Function at 0x659e8660
Capabilities:
Create thread
Get common file path
Link many functions at runtime

Disassembly:
push edi
push esi
push ebx
sub esp, 0x130
cmp dword [esp + 0x144], 1
je 0x659e8684
add esp, 0x130
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
mov eax, dword [esp + 0x140]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
mov ecx, 0x41
sub esp, 4
lea edi, [esp + 0x2c]
lea ebx, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, ebx
sub esp, 8
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x659e86be
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
sbb edx, 3
mov dword [edx], 0x7265765c
mov dword [edx + 4], 0x6e6f6973
mov dword [edx + 8], 0x6c6c642e
mov byte [edx + 0xc], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 4
mov esi, eax
mov dword [esp + 4], str.GetFileVersionInfoA
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x65aa1328], eax
mov dword [esp + 4], str.GetFileVersionInfoByHandle
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1330], eax
mov dword [esp + 4], str.GetFileVersionInfoExA
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1338], eax
mov dword [esp + 4], str.GetFileVersionInfoExW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1308], eax
mov dword [esp + 4], str.GetFileVersionInfoSizeA
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1314], eax
mov dword [esp + 4], str.GetFileVersionInfoSizeExA
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1334], eax
mov dword [esp + 4], str.GetFileVersionInfoSizeExW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa130c], eax
mov dword [esp + 4], str.GetFileVersionInfoSizeW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa133c], eax
mov dword [esp + 4], str.GetFileVersionInfoW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa132c], eax
mov dword [esp + 4], str.VerFindFileA
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1340], eax
mov dword [esp + 4], str.VerFindFileW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1320], eax
mov dword [esp + 4], str.VerInstallFileA
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1318], eax
mov dword [esp + 4], str.VerInstallFileW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa131c], eax
mov dword [esp + 4], str.VerLanguageNameA
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1344], eax
mov dword [esp + 4], str.VerLanguageNameW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1310], eax
mov dword [esp + 4], str.VerQueryValueA
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1324], eax
mov dword [esp + 4], str.VerQueryValueW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [0x65aa1348], eax
mov dword [esp], 0xc
call sub.msvcrt.dll_malloc
mov edi, dword [esp + 0x140]
mov edx, dword [esp + 0x148]
mov dword [eax + 4], 1
mov dword [eax], edi
mov dword [eax + 8], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x659e8640
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
jmp 0x659e8673