Function at 0x1000136c
Capabilities:
Get common file path
Get hostname
Get session user name
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov dword [ebp - 0x41c], 0x100
lea eax, [ebp - 0x400]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x105
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x105
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10001406
xor eax, eax
jmp 0x10001698
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x410], ecx
mov eax, dword [ebp - 0x410]
cmp dword [eax], 0x4550
je 0x1000142d
xor eax, eax
jmp 0x10001698
push 4
push 0x2000
mov eax, dword [ebp - 0x410]
push dword [eax + 0x50]
mov eax, dword [ebp - 0x410]
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x10001479
push 4
push 0x2000
mov eax, dword [ebp - 0x410]
push dword [eax + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x10001489
xor eax, eax
jmp 0x10001698
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov ecx, dword [ebp - 0x42c]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x404]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x404]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x404]
and dword [eax + 0x10], 0
push 0x105
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 4
push 0x1000
mov eax, dword [ebp - 0x410]
push dword [eax + 0x50]
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
mov eax, dword [ebp - 0x410]
push dword [eax + 0x54]
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x418]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x410]
add eax, dword [ecx + 0x54]
push eax
push dword [ebp - 0x418]
push dword [ebp - 0x428]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 0x428]
add ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x404]
mov dword [eax], ecx
mov eax, dword [ebp - 0x404]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x42c]
mov dword [eax + 0x34], ecx
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x105
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x105
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push dword [ebp - 0x404]
push dword [ebp - 0x410]
push dword [ebp + 8]
call fcn.1000169a
add esp, 0xc
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x42c]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x40c], ecx
cmp dword [ebp - 0x40c], 0
je 0x100015fb
push dword [ebp - 0x40c]
push dword [ebp - 0x404]
call fcn.10001915
pop ecx
pop ecx
push dword [ebp - 0x404]
call fcn.100019e1
pop ecx
test eax, eax
jne 0x10001610
jmp 0x10001696
push dword [ebp - 0x404]
call fcn.100017d1
pop ecx
mov eax, dword [ebp - 0x404]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1000167a
mov eax, dword [ebp - 0x404]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x42c]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x408], ecx
cmp dword [ebp - 0x408], 0
jne 0x1000164c
jmp 0x10001694
push 0
push 1
push dword [0x10002220]
call dword [ebp - 0x408]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jne 0x1000166d
jmp 0x10001692
mov eax, dword [ebp - 0x404]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 0x404]
jmp 0x10001698
push dword [ebp - 0x404]
call fcn.10001c43
pop ecx
xor eax, eax
jmp 0x10001698
jmp 0x10001682
jmp 0x10001682
jmp 0x10001682
leave
ret