Function at 0x1002192
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Get session user name
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10d8
call fcn.01002ed0
mov eax, dword [0x1005150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
push ebx
xor edi, edi
push ebx
inc edi
push edi
push ebx
mov dword [ebp - 0x104c], ebx
mov dword [ebp - 0x1044], edi
mov dword [ebp - 0x1040], ebx
mov dword [ebp - 0x1050], ebx
mov dword [ebp - 0x1048], ebx
mov dword [ebp - 0x1058], ebx
mov dword [ebp - 0x105c], ebx
mov dword [ebp - 0x103c], ebx
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1060], ebx
mov dword [ebp - 0x1054], ebx
mov dword [ebp - 0x1038], ebx
mov dword [ebp - 0x1028], ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x208
lea eax, [ebp - 0x610]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, 0x402
push esi
lea eax, [ebp - 0xc14]
push ebx
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x408]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x200
lea eax, [ebp - 0x810]
push ebx
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x1018]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
add esp, 0x3c
push ebx
mov dword [0x1005174], eax
call fcn.01001743
call fcn.010017b2
cmp eax, ebx
jne 0x10029ff
lea eax, [ebp - 0x1020]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x102c], eax
cmp eax, ebx
je 0x10029fa
cmp dword [ebp - 0x1020], edi
mov dword [ebp - 0x1030], edi
mov dword [ebp - 0x1024], edi
jle 0x1002577
xor edx, edx
mov dword [ebp - 0x1034], edx
lea esi, [ebp - 0x1094]
mov eax, dword [ebp - 0x102c]
mov ecx, dword [ebp - 0x1024]
mov eax, dword [eax + ecx*4]
cmp word [eax], 0x2f
jne 0x1002641
movzx ecx, word [eax + 2]
cmp ecx, 0x65
jg 0x100231e
je 0x10022f2
sub ecx, 0x45
je 0x10022f2
sub ecx, 9
jmp 0x1002321
xor eax, eax
cmp edx, ebx
jle 0x1002311
mov ecx, dword [ebp + eax*4 - 0x1094]
cmp dword [ecx*4 + section..data], ebx
je 0x1002698
inc eax
cmp eax, edx
jl 0x10022f8
mov dword [esi], ebx
mov dword [ebp - 0x1050], edi
jmp 0x1002555
sub ecx, 0x6e
je 0x10024d8
dec ecx
dec ecx
je 0x10024b1
sub ecx, 3
je 0x100241c
dec ecx
je 0x10023b3
dec ecx
jne 0x1002a71
cmp edx, ebx
jle 0x1002363
mov edx, dword [ebp + ecx*4 - 0x1094]
cmp dword [edx*4 + 0x10050b4], ebx
je 0x1002698
inc ecx
cmp ecx, dword [ebp - 0x1034]
jl 0x1002346
mov dword [esi], 5
lea edi, [eax + 4]
jmp 0x1002379
cmp ax, bx
je 0x1002a71
inc edi
inc edi
movzx eax, word [edi]
cmp ax, 0x3a
jne 0x100236e
inc edi
inc edi
push edi
push 0x201
lea eax, [ebp - 0x408]
push eax
call fcn.01001465
test eax, eax
jl 0x10029b1
mov dword [ebp - 0x1038], edi
xor edi, edi
mov dword [ebp - 0x105c], 1
inc edi
jmp 0x1002411
xor ecx, ecx
cmp edx, ebx
jle 0x10023d6
mov edx, dword [ebp + ecx*4 - 0x1094]
cmp dword [edx*4 + 0x1005090], ebx
je 0x1002698
inc ecx
cmp ecx, dword [ebp - 0x1034]
jl 0x10023b9
mov dword [esi], 4
add eax, 4
jmp 0x10023ec
cmp cx, bx
je 0x1002a71
inc eax
inc eax
movzx ecx, word [eax]
cmp cx, 0x3a
jne 0x10023e1
push 0x10
add eax, 2
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1048], edi
mov edx, dword [ebp - 0x1034]
jmp 0x1002555
movzx eax, word [eax + 4]
cmp eax, 0x41
je 0x100247a
cmp eax, 0x48
je 0x100265b
cmp eax, 0x4d
je 0x100244a
cmp eax, 0x61
je 0x100247a
cmp eax, 0x68
je 0x100265b
cmp eax, 0x6d
jne 0x1002555
xor eax, eax
cmp edx, ebx
jle 0x1002469
mov ecx, dword [ebp + eax*4 - 0x1094]
cmp dword [ecx*4 + 0x10050d8], ebx
je 0x1002698
inc eax
cmp eax, edx
jl 0x1002450
or dword [ebp - 0x101c], edi
mov dword [esi], 6
jmp 0x1002555
xor eax, eax
cmp edx, ebx
jle 0x1002499
