Function at 0x1001573
Capabilities:
Create process on windows
Query environment variable
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xaec
mov eax, dword [0x1006084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x10022d0
xor esi, esi
push edi
mov dword [ebp - 0xa20], esi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x10015bc
push 0x10022b4
push edi
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x100252c
push 0x104
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0xa20], 1
push 0x10016cc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10015e7
lea edi, [ebp - 0x210]
cmp dword [ebp + 0x14], esi
jne 0x10019c6
mov ax, word [ebp + 0x18]
mov word [ebp - 0xa44], ax
xor eax, eax
mov word [ebp - 0xa42], ax
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0xa74]
push eax
mov eax, dword [ebp + 0xc]
push esi
push esi
xor ebx, ebx
push 0x20
inc ebx
neg eax
sbb eax, eax
push esi
not eax
push esi
and eax, edi
push esi
push eax
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, edi
push eax
mov dword [ebp - 0xa1c], ebx
mov dword [ebp - 0xa74], 0x44
mov dword [ebp - 0xa70], edi
mov dword [ebp - 0xa68], edi
mov dword [ebp - 0xa6c], esi
mov dword [ebp - 0xa58], esi
mov dword [ebp - 0xa5c], esi
mov dword [ebp - 0xa60], esi
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa48], ebx
mov dword [ebp - 0xa40], esi
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_CreateProcessW]
mov dword [ebp - 0xa14], eax
cmp eax, esi
je 0x10034d9
cmp dword [ebp + 0x10], esi
jne 0x100369e
push dword [ebp - 0xa30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
cmp dword [ebp - 0xa1c], esi
je 0x10016b3
push dword [ebp - 0xa2c]
call edi
mov eax, dword [ebp - 0xa14]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100148d
leave
ret 0x18
cmp dword [0x100608c], esi
jne 0x1001a00
push 0x10023d4
mov dword [ebp - 0xa14], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
je 0x10016b3
push 0x10023ec
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100608c], eax
cmp eax, esi
je 0x10016b3
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call ebx
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xa14], eax
cmp eax, esi
je 0x10034b3
push edi
push edi
call ebx
inc eax
push eax
push dword [ebp - 0xa14]
call fcn.010021a9
cmp dword [ebp + 0xc], esi
jne 0x1001a54
push dword [ebp - 0xa14]
call fcn.0100254e
mov ebx, eax
cmp ebx, esi
je 0x1001a56
cmp word [ebx], si
jne 0x10034ba
mov ebx, esi
push dword [ebp - 0xa14]
call fcn.01002401
push 0x3c
pop edi
push edi
lea eax, [ebp - 0xab0]
push esi
push eax
call sub.msvcrt.dll_memset
movzx eax, word [ebp + 0x18]
mov dword [ebp - 0xa94], eax
add esp, 0xc
mov dword [ebp - 0xab0], edi
mov edi, dword [ebp - 0xa14]
lea eax, [ebp - 0xab0]
push eax
mov dword [ebp - 0xaac], 0x640
mov dword [ebp - 0xaa0], edi
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xaa4], 0x1001ae4
call dword [0x100608c]
mov dword [ebp - 0xa14], eax
cmp eax, esi
je 0x1001ad7
cmp dword [ebp + 0x10], esi
jne 0x10034c6
push dword [ebp - 0xa78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10016b3
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
jmp 0x10015d7
xor eax, eax
jmp 0x10016b9
xor eax, eax
mov word [ebx], ax
inc ebx
inc ebx
jmp 0x1001a56
push 0xffffffffffffffff
push dword [ebp - 0xa78]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1001acb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x100360d
cmp dword [ebp + 0x1c], esi
je 0x100360d
mov dword [ebp - 0xa1c], esi
cmp dword [0x100608c], esi
jne 0x1003533
push 0x10023d4
mov dword [ebp - 0xa14], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
je 0x100361c
push 0x10023ec
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100608c], eax
cmp eax, esi
je 0x100361c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call ebx
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xa14], eax
cmp eax, esi
je 0x10034b3
push edi
push edi
call ebx
inc eax
push eax
push dword [ebp - 0xa14]
call fcn.010021a9
cmp dword [ebp + 0xc], esi
jne 0x100358c
push dword [ebp - 0xa14]
call fcn.0100254e
mov ebx, eax
cmp ebx, esi
je 0x100358e
cmp word [ebx], si
je 0x100358c
xor eax, eax
mov word [ebx], ax
inc ebx
inc ebx
jmp 0x100358e
mov ebx, esi
push dword [ebp - 0xa14]
call fcn.01002401
push 0x3c
pop edi
push edi
lea eax, [ebp - 0xaec]
push esi
push eax
call sub.msvcrt.dll_memset
movzx eax, word [ebp + 0x18]
mov dword [ebp - 0xad0], eax
add esp, 0xc
mov dword [ebp - 0xaec], edi
mov edi, dword [ebp - 0xa14]
lea eax, [ebp - 0xaec]
push eax
mov dword [ebp - 0xae8], 0x640
mov dword [ebp - 0xadc], edi
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xae0], 0x10036b4
call dword [0x100608c]
mov dword [ebp - 0xa14], eax
cmp eax, esi
je 0x1003606
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xa30], eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xa14], esi
jne 0x100168c
xor ebx, ebx
inc ebx
call fcn.010047e9
test eax, eax
jne 0x10016b3
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp ecx, dword [eax + 0x1d4]
je 0x10016b3
cmp dword [ebp - 0xa20], ebx
jne 0x10016b3
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0x200
push ebx
lea eax, [ebp - 0x610]
push eax
push 0x648
push esi
call edi
push ebx
lea eax, [ebp - 0xa10]
push eax
push 0x647
push esi
call edi
push esi
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0xa10]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x10016b3
push 0xffffffffffffffff
push dword [ebp - 0xa30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1001695