Function at 0x10019ec0
Capabilities:
Get common file path
Get hostname
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
push 0x1ed8
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.10015f70
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a54], eax
mov edx, dword [ebp + 8]
add edx, 0xa5c
push edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x1a54]
push eax
call fcn.10017050
add esp, 8
push 0x105
mov edx, dword [ebp + 8]
add edx, 0x1a58
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10019f53
xor eax, eax
je 0x10019f51
jmp 0x10019f4b
jmp 0x10019f70
push 0x5c
mov ecx, dword [ebp + 8]
add ecx, 0x1a58
push ecx
call fcn.10016900
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c64], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.10019290
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x104], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x104]
mov ecx, dword [eax]
push ecx
call fcn.10019440
add esp, 4
test eax, eax
je 0x10019fb5
mov edx, dword [ebp + 8]
mov dword [edx + 0x408], 3
xor eax, eax
je 0x10019fb3
jmp 0x10019fad
jmp 0x10019fe6
call fcn.10019330
test eax, eax
jle 0x10019fd3
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x408], 2
xor edx, edx
je 0x10019fd1
jmp 0x10019fcb
jmp 0x10019fe6
mov eax, dword [ebp + 8]
mov dword [eax + 0x408], 1
xor ecx, ecx
je 0x10019fe6
jmp 0x10019fe0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x40c], eax
xor ecx, ecx
je 0x10019ff8
jmp 0x10019ff2
mov dword [ebp - 0x18], 0x80
mov dword [ebp - 0x10], 0x80
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x308
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
add eax, 0x208
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x104]
mov eax, dword [edx]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x1001a06c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
push str.LookupAccountSidW___err__u
push 0x80
mov edx, dword [ebp + 8]
add edx, 0x308
push edx
call fcn.10016090
add esp, 0x10
xor eax, eax
je 0x1001a06c
jmp 0x1001a066
mov ecx, dword [ebp + 0x14]
and ecx, 2
je 0x1001a09e
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
xor eax, eax
je 0x1001a080
jmp 0x1001a07a
push 0x20a
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x410
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x1001a182
mov eax, dword [ebp + 0x14]
and eax, 4
je 0x1001a163
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
xor edx, edx
je 0x1001a0b6
jmp 0x1001a0b0
push 0x105
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x410
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2ff]
mov dword [0x100300c8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x307]
mov dword [0x100300cc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x30b]
mov dword [0x100300d0], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x313]
mov dword [0x100300d4], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x317]
mov dword [0x100300d8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x31f]
mov dword [0x100300dc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x323]
mov dword [0x100300e0], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x32b]
mov dword [0x100300e4], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x32f]
mov dword [0x100300e8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x337]
mov dword [0x100300ec], eax
jmp 0x1001a182
push 0x20a
mov ecx, dword [ebp + 8]
add ecx, 0x410
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
mov ecx, dword [ebp + 8]
add ecx, 0x410
push ecx
call fcn.10016900
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 0x61c], eax
push 0x40
push 0x5c
mov eax, dword [ebp + 8]
add eax, 0x410
push eax
call fcn.10016900
add esp, 8
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xc4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp + 8]
add edx, 0xc4
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov edx, dword [ebp + 8]
mov word [edx + eax*2 + 0xbc], cx
push 0x20
mov eax, dword [ebp + 8]
add eax, 0xa4
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xc4
push ecx
call fcn.10016c40
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x620
push edx
mov eax, dword [ebp + 8]
add eax, 0x410
push eax
call fcn.10016950
add esp, 8
push 0x105
mov ecx, dword [ebp + 8]
add ecx, 0x620
push ecx
mov edx, dword [ebp + 8]
add edx, 0x850
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x1002139c
mov eax, dword [ebp + 8]
add eax, 0x850
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp + 8]
add ecx, 0xc4
push ecx
mov edx, dword [ebp + 8]
add edx, 0x850
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x188c
call fcn.10016660
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x850
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x20]
push edx
call fcn.10016890
add esp, 4
mov eax, dword [ebp + 8]
add eax, 0xa5c
push eax
push 0xf
push 0xa
mov ecx, dword [ebp + 8]
add ecx, 0x82a
push ecx
call fcn.100169f0
add esp, 0x10
mov edx, dword [ebp + 8]
add edx, 0x1420
push edx
push 0
mov eax, dword [ebp + 8]
add eax, 0xa4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xa4
push ecx
call fcn.10017340
add esp, 0xc
push eax
call fcn.1001bd30
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.100194c0
add esp, 4
movsx edx, al
mov eax, dword [ebp + 8]
mov dword [eax + 0x1430], edx
xor ecx, ecx
je 0x1001a30e
jmp 0x1001a308
push 0x9c
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.10015f70
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 0x9c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp + 8]
mov dword [edx + 0x1dac], eax
call fcn.10019e00
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xa0], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
push eax
call fcn.10019e30
add esp, 4
mov ecx, dword [ebp + 8]
mov word [ecx + 0x9c], ax
xor edx, edx
je 0x1001a384
jmp 0x1001a37e
push 0x104
mov eax, dword [ebp + 8]
add eax, 0x1434
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1001a3a4
xor ecx, ecx
je 0x1001a3a2
jmp 0x1001a39c
jmp 0x1001a3aa
xor edx, edx
je 0x1001a3aa
jmp 0x1001a3a4
push 0x104
lea eax, [ebp - 0x230]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1001a3e0
xor ecx, ecx
je 0x1001a3cb
jmp 0x1001a3c5
mov edx, dword [ebp + 8]
add edx, 0x1434
push edx
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x209
mov eax, dword [ebp + 8]
add eax, 0x1848
push eax
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1001a442
xor ecx, ecx
je 0x1001a403
jmp 0x1001a3fd
push str.TEMP
mov edx, dword [ebp + 8]
add edx, 0x1434
push edx
push str._s_s
push 0x20a
mov eax, dword [ebp + 8]
add eax, 0x1848
push eax
call fcn.10016090
add esp, 0x14
mov ecx, dword [ebp + 8]
add ecx, 0x1848
push ecx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x20a
mov edx, dword [ebp + 8]
add edx, 0x163e
push edx
push 0x10028148
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1001a47b
xor eax, eax
je 0x1001a466
jmp 0x1001a460
mov ecx, dword [ebp + 8]
add ecx, 0x1848
push ecx
push 0x10028148
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x3f
lea edx, [ebp - 0x270]
push edx
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1001a4a9
xor eax, eax
je 0x1001a499
jmp 0x1001a493
push 0x10028138
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov dword [ebp - 0x274], 0x7f
lea ecx, [ebp - 0x274]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x1db0
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0xc40]
push eax
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x1420
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [ebp + 8]
add edx, 0x1420
push edx
call fcn.10017340
add esp, 0xc
push eax
call fcn.10017050
add esp, 8
push 0x20
mov eax, dword [ebp + 8]
add eax, 0x1c68
push eax
lea ecx, [ebp - 0xc40]
push ecx
call fcn.10017300
add esp, 0xc
xor edx, edx
je 0x1001a51f
jmp 0x1001a519
lea eax, [ebp - 0xc40]
push eax
push 0x1e
push 0x14
mov ecx, dword [ebp + 8]
add ecx, 0x1c88
push ecx
call fcn.100169f0
add esp, 0x10
xor edx, edx
je 0x1001a542
jmp 0x1001a53c
mov eax, dword [ebp + 0x14]
and eax, 1
jne 0x1001a55e
call fcn.10019af0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1ca8], eax
xor edx, edx
je 0x1001a55e
jmp 0x1001a558
mov eax, 1
mov esp, ebp
pop ebp
ret