mov ecx, dword [ebp + eax*4 - 0x1094]
cmp dword [ecx*4 + 0x1005120], ebx
je 0x1002698
inc eax
cmp eax, edx
jl 0x1002480
or dword [ebp - 0x101c], 2
mov dword [esi], 8
mov dword [ebp - 0x103c], edi
jmp 0x1002555
xor eax, eax
cmp edx, ebx
jle 0x10024d0
mov ecx, dword [ebp + eax*4 - 0x1094]
cmp dword [ecx*4 + 0x100506c], ebx
je 0x1002698
inc eax
cmp eax, edx
jl 0x10024b7
mov dword [esi], 3
jmp 0x1002555
movzx eax, word [eax + 4]
cmp eax, 0x45
je 0x1002522
cmp eax, 0x4f
je 0x10024f4
cmp eax, 0x65
je 0x1002522
cmp eax, 0x6f
jne 0x1002a71
xor eax, eax
cmp edx, ebx
jle 0x1002513
mov ecx, dword [ebp + eax*4 - 0x1094]
cmp dword [ecx*4 + 0x1005048], ebx
je 0x1002698
inc eax
cmp eax, edx
jl 0x10024fa
and dword [ebp - 0x1030], 0xfffffffe
mov dword [esi], 2
jmp 0x1002555
xor eax, eax
cmp edx, ebx
jle 0x1002541
mov ecx, dword [ebp + eax*4 - 0x1094]
cmp dword [ecx*4 + 0x1005024], ebx
je 0x1002698
inc eax
cmp eax, edx
jl 0x1002528
mov eax, dword [ebp - 0x1030]
and eax, 0xfffffffe
or eax, 2
mov dword [esi], edi
mov dword [ebp - 0x1030], eax
inc dword [ebp - 0x1024]
mov eax, dword [ebp - 0x1024]
inc edx
add esi, 4
cmp eax, dword [ebp - 0x1020]
mov dword [ebp - 0x1034], edx
jl 0x10022c4
mov edi, dword [ebp - 0x101c]
and edi, 1
je 0x10025a3
lea eax, [ebp - 0x408]
push eax
push 0x104
lea eax, [ebp - 0x610]
push eax
call fcn.01001465
xor eax, eax
mov word [ebp - 0x408], ax
cmp dword [ebp - 0x1058], ebx
je 0x1002a71
cmp dword [ebp - 0x105c], ebx
jne 0x10025c7
cmp dword [ebp - 0x1048], ebx
jne 0x10025c7
cmp edi, ebx
je 0x1002a71
push 0x44
pop esi
push esi
lea eax, [ebp - 0x10d8]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x1070]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp - 0x1048], 1
stosd dword es:[edi], eax
mov dword [ebp - 0x10d8], esi
jne 0x10027b3
lea eax, [ebp - 0x103c]
push eax
lea eax, [ebp - 0x408]
push eax
push 2
mov dword [ebp - 0x103c], 0x201
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x10029fa
push 0x208
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x10026a4
push 8
jmp 0x10029b3
mov eax, dword [ebp - 0x1020]
dec eax
cmp ecx, eax
jne 0x1002a71
mov dword [ebp - 0x1058], edi
jmp 0x1002577
mov eax, dword [ebp - 0x1024]
xor ecx, ecx
dec eax
cmp eax, ebx
jle 0x100267d
mov edx, dword [ebp + ecx*4 - 0x1094]
cmp dword [edx*4 + 0x10050fc], ebx
je 0x1002698
inc ecx
cmp ecx, eax
jl 0x1002668
mov eax, dword [ebp - 0x1024]
mov dword [ebp + eax*4 - 0x1098], 7
call fcn.01001f85
jmp 0x1002a69
call fcn.010019e9
mov eax, edi
jmp 0x1002a9e
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x10029fa
mov edi, dword [ebp - 0x102c]
lea eax, [ebp - 0x1028]
push eax
push 1
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp - 0x1020]
push dword [edi + eax*4 - 4]
call fcn.01001930
test eax, eax
je 0x10029fa
mov eax, dword [ebp - 0x1028]
mov dword [ebp - 0x10cc], eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x10d8]
push eax
mov eax, dword [ebp - 0x1020]
push esi
push dword [edi + eax*4 - 4]
push ebx
push dword [ebp - 0x104c]
call fcn.01001961
mov edi, eax
cmp edi, ebx
jne 0x1002a3f
mov dword [ebp - 0x1038], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x101c], eax
cmp eax, ebx
jne 0x1002776
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - 0x1070]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x101c], ebx
jne 0x1002776
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - 0x106c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x101c], ebx
jne 0x1002776
mov dword [ebp - 0x101c], 0x80004005
mov eax, dword [ebp - 0x1020]
mov edi, dword [ebp - 0x102c]
push dword [edi + eax*4 - 4]
