Function at 0x10001990
Capabilities:
Allocate or change rwx memory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx edx, word [0x100ce9b4]
push ebx
mov bl, byte [0x100ce986]
movzx eax, bl
push esi
mov dword [ebp - 4], eax
add eax, 0x3646
push edi
mov edi, ecx
movzx esi, bl
movzx ecx, ax
movzx eax, word [0x100ce99a]
sub ecx, edi
sub edx, eax
cmp edx, 0x346
jne 0x100019dd
lea ecx, [ecx*2 - 0x6a40]
lea edx, [esi + 0x9d55]
add edx, ecx
jmp 0x100019f3
mov edx, dword [0x100ce9b0]
add ecx, 0xffff95c9
add ecx, esi
lea eax, [ecx + ecx]
sub edx, eax
sub edx, 8
mov eax, dword [0x100ee7f0]
lea ecx, [ecx + ecx*2]
mov dword [0x100df7c0], eax
mov ebx, 0x13
shl ecx, 5
mov eax, ebx
sub eax, ecx
mov dword [0x100ce9b0], edx
movzx eax, ax
mov ecx, edi
lea eax, [eax + eax*2]
shl eax, 5
sub ecx, eax
mov eax, dword [ebp - 4]
cmp word [0x100ce99c], ax
ja 0x10001a45
lea eax, [ecx - 0x4c]
mov word [0x100ce990], cx
sub edx, esi
lea ecx, [esi*2 - 2]
add eax, edx
mov dword [0x100ce9b0], eax
lea ecx, [ecx + ecx*2]
mov eax, ebx
shl ecx, 5
push 0x712
sub eax, ecx
push 0x100ee7f8
mov word [0x100ce984], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
movzx eax, byte [0x100ce986]
mov dword [ebp - 4], eax
lea ecx, [eax + eax*2]
cdq
shl ecx, 5
sub ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [0x100ce9f4], edx
ja 0x10001aba
jb 0x10001a8f
cmp dword [0x100ce9f0], eax
ja 0x10001aba
mov eax, dword [0x100ce9b0]
mov ecx, dword [ebp - 4]
add eax, 0xffffffb4
mov dword [0x100ce9c0], esi
sub esi, ecx
add eax, esi
mov dword [0x100ce9c4], 0
mov dword [0x100ce9b0], eax
lea esi, [ecx*2 - 2]
push 0x100df7c4
push 0x40
push 0x5064
push dword [0x100df7c0]
mov al, bl
sub al, byte [0x100ce986]
add al, byte [0x100ce984]
push 0xffffffffffffffff
mov byte [0x100ce986], al
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edx, dword [0x100ce9b0]
lea ecx, [ebx - 0x2e]
add cl, byte [0x100ce986]
mov byte [0x100ce986], cl
cmp edx, esi
jb 0x10001b20
movzx eax, cl
sub word [0x100ce996], ax
mov eax, 0xfffffff0
movzx ecx, cl
add ecx, esi
add ecx, ecx
sub eax, ecx
add edx, eax
mov dword [0x100ce9b0], edx
movzx ecx, word [0x100ce9b4]
mov edx, esi
movzx eax, word [0x100ce99a]
movzx ebx, di
sub ecx, eax
sub edx, ebx
add edx, 0x5c
cmp ecx, 0x346
jne 0x10001b59
lea ecx, [edx*2 - 0x6a2e]
movzx eax, cx
lea esi, [edi + 0x9d55]
add esi, eax
movzx eax, cx
jmp 0x10001b72
add edx, 0xffff95d2
mov eax, 0xfffffff8
add edx, ebx
movzx ecx, dx
add ecx, ecx
sub eax, ecx
add esi, eax
movzx eax, dx
push 0x712
push 0x100df1b0
push str.Child
mov word [0x100ce984], ax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
movzx eax, word [0x100ce99a]
movzx ecx, word [0x100ce9b4]
sub ecx, eax
mov eax, 0x6a2e
cmp ecx, 0x346
jne 0x10001bc4
mov cx, word [0x100ce984]
lea esi, [edi + 0x9d55]
add cx, cx
sub cx, ax
movzx eax, cx
add esi, eax
jmp 0x10001bdf
mov cx, bx
mov edx, 0xfffffff8
add cx, word [0x100ce984]
sub cx, ax
movzx eax, cx
add eax, eax
sub edx, eax
add esi, edx
movzx eax, cx
mov word [0x100ce984], ax
push dword [0x100df7c0]
movzx eax, word [0x100ce99c]
cmp eax, edi
ja 0x10001c0d
movzx eax, word [0x100ce984]
mov word [0x100ce990], ax
sub eax, edi
add eax, 0xffffffb4
add esi, eax
mov eax, esi
sub eax, ebx
add eax, 2
movzx eax, ax
cmp esi, eax
jb 0x10001c2f
sub word [0x100ce996], bx
add eax, edi
add eax, eax
mov ecx, 0xfffffff0
sub ecx, eax
add esi, ecx
sub esi, ebx
mov byte [0x100ce986], 2
add esi, 2
mov word [0x100ce984], si
ret