Function at 0x10001a80
Capabilities:
Create process on windows
Get disk size
Get file size
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
mov eax, dword [0x1001a078]
xor eax, esp
mov dword [esp + 0x460], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 4
mov dword [esp + 0x14], eax
call fcn.10002f36
mov ebx, eax
add esp, 4
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], 0x1137
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x20]
push ecx
push 0xe0fc
mov dword [esp + 0x24], 0xe0fc
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0x1001c134
push sym.zpfmzfygpg.dll_qjuoekplsp
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x10001b68
push 0x208
call fcn.10002669
add esp, 4
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
mov dword [esp + 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [esp + 0x158]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10001b51
mov ecx, dword [esi]
mov dword [esp + 0x158], ecx
mov edx, dword [esi + 4]
mov dword [esp + 0x15c], edx
mov eax, dword [esi + 8]
mov dword [esp + 0x160], eax
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x164], ecx
mov edx, dword [0x1001c134]
push 0x104
push 0x1001c140
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [0x1001c138]
mov ecx, edi
imul ecx, ecx, 0x38d
and ecx, 0x80000003
jns 0x10001b83
dec ecx
or ecx, 0xfffffffc
inc ecx
mov esi, dword [0x1001c024]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
add ecx, edx
and edi, 0x80000003
jns 0x10001ba9
dec edi
or edi, 0xfffffffc
inc edi
fld dword [0x1001b2a8]
sub ecx, edi
fld qword [0x10014638]
sub ecx, esi
fld st(0)
mov dword [0x1001b2ac], ecx
fsubrp st(2)
fldz
fucomp st(2)
fnstsw ax
fstp st(1)
test ah, 0x44
jnp 0x10001bed
fstp st(0)
fld qword [0x10014670]
call fcn.1000f760
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fstp dword [0x1001b2a8]
jmp 0x10001c2d
sub ecx, esi
je 0x10001c2b
movzx ecx, byte [0x1001c34c]
lea eax, [esi + esi*2]
lea edx, [ecx + eax*2]
mov dword [esp + 0xc], edx
fiadd dword [esp + 0xc]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
call fcn.1000f760
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fmul qword [0x10014668]
fchs
fstp dword [0x1001b2a8]
jmp 0x10001c2d
fstp st(0)
push 0x1001c140
lea eax, [esp + 0x54]
push 0x10014578
push eax
call fcn.10002683
add esp, 0xc
push 0x1001c140
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
push str.IndexerVolumeGuid
push 0x1001c140
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, ah
movzx edx, al
mov dword [0x1001b2b0], eax
lea eax, [esp + 0x50]
add ecx, edx
push eax
mov dword [0x1001c130], ecx
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
lea eax, [esp + 0x50]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001c90
push 0
sub eax, edx
push 0
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
fld dword [0x10014660]
cmp dword [0x1001c020], 0
fstp dword [0x1001b2a8]
mov dword [0x1001b2b0], eax
jne 0x10001ccb
mov dword [0x1001c020], 1
jmp 0x10001cd5
mov dword [0x1001c354], 0
call fcn.10001190
push str.ycjidtlerwswdgig
push str.utvohejtax
mov dword [0x1001c020], eax
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov eax, dword [0x1001c138]
lea ecx, [eax + eax*2]
mov dword [0x1001b2ac], ecx
test ecx, ecx
jle 0x10001d18
inc ecx
cdq
idiv ecx
neg edx
mov dword [0x1001b2ac], edx
mov ecx, dword [esp + 0x14]
push 0x104
push 0x1001c028
push 0x8d
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x1001c028
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov esi, dword [0x1001c138]
lea edx, [esi + esi*8]
add edx, edx
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
add edx, edx
mov eax, esi
add edx, edx
fstp dword [0x1001c12c]
and eax, 0x80000001
jns 0x10001d75
dec eax
or eax, 0xfffffffe
inc eax
fld qword [0x10014638]
sub edx, eax
fld qword [0x10014658]
add edx, 9
mov dword [0x1001b2ac], edx
call fcn.1000f5ca
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x10001dee
fld qword [0x10014638]
call fcn.1000f760
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld st(0)
fchs
fstp dword [esp + 0x18]
fld qword [0x10014638]
fxch st(1)
call fcn.1000f5ca
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [esp + 0x18]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x10001dee
mov ecx, 0x38d
sub ecx, esi
mov dword [0x1001b2ac], ecx
lea edx, [esp + 0x50]
push edx
push 0x1001c140
push str.obj_S__s
lea eax, [esp + 0x36c]
push 0x104
push eax
call fcn.10002d71
lea ecx, [esp + 0x374]
add esp, 0x14
push ecx
call fcn.1000e0e5
add esp, 4
push 0
push 0
push 0
push str.tjmtbjzbkijmeyHHIHzznArg.bmp
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 0x10]
push ebx
lea edx, [esp + 0x54]
push edx
push eax
call sym.zpfmzfygpg.dll_vlggkebnztp
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1001c130
push 0x1001b2b0
push 0x100145f8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push 0x1001c13c
push 0x104
push 0x1001c028
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
mov dword [0x1001c020], eax
mov eax, dword [0x1001c138]
lea edx, [eax + eax*4]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fsubr qword [0x10014650]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
call fcn.1000f3a0
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp dword [esp + 0x18]
fild dword [0x1001c138]
fsubr qword [0x10014648]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
call fcn.1000f4d0
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
push 2
fmul dword [esp + 0x1c]
fstp dword [0x1001b2a8]
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov dword [0x1001b2b0], eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.COMDLG32.dll_ChooseColorA]
cmp eax, 1
jne 0x10001f3d
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edx, dword [esp + 0x30]
mov dword [0x1001c35c], edx
lea eax, [esp + 0x48]
push eax
call fcn.10001100
fild dword [0x1001c138]
mov ecx, dword [0x1001c138]
mov esi, dword [0x1001b2ac]
fsubr qword [0x10014638]
imul esi, esi, 0x5c0
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov edx, 0xffffdca5
sub esi, 0x24d6e
add eax, 9
sub edx, ecx
or esi, eax
or edx, 0x36
add esi, edx
add esp, 4
mov dword [0x1001b2ac], esi
call fcn.1000f630
mov ecx, dword [esp + 0x46c]
fstp dword [esp + 0x14]
pop edi
fld dword [esp + 0x10]
pop esi
fchs
pop ebx
fld qword [0x10014640]
xor ecx, esp
fabs
xor eax, eax
fstp dword [esp + 8]
fmul dword [esp + 8]
fstp dword [0x1001b2a8]
call fcn.10002674
mov esp, ebp
pop ebp
ret