lea eax, [ebp - 0x1038]
push eax
push dword [ebp - 0x101c]
push 0x1000
call fcn.010018f5
add esp, 0x10
test eax, eax
jne 0x1002a15
push dword [ebp - 0x101c]
jmp 0x10029b3
mov esi, 0x201
push esi
lea eax, [ebp - 0x1018]
push eax
push esi
lea eax, [ebp - 0xc14]
push eax
push esi
lea eax, [ebp - 0x408]
push eax
push 0x100
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x101c]
call fcn.01001be4
test eax, eax
jne 0x10029ee
mov ecx, dword [ebp - 0x102c]
lea eax, [ebp - 0x1028]
push eax
push ebx
lea eax, [ebp - 0xc14]
push eax
mov eax, dword [ebp - 0x1020]
push dword [ecx + eax*4 - 4]
call fcn.01001930
test eax, eax
je 0x10029fa
mov eax, dword [ebp - 0x1028]
mov dword [ebp - 0x10cc], eax
lea edi, [ebp - 0x408]
cmp word [ebp - 0x408], bx
je 0x1002883
cmp word [edi], 0x5c
je 0x1002845
inc edi
inc edi
cmp word [edi], bx
jne 0x1002836
jmp 0x1002883
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x408]
push eax
push 0x104
lea eax, [ebp - 0x610]
push eax
call fcn.01001465
test eax, eax
jl 0x10029b1
add edi, 2
push edi
push esi
lea eax, [ebp - 0x408]
push eax
call fcn.01001465
test eax, eax
jl 0x10029b1
mov edi, dword [ebp - 0x102c]
lea eax, [ebp - 0xc14]
push eax
mov eax, dword [ebp - 0x1020]
push dword [edi + eax*4 - 4]
mov esi, 0x800
push 0x1f44
push esi
call fcn.0100188d
add esp, 0x10
cmp dword [ebp - 0x1050], ebx
je 0x1002900
push 0x208
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1054], eax
cmp eax, ebx
je 0x1002a02
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1002a06
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
or dword [ebp - 0x1040], 0x400
mov dword [ebp - 0x1060], eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x10d8]
push eax
push dword [ebp - 0x1054]
mov eax, dword [ebp - 0x1020]
push dword [ebp - 0x1060]
push dword [ebp - 0x1040]
push dword [edi + eax*4 - 4]
lea eax, [ebp - 0x810]
push ebx
push dword [ebp - 0x1030]
push eax
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov edi, eax
cmp dword [ebp - 0x103c], ebx
je 0x1002718
test byte [ebp - 0x101c], 2
je 0x10029ca
cmp edi, ebx
jne 0x1002a3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sub.credui.dll_SspiIsPromptingNeeded
test al, al
je 0x1002718
mov eax, dword [ebp - 0x101c]
push dword [ebp - 0x1038]
and eax, 0xfffffffd
or eax, 4
mov dword [ebp - 0x101c], eax
mov esi, 0x201
push esi
lea eax, [ebp - 0x408]
push eax
call fcn.01001465
test eax, eax
jge 0x10027b8
push 0x57
push 0x1f43
push 0x800
call fcn.0100188d
add esp, 0xc
jmp 0x1002a76
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x610]
push eax
push 0x201
lea eax, [ebp - 0x408]
push eax
call fcn.01001de0
jmp 0x1002718
push 0x1bc0
call fcn.010017e1
jmp 0x1002a76
call fcn.01001878
push eax
jmp 0x10029b3
push 8
jmp 0x1002a0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1f43
push esi
jmp 0x10029bd
push dword [ebp - 0x1038]
mov eax, dword [ebp - 0x1020]
push dword [ebp - 0x101c]
push dword [edi + eax*4 - 4]
push 0x1f45
push 0x800
call fcn.0100188d
add esp, 0x14
jmp 0x1002a76
push dword [ebp - 0x1070]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x106c]
call edi
cmp dword [ebp - 0x1028], ebx
je 0x1002a69
push dword [ebp - 0x1028]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x1044], ebx
jmp 0x1002a76
call fcn.010019e9
mov ecx, 0x200
lea eax, [ebp - 0x810]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1002a81
mov ecx, 0x402
lea eax, [ebp - 0x1018]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1002a92
mov eax, dword [ebp - 0x1044]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002ea1
leave
ret 0x10