Function at 0x100018a0
Capabilities:
Set environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x774
mov eax, dword [0x1001c078]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x10019430]
mov eax, dword [0x10019428]
mov ecx, dword [0x1001942c]
push 0x1f4
mov dword [ebp - 0x510], edx
mov dword [ebp - 0x518], eax
mov eax, dword [0x10019434]
mov dword [ebp - 0x514], ecx
mov ecx, dword [0x10019438]
lea edx, [ebp - 0x504]
push 0
push edx
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x508], ecx
call fcn.10006fd0
add esp, 0xc
push 0x76
push str.bitdbsoxzvpetrema
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x1c
lea eax, [ebp - 0x774]
push eax
push 0x1001e324
mov dword [ebp - 0x74c], 0xe58
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10001991
fild dword [0x1001e440]
dec dword [0x1001e440]
fmul qword [0x10019570]
fsub qword [0x10019568]
fstp dword [ebp - 0x740]
fld dword [ebp - 0x740]
call fcn.100109f0
fstp dword [ebp - 0x740]
fld dword [ebp - 0x740]
mov eax, dword [ebp - 0x770]
fmul dword [0x1001d084]
push 0x104
lea ecx, [ebp - 0x310]
push ecx
push eax
fstp dword [0x1001d084]
mov dword [0x1001e43c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push edi
push 0xffffffffffffffff
lea edx, [ebp - 0x310]
push edx
push 0x104
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x74c]
push ecx
call fcn.10003a0c
add esp, 0x14
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.IndexerVolumeGuid
lea ecx, [ebp - 0x310]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x748]
push edx
push 0x20019
push 0
push str.software_aHFMgxave
push 0x80000001
mov dword [ebp - 0x748], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001a1f
mov edi, dword [ebp - 0x748]
call fcn.10001040
mov dword [0x1001e42c], eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push 0
push 0x1001e328
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
and dword [0x1001e440], 0xfffffaf0
mov dword [0x1001e438], eax
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001a60
mov ecx, dword [0x1001e450]
sub eax, edx
mov dword [ecx], eax
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x310]
push eax
push str._s__S
lea ecx, [ebp - 0x720]
push 0x104
push ecx
call fcn.100023a8
lea edx, [ebp - 0x720]
push edx
push 0x10019494
call fcn.10003e33
mov eax, dword [ebp - 0x744]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x310]
push edx
call sym.xbnaanarx.dll_uwzjydwtstq
fld qword [0x10019528]
mov eax, dword [0x1001e440]
imul eax, eax, 0x5c0
add eax, 0x690c
or eax, 0xad
add eax, 0xf6
add esp, 0x28
mov dword [0x1001e440], eax
call fcn.100109f0
fstp dword [ebp - 0x740]
fld dword [ebp - 0x740]
fsub qword [0x10019560]
fstp qword [0x1001d098]
call sym.xbnaanarx.dll_ywwtlmdsqlgkv
mov eax, dword [0x1001e440]
lea ecx, [eax*4]
sub ecx, eax
mov eax, dword [ebp - 0x744]
neg ecx
mov esi, eax
sar esi, cl
mov dword [0x1001e440], esi
test esi, esi
jns 0x10001b47
add eax, 0x448
mov dword [ebp - 0x740], eax
fild dword [ebp - 0x740]
fdiv dword [0x1001d084]
jmp 0x10001b53
fld dword [0x1001d084]
fisub dword [0x1001e440]
fstp dword [0x1001d084]
fld qword [0x10019570]
call fcn.10010af0
fstp dword [ebp - 0x740]
fld dword [ebp - 0x740]
fstp dword [ebp - 0x744]
fld qword [0x10019558]
call fcn.10010af0
fstp dword [ebp - 0x740]
fld dword [ebp - 0x740]
fld dword [ebp - 0x744]
fcompp
fnstsw ax
test ah, 5
jp 0x10001bca
fld qword [0x10019528]
call fcn.10010af0
fstp dword [ebp - 0x744]
movzx ecx, byte [ebp - 0xb0]
fld dword [ebp - 0x744]
imul ecx, ecx, 0xffffecf7
add esi, ecx
mov dword [0x1001e440], esi
jmp 0x10001bf6
movzx edx, byte [ebp - 0xb0]
cmp edx, 0xffffff5e
jg 0x10001bfc
fld qword [0x10019550]
call fcn.10010af0
fstp dword [ebp - 0x744]
fld dword [ebp - 0x744]
fmul dword [0x1001d084]
fstp dword [0x1001d084]
push str.khqcxEEnQiL
push str.qcemctqlpafn
call edi
push 0x76
push eax
mov dword [0x1001e438], eax
call dword [sym.imp.USER32.dll_GetScrollPos]
mov eax, dword [0x1001e438]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [0x1001e320], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul eax, eax, 0x79
push 0x1001e430
push 2
mov dword [0x1001e324], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
test eax, eax
je 0x10001c65
mov ecx, dword [0x1001d090]
shr ecx, 2
not ecx
test cl, 1
jne 0x10001c65
call dword [0x1001d094]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test eax, eax
je 0x10001c7d
push 3
push 0x10001370
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 4
push 0x1000
push 0x104
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10001ca3
mov ecx, 0x41
mov esi, 0x1001e328
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, 0xf
lea esi, [ebp - 0x73c]
mov dword [0x1001e440], 0xfffffc94
mov dword [ebp - 0x728], edi
mov dword [ebp - 0x72c], 0
mov byte [ebp - 0x73c], 0
call fcn.10001db0
push 0xc
call fcn.100043db
mov edx, dword [ebp - 0x72c]
mov esi, eax
lea eax, [edx + edx]
push eax
call fcn.10002289
mov dword [esi + 8], eax
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [esi + 8]
add esp, 8
mov dword [ebp - 0x754], ecx
mov ecx, eax
mov dword [ebp - 0x758], ecx
mov ecx, dword [esi + 4]
pop edi
mov dword [ebp - 0x750], edx
mov dword [ebp - 0x750], edx
pop esi
test eax, eax
ja 0x10001d24
mov eax, 0xc00000f0
jmp 0x10001d36
add eax, 7
and eax, 0xfffffff8
add eax, 8
cmp ecx, eax
sbb eax, eax
and eax, 0xc0000022
mov dword [0x1001e320], eax
lea eax, [ebp - 0x518]
push eax
push str.egjnqjbyspj
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.jkklvytianj
call sym.xbnaanarx.dll_XiwklURcuQR
add esp, 4
cmp dword [ebp - 0x728], 0x10
mov byte [0x1001d08c], al
mov dword [0x1001e42c], 0x1001d08c
jb 0x10001d81
mov ecx, dword [ebp - 0x73c]
push ecx
call fcn.10002be9
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10002294
mov esp, ebp
pop ebp
ret