Function at 0x1018353
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9b8
mov eax, dword [0x103e010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x99d]
mov dword [ebp - 0x9b0], ebx
mov dword [ebp - 0x9a8], ebx
mov dword [ebp - 0x9a4], ebx
call fcn.010233a3
lea ecx, [ebp - 0x99c]
call fcn.01019280
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x9ac], ebx
call esi
mov dword [ebp - 0x9b8], eax
call fcn.01017f49
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
call esi
mov dword [0x103ec5c], eax
mov eax, dword [section..data]
test byte [eax + 0x1c], 4
je 0x1018424
cmp eax, section..data
je 0x10183ef
push 0x1003860
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
mov eax, dword [section..data]
xor esi, esi
cmp dword [ebp + 8], ebx
jle 0x1018424
cmp eax, section..data
je 0x101841e
test byte [eax + 0x1c], 4
je 0x101841e
push dword [edi + esi*4]
push esi
push 0x1003860
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008b5a
mov eax, dword [section..data]
inc esi
cmp esi, dword [ebp + 8]
jl 0x10183f6
mov esi, 0x104
push esi
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
jne 0x1018483
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101844f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x1018b51
cmp eax, esi
jbe 0x10184bd
mov esi, 0x8007007a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b55
test byte [eax + 0x1c], 1
je 0x1018b55
push 0x1003860
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
jmp 0x1018b55
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x220]
push eax
push 0x1003a48
call esi
test eax, eax
jne 0x1018512
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10184e9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x22
jmp 0x1018473
push ebx
push 0x1003a28
call esi
push ebx
push 0x1003a00
call esi
push ebx
push 0x10039cc
call esi
push ebx
push 0x1003994
call esi
push ebx
push 0x1003974
call esi
push ebx
push 0x1003944
call esi
push ebx
push 0x1003910
call esi
lea ecx, [ebp - 0x99d]
call fcn.010233f4
test eax, eax
je 0x101858d
xor esi, esi
inc esi
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b5b
test byte [eax + 0x1c], 2
je 0x1018b5b
push 0x1003860
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
jmp 0x1018b5b
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x103ec40], eax
cmp eax, ebx
jne 0x10185da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10185b1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x24
jmp 0x1018473
xor esi, esi
cmp dword [ebp + 8], ebx
jle 0x1018620
mov ebx, dword [sym.imp.KERNEL32.dll_CompareStringW]
mov eax, dword [edi + esi*4]
push 0xffffffffffffffff
push 0x1003900
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call ebx
cmp eax, 2
jne 0x1018611
mov eax, dword [ebp + 8]
dec eax
cmp esi, eax
jge 0x101864b
mov eax, dword [edi + esi*4 + 4]
mov dword [ebp - 0x9ac], eax
inc esi
cmp esi, dword [ebp + 8]
jl 0x10185e7
cmp dword [ebp - 0x9ac], 0
jne 0x1018676
mov esi, 0x80070057
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b55
test byte [eax + 0x1c], 1
je 0x1018b55
push 0x1003860
push 0x26
jmp 0x10184ad
mov esi, 0x80070057
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b55
test byte [eax + 0x1c], 1
je 0x1018b55
push 0x1003860
push 0x25
jmp 0x10184ad
lea eax, [ebp - 0x9a8]
push eax
push dword [ebp - 0x9ac]
call fcn.01017da7
mov esi, eax
test esi, esi
jge 0x10186b5
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x27
jmp 0x1018473
mov esi, dword [ebp - 0x9a8]
push dword [ebp - 0x9a8]
mov ecx, 0xd4
lea edi, [ebp - 0x570]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [ebp - 0x9a8], 0
lea eax, [ebp - 0x570]
push eax
call fcn.010180c0
mov esi, eax
test esi, esi
jge 0x1018714
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x28
jmp 0x1018473
mov eax, dword [ebp - 0x3e8]
or eax, dword [ebp - 0x3e4]
je 0x10187c7
push 0xa
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x3e8]
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jne 0x1018779
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1018750
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x29
jmp 0x1018473
push 0xffffffffffffffff
push 0x10038f4
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
xor edi, edi
inc edi
push edi
push 0x7f
call ebx
cmp eax, 2
jne 0x10187ca
push 0
push 0x9001
call sub.ntdll.dll_ShipAssert
mov esi, edi
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b5b
test byte [eax + 0x1c], 4
je 0x1018b5b
push 0x1003860
push 0x2a
jmp 0x101857d
xor edi, edi
inc edi
xor ebx, ebx
cmp dword [ebp - 0x2cc], ebx
je 0x101884f
push dword [ebp - 0x3e8]
call dword [sym.imp.USER32.dll_IsHungAppWindow]
