Function at 0x10001680
Capabilities:
Set environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c4
mov eax, dword [0x10019138]
xor eax, esp
mov dword [esp + 0x5c0], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0x1d
mov esi, str.mtipdskwlibrdnoeajyikddmyjpjldbhddqrmqdblojhcsqeffuuutyee
lea edi, [esp + 0x1b8]
rep movsd dword es:[edi], dword [esi]
push 0x194
xor edi, edi
lea ecx, [esp + 0x230]
push edi
push ecx
mov dword [esp + 0x1c], eax
call fcn.10007b70
add esp, 0xc
push edi
lea edx, [esp + 0x1bc]
push edx
push 0x104
push 0x100133c4
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x1a
mov dword [0x1001b1e4], eax
mov dword [esp + 0x24], 0x10013290
mov dword [esp + 0x20], 0xa
call fcn.100022b8
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, edi
je 0x10001720
lea esi, [esp + 0x1c]
call fcn.100011e0
mov dword [0x10019f78], eax
push 0x1c
lea eax, [esp + 0x30]
push eax
push 0x10019f28
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
push 0x104
push ecx
push eax
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [0x10019f6c]
mov dword [esp + 0x18], str.jscDKdCGDecMKbs_PQWYuaLJMooJ
cmp ebx, 0xfffffa71
je 0x1000177d
push str.jscDKdCGDecMKbs_PQWYuaLJMooJ
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + 1]
mov dword [0x10019f6c], ebx
mov dword [0x1001b2ec], 1
test dword [0x1001b2ec], 0x2000
je 0x100017d5
cmp ebx, edi
je 0x100017ce
mov edx, dword [esp + 0x18]
movzx edi, word [edx]
dec ebx
xor esi, esi
mov ecx, 7
lea esp, [esp]
lea eax, [ecx + esi]
cdq
sub eax, edx
sar eax, 1
movzx edx, word [eax*2 + 0x10013210]
cmp dx, di
jae 0x100017ba
lea esi, [eax + 1]
jmp 0x100017bf
jbe 0x100017c3
lea ecx, [eax - 1]
cmp esi, ecx
jle 0x100017a0
add dword [esp + 0x18], 2
test ebx, ebx
jne 0x1000178d
xor edi, edi
dec ebx
mov dword [0x10019f6c], ebx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push 0x104
push esi
push 0x1001b1e8
mov dword [0x1001b304], eax
mov byte [0x1001b1e8], 0
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
push str.k9vDAhB0rzPwYgFj0m
call fcn.100027b2
imul eax, dword [0x1001b1e4]
add esp, 4
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x10001820
fadd qword [0x10013550]
fstp qword [esp + 0x10]
fld qword [0x10013548]
fld qword [0x10013540]
call fcn.1000b70a
fsubr qword [esp + 0x10]
call fcn.1000b880
fld dword [0x1001b2fc]
fld st(0)
mov dword [0x1001b2ec], eax
fsub dword [0x10019f64]
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x10001885
fmul qword [0x10013530]
fdiv qword [0x10013528]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
call fcn.1000b770
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp dword [0x10019f64]
jmp 0x100018c0
mov ecx, dword [0x10019f68]
add ecx, 0xfffffa2c
je 0x100018be
fadd qword [0x10013520]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
call fcn.1000b770
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fmul qword [0x10013518]
fchs
fstp dword [0x10019f64]
jmp 0x100018c0
fstp st(0)
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.IndexerVolumeGuid
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 0xa4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
movzx eax, byte [esp + 0xa6]
cdq
mov ecx, 0x3c
idiv ecx
mov eax, dword [esp + 0xac]
push 0x1001b1e8
sub eax, edx
mov dword [0x10019f6c], eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
push 0x1001b1e8
mov dword [0x10019f68], 0xffffff2a
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x1001b318]
push 0x1001b1e8
push esi
push str._S__S
lea edx, [esp + 0x3cc]
mov dword [ecx], eax
call fcn.10001000
add esp, 0xc
lea edx, [esp + 0x3c0]
push edx
push 0x10013428
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x21
call fcn.100022b8
add esp, 4
push 0xa
push eax
mov dword [str.ajXxEcXWMkERTshAzwNtZZU], eax
mov eax, dword [0x1001b2ec]
push eax
call fcn.1000b26b
add esp, 0xc
push 0x58
lea ecx, [esp + 0x4c]
push edi
push ecx
mov byte [esp + 0xbc], 0
call fcn.10007b70
add esp, 0xc
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x80], 0x1800
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp eax, 1
jne 0x100019c2
push 0x80
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push 0x10013444
push edi
mov dword [0x10019f68], 0xffff8246
call fcn.100025b1
mov esi, eax
lea ecx, [esi + esi + 2]
add esp, 0xc
push ecx
mov dword [0x1001b2ec], esi
call fcn.10002708
add esp, 4
cmp eax, edi
je 0x10001a2e
inc esi
push esi
push str.sKztCLJZokmYfSAv
push eax
call fcn.100025b1
add esp, 0xc
mov dword [0x10019f78], eax
cmp eax, 0xffffffff
mov eax, 1
jne 0x10001a33
mov dword [0x1001b2ec], edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5c0]
xor ecx, esp
call fcn.100022c3
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [esp + 0x5cc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100022c3
mov esp, ebp
pop ebp
ret