - 0x81c], edi
je 0x104fa81
push dword [ebp - 0x81c]
call fcn.0105ca47
cmp esi, edi
jge 0x104fabb
push dword [0x1066e94]
mov dword [0x1066e98], edi
mov dword [0x1066e9c], edi
mov dword [0x1066ea0], edi
mov dword [0x1066ea4], edi
mov dword [0x1066ea8], edi
mov dword [0x1066eac], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1066e94], edi
cmp dword [ebp - 0x830], edi
je 0x104facf
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0104dc4f
leave
ret 8