test eax, eax
jne 0x101880f
mov esi, 0x80070005
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b55
test byte [eax + 0x1c], 1
je 0x1018b55
push 0x1003860
push 0x2b
jmp 0x10184ad
push dword [ebp - 0x2cc]
push dword [ebp - 0x3e8]
call sub.USER32.dll_CheckWindowThreadDesktop
test eax, eax
jne 0x101884f
mov esi, 0x80070005
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b55
test byte [eax + 0x1c], 1
je 0x1018b55
push 0x1003860
push 0x2c
jmp 0x10184ad
push dword [ebp - 0x3e8]
lea ecx, [ebp - 0x99c]
push dword [ebp - 0x3ec]
push dword [ebp - 0x3f0]
call fcn.0101b0f5
mov esi, eax
cmp esi, ebx
jge 0x1018899
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x2d
jmp 0x1018473
call fcn.01017bd1
mov eax, dword [ebp - 0x3f8]
sub eax, ebx
je 0x10188eb
dec eax
jne 0x1018969
push 0x6c8
mov esi, edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x10188cf
mov ecx, eax
call fcn.01020001
mov dword [ebp - 0x9a4], eax
jmp 0x10188d5
mov dword [ebp - 0x9a4], ebx
push edi
push 0x351
push dword [0x103ec44]
call sub.ntdll.dll_WinSqmSetDWORD
jmp 0x101896b
push dword [ebp - 0x3f0]
call fcn.01017c64
test eax, eax
je 0x1018933
mov esi, edi
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b5b
test byte [eax + 0x1c], 4
je 0x1018b5b
push dword [ebp - 0x3f0]
push 0x1003860
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x1018b5b
mov esi, dword [ebp - 0x3f4]
push 0x2c18
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x1018957
mov ecx, eax
call fcn.0101e05d
mov dword [ebp - 0x9a4], eax
jmp 0x101895d
mov dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9b0], edi
push ebx
jmp 0x10188d6
mov esi, ebx
push dword [ebp - 0x3e0]
push 0xcf2
push dword [0x103ec44]
call sub.ntdll.dll_WinSqmSetDWORD
push esi
push 0x356
push dword [0x103ec44]
call sub.ntdll.dll_WinSqmSetDWORD
push esi
push 0x355
push dword [0x103ec44]
call sub.ntdll.dll_WinSqmSetDWORD
cmp dword [ebp - 0x9a4], ebx
jne 0x10189d9
mov eax, dword [section..data]
cmp eax, section..data
je 0x10189cf
test byte [eax + 0x1c], 1
je 0x10189cf
push 0x1003860
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
mov esi, 0x8007000e
jmp 0x1018b55
push dword [ebp - 0x9b8]
mov ecx, dword [ebp - 0x9a4]
call fcn.0101beba
push dword [ebp - 0x9ac]
mov ecx, dword [ebp - 0x9a4]
lea eax, [ebp - 0x570]
push eax
push esi
lea eax, [ebp - 0x99c]
push eax
call fcn.0101d1b8
mov esi, eax
cmp esi, ebx
jge 0x1018a37
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x30
jmp 0x1018473
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
cmp eax, ebx
je 0x1018ac4
cmp eax, 0x8000
jne 0x1018b03
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x1018a7b
test byte [eax + 0x1c], 4
je 0x1018a7b
push 0x1003860
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
push 0x20
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x1018b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1018a9e
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, edi
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x32
jmp 0x1018473
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1018ad8
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x1018b08
test byte [eax + 0x1c], 1
je 0x1018b08
push ecx
push 0x1003860
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x1018b08
mov edi, section..data
mov eax, dword [ebp - 0x2b0]
or eax, dword [ebp - 0x2ac]
je 0x1018b22
push dword [ebp - 0x2b0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0x9a4]
call fcn.0101c8b1
mov esi, eax
cmp esi, ebx
jge 0x1018b4f
mov eax, dword [section..data]
cmp eax, edi
je 0x1018b51
test byte [eax + 0x1c], 1
je 0x1018b51
push esi
push 0x1003860
push 0x34
jmp 0x1018473
xor esi, esi
test esi, esi
jge 0x1018b5b
push esi
call fcn.01017d0e
mov ecx, 0x103ec5c
call fcn.0100f423
push eax
push 0x353
push dword [0x103ec44]
call sub.ntdll.dll_WinSqmSetDWORD
push dword [0x103ec44]
call sub.ntdll.dll_WinSqmEndSession
xor edi, edi
mov dword [0x103ec44], edi
cmp dword [ebp - 0x9a8], edi
je 0x1018b9d
push dword [ebp - 0x9a8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x9b0], edi
je 0x1018bb8
cmp dword [ebp - 0x9a4], edi
je 0x1018bc9
mov eax, dword [0x103ec58]
cmp eax, edi
jge 0x1018bb8
mov esi, eax
mov ecx, dword [ebp - 0x9a4]
cmp ecx, edi
je 0x1018bc9
mov eax, dword [ecx]
push 1
call dword [eax + 0x40]
mov eax, dword [section..data]
cmp eax, section..data
je 0x1018bee
test byte [eax + 0x1c], 4
je 0x1018bee
push esi
push 0x1003860
push 0x35
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
lea ecx, [ebp - 0x99c]
call fcn.0101b0da
lea ecx, [ebp - 0x99d]
call fcn.01022380
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010084d5
leave
ret 8