Function at 0x1000125c
Capabilities:
Get common file path
Get file size
Get session user name
Read file on windows
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x10012038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x10]
push str.EwGfQKpjwrfBY
push str.DISPLAY
mov dword [ebp - 0x21c], eax
mov dword [0x10012d8c], 0xf
call dword [sym.imp.GDI32.dll_CreateDCA]
movzx ecx, byte [0x100140cc]
push ecx
push eax
mov dword [0x10013fc4], eax
call dword [sym.imp.GDI32.dll_SetTextColor]
movzx ecx, byte [0x100140cc]
sub ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0x103
inc ecx
mov dword [ebp - 0x218], ecx
push 6
pop eax
fild dword [ebp - 0x218]
sub eax, dword [0x100140d8]
fstp dword [0x10012d88]
imul eax, dword [0x100140d4]
fild dword [0x100140d8]
fsubr qword [0x1000f380]
fstp dword [ebp - 0x218]
fld dword [ebp - 0x218]
mov dword [0x100140dc], eax
call fcn.100071f0
lea esi, [ebp - 0xc]
fstp dword [ebp - 0x218]
fld dword [ebp - 0x218]
fchs
fld qword [0x1000f3d0]
fabs
fstp dword [ebp - 0x218]
fmul dword [ebp - 0x218]
fstp dword [0x10013fbc]
call fcn.1000117c
mov esi, 0x10013ec8
push esi
push 0xf4
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x10013eb8
push ebx
push str.LrkOhPkCJOg
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0x1c
lea eax, [ebp - 0x244]
push eax
push sym.amjuljdpvd.dll_fmxfwhbeosky
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [0x10014508], eax
cmp eax, ebx
je 0x1000139f
push 0x104
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0x10013fc8
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edi, [ebp - 0x110]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100013ca
push ebx
push ebx
push ebx
mov esi, str.IndexerVolumeGuid
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
mov eax, 0x80000000
push eax
push eax
movsd dword es:[edi], dword [esi]
push eax
push eax
movsd dword es:[edi], dword [esi]
push 0xcf0000
push str.vvIeuVxtixtO
movsw word es:[edi], word [esi]
push str.fgrztpvxiilvmxldc
push ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x10014500], eax
mov eax, dword [0x100140d4]
shl eax, 3
cdq
mov ecx, 0xe6f
idiv ecx
push 0x10013fc8
and dword [0x100140dc], edx
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
fld dword [0x10012d88]
fmul qword [0x1000f3c8]
push 0x20
fsub qword [0x1000f378]
fdivr qword [0x1000f3c0]
fstp dword [0x10013fbc]
call fcn.10002068
mov dword [ebp - 0x218], eax
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
stosb byte es:[edi], al
xor esi, esi
movzx edi, byte [esi + 0x1000f1dc]
mov eax, edi
and eax, 0x80000007
jns 0x10001473
dec eax
or eax, 0xfffffff8
inc eax
mov cl, 7
sub cl, al
mov eax, dword [ebp - 0x218]
shr edi, 3
mov al, byte [edi + eax]
shr al, cl
test al, 1
je 0x100014b0
mov eax, esi
cdq
push 7
pop ecx
and edx, ecx
add eax, edx
sar eax, 3
lea edi, [ebp + eax - 0xc]
mov eax, esi
and eax, 0x80000007
jns 0x100014a8
dec eax
or eax, 0xfffffff8
inc eax
sub ecx, eax
mov al, 1
shl al, cl
or byte [edi], al
inc esi
cmp esi, 0x38
jl 0x1000145e
push 0x1000f1dc
push 0x10013eb8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 0x10013fc8
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100014ce
mov ecx, dword [ebp - 0x21c]
sub eax, esi
mov dword [ecx], eax
movzx eax, byte [0x100140cd]
imul eax, eax, 0xffffffb2
xor eax, 0x65738
neg eax
mov dword [0x100140dc], eax
call dword [sym.imp.USER32.dll_CreateMenu]
mov esi, eax
movzx eax, byte [0x100140cc]
push ebx
push dword [0x10014500]
mov dword [0x10013fc0], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [0x10013eb0]
mov dword [ebp - 0x21c], eax
fild dword [ebp - 0x21c]
fstp dword [0x10012d88]
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x10013eb4]
push esi
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov eax, dword [0x10013fc0]
cmp eax, 0x43
je 0x1000156e
add eax, 0x30
mov dword [ebp - 0x21c], eax
fild dword [ebp - 0x21c]
jns 0x10001568
fadd dword [0x1000f3b8]
fstp dword [0x10012d88]
fld qword [0x1000f378]
call fcn.100073ec
call fcn.10007300
and eax, 0x80000007
jns 0x1000158a
dec eax
or eax, 0xfffffff8
inc eax
mov ecx, dword [0x100140d0]
shl ecx, 6
or eax, ecx
mov esi, 0x80
xor ecx, ecx
lea edx, [esi + 0x5c]
mov dword [0x100140d0], eax
mov dword [0x10013fc0], ecx
cmp eax, edx
jae 0x100015f4
