Function at 0x1009e5b
Capabilities:
Check os version
Get common file path
Query environment variable
Read file on windows
Shutdown system
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x3c8
push ebx
xor ebx, ebx
push esi
xor eax, eax
cmp dword [ebp + 0x78], ebx
push edi
mov dword [ebp + 0x58], 0x10
je 0x1009e86
cmp dword [ebp + 0x74], ebx
setne al
add eax, 0x80020016
jmp 0x1009e91
cmp dword [ebp + 0x74], ebx
setne al
add eax, 0x80020010
mov dword [ebp + 0x5c], eax
push 0x104
lea eax, [ebp - 0x368]
push eax
push 0x10021e4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1009fd4
push ebx
push ebx
push 3
push ebx
push 7
push 0xc0000000
lea eax, [ebp - 0x368]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0x78], eax
je 0x1009fd4
push ebx
lea ecx, [ebp + 0x74]
push ecx
mov esi, 0x210
push esi
lea ecx, [ebp - 0x264]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009fb3
cmp dword [ebp + 0x74], esi
jne 0x1009fb3
cmp dword [ebp - 0x264], 0x6e776453
jne 0x1009fb3
mov edx, 0x10000
cmp dword [ebp - 0x260], edx
jb 0x1009fb3
xor eax, eax
cmp dword [ebp + 0x68], ebx
mov ecx, 0x84
lea edi, [ebp - 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebp - 0x264], 0x6e776453
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x258], eax
je 0x1009f57
or dword [ebp - 0x25c], 1
cmp dword [ebp + 0x6c], ebx
je 0x1009f63
or dword [ebp - 0x25c], 2
cmp dword [ebp + 0x70], ebx
je 0x1009f6f
or dword [ebp - 0x25c], 0x10
push 0x1ff
push dword [ebp + 0x7c]
lea eax, [ebp - 0x254]
push eax
call sub.ntdll.dll_strncpy
add esp, 0xc
push ebx
push ebx
push ebx
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp + 0x74]
push eax
push esi
lea eax, [ebp - 0x264]
push eax
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp edi, ebx
je 0x1009fb5
cmp dword [ebp + 0x74], esi
je 0x1009fb5
xor edi, edi
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x1009fd4
push 0x10021bc
call fcn.01008343
xor eax, eax
inc eax
jmp 0x100a104
push 0x10021a8
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
cmp esi, ebx
je 0x100a000
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100a017
cmp dword [ebp + 0x70], ebx
je 0x100a00c
push 0xea60
jmp 0x100a011
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x48]
push eax
push ebx
push 0x13
call fcn.01007b24
test eax, eax
je 0x100a104
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x94
call esi
cmp dword [ebp - 0x50], 4
jbe 0x100a055
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x9c
call esi
cmp dword [ebp - 0x50], 5
jne 0x100a080
cmp dword [ebp - 0x4c], 1
jb 0x100a080
mov eax, dword [0x1010334]
cmp eax, ebx
je 0x100a07c
push dword [ebp + 0x5c]
push dword [ebp + 0x68]
push dword [ebp + 0x6c]
push ebx
push dword [ebp + 0x7c]
push ebx
call eax
jmp 0x100a08f
xor esi, esi
jmp 0x100a091
push dword [ebp + 0x68]
push dword [ebp + 0x6c]
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
mov esi, eax
cmp esi, ebx
jne 0x100a0f9
test byte [ebp + 0x44], 0x40
je 0x100a0f9
push 0xfffa
mov edi, 0x10339e0
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100a0f9
push 0x5c
push edi
call sub.ntdll.dll_strchr
pop ecx
pop ecx
push ebx
push 0x2000000
push 3
push ebx
push 7
push 0xc0000000
push edi
mov byte [eax + 1], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100a0f9
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x100a0f9
push 1
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
mov esi, eax
lea eax, [ebp + 0x48]
push eax
call fcn.01007ba8
mov eax, esi
pop edi
pop esi
pop ebx
add ebp, 0x60
leave
ret 0x18