movsx edi, byte [ecx + 0x10013eb8]
cmp edi, esi
jle 0x100015bc
inc ecx
jmp 0x100015e4
cmp edi, 0x800
jge 0x100015c9
add ecx, 2
jmp 0x100015e4
cmp dword [0x10013eb0], 0x10000
jge 0x100015da
add ecx, 3
jmp 0x100015e4
add ecx, 4
inc byte [ecx + 0x10013eb8]
dec eax
dec eax
cmp eax, edx
jb 0x100015ae
mov dword [0x100140d0], eax
mov dword [0x10013fc0], ecx
fild dword [0x10013fc0]
call fcn.100073ec
call fcn.10007300
push ebx
push esi
push 4
push ebx
push 3
mov dword [0x10012d8c], eax
push 0xc0000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x220]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x1000169d
fld qword [0x1000f3b0]
fld qword [0x1000f3a8]
call fcn.100072ea
fstp dword [ebp - 0x21c]
fld dword [ebp - 0x21c]
fcomp dword [0x1000f3a0]
fnstsw ax
test ah, 1
jne 0x10001663
mov dword [0x100140dc], 0xfffffd1f
push 0x12c
call fcn.100020bc
mov dword [esp], str.pssvvrmoek
push eax
mov dword [0x100144fc], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [0x100144fc]
call fcn.10002082
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002073
leave
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
fld qword [0x1000f398]
mov edi, eax
fabs
mov dword [0x100144f8], edi
mov dword [0x10013fc0], 0x7e
call fcn.10007300
mov dword [0x10013eb0], eax
cmp edi, 0xffffffff
je 0x1000168c
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push str.pGISufRYd
mov dword [0x100144f4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x10013fc0
mov esi, 0x104
push esi
push 0x10013eb8
push eax
mov dword [0x10014504], eax
call sym.amjuljdpvd.dll_pxfcrcqwzuoqt
add esp, 0x10
push 0x10013eb4
push dword [0x10014504]
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov eax, dword [0x10013eb4]
and eax, 1
push 0x10
mov dword [0x10013fc0], eax
call fcn.100023b8
mov edi, dword [ebp - 0x228]
neg eax
sbb eax, eax
neg eax
mov dword [0x10014508], eax
mov eax, dword [0x100144f8]
pop ecx
mov dword [edi], ebx
mov ecx, dword [edi]
push ebx
lea edx, [ebp - 0x224]
push edx
sub eax, ecx
add ecx, dword [0x100144f4]
push eax
mov eax, dword [ebp - 0x220]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10001783
mov eax, dword [ebp - 0x224]
add dword [edi], eax
mov eax, dword [0x100144f8]
cmp eax, dword [edi]
jne 0x1000174a
jmp 0x10001791
mov eax, dword [edi]
cmp eax, dword [0x100144f8]
jne 0x1000168c
push dword [0x10014500]
call dword [sym.imp.USER32.dll_IsWindow]
push 3
sub eax, 0x30
pop ecx
mov dword [0x10012d8c], eax
mov eax, dword [0x100140d4]
push 9
sub ecx, eax
pop edx
add ecx, ecx
sub edx, eax
cmp edx, ecx
jl 0x100017c2
add eax, 0xfffffffa
mov dword [0x100140dc], eax
movzx ecx, byte [0x10014527]
movzx eax, byte [0x10012b77]
push 0x10014528
push ecx
movzx ecx, byte [0x10014526]
push ecx
movzx ecx, byte [0x10014525]
push ecx
movzx ecx, byte [0x10014524]
push ecx
movzx ecx, byte [0x10014522]
push eax
push ecx
movzx ecx, byte [0x10014521]
push ecx
push eax
push dword [0x10013eb4]
mov dword [0x1001451c], 0x190
push dword [0x10014518]
mov byte [0x10014520], bl
push dword [0x10014514]
push 5
push 0xa
call dword [sym.imp.GDI32.dll_CreateFontA]
push dword [0x10014500]
mov dword [ebp - 0x21c], eax
call dword [sym.imp.USER32.dll_GetMenu]
lea ecx, [ebp - 0x21c]
push ecx
push 1
push 0x108
push 1
push eax
call dword [sym.imp.USER32.dll_ModifyMenuA]
mov eax, dword [0x100140d4]
lea eax, [eax + eax + 1]
test eax, eax
jne 0x1000186e
mov dword [0x100140dc], 8
jmp 0x1000187a
fld dword [0x1000f394]
fstp dword [0x10013fbc]
push 0xc
call fcn.100026c5
push esi
mov edi, eax
call fcn.10002068
pop ecx
pop ecx
lea ecx, [edi + 4]
push ecx
push eax
mov dword [edi], eax
mov dword [ecx], 0x1d
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x100018df
mov eax, str.EoEnldjSRcGSksskv
mov dword [edi + 8], eax
mov edi, dword [edi]
mov dword [ebp - 0x220], eax
jmp 0x100018db
mov eax, dword [ebp - 0x220]
movzx eax, byte [eax]
push eax
call fcn.1000264a
mov esi, eax
movzx eax, byte [edi]
push eax
call fcn.1000264a
pop ecx
pop ecx
cmp eax, esi
jne 0x100018df
inc edi
inc dword [ebp - 0x220]
cmp byte [edi], bl
jne 0x100018b4
push 0x10013fc8
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x214]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
push 0x1000f254
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
inc eax
jmp 0x1000168e