Function at 0x10020b4
Capabilities:
Create process on windows
Create process suspended
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x10
push 0x40
call esi
push 0x44
push 0x40
mov dword [ebp - 8], eax
call esi
push 0x94
mov ebx, eax
push 0x40
mov dword [ebp - 0xc], ebx
call esi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], eax
je 0x1002293
test ebx, ebx
je 0x1002293
test eax, eax
je 0x10022a2
push edi
push 0x11
xor eax, eax
mov edi, ebx
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebx], 0x44
mov dword [ebx + 0x2c], 1
mov word [ebx + 0x30], 5
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x100228f
push 0x1001344
push ebx
call main
mov edi, dword [ebp + 0x14]
mov ecx, edi
sub ecx, eax
push ecx
push ebx
call fcn.0100168e
push dword [ebp + 0xc]
push ebx
call main
mov ecx, edi
sub ecx, eax
push ecx
push ebx
call fcn.0100168e
push 0x1001298
push ebx
call main
sub edi, eax
push edi
push ebx
call fcn.0100168e
cmp dword [ebp + 0x10], 0
je 0x100228f
push dword [ebp + 0xc]
push 0x1001334
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push dword [ebp + 0x10]
call main
push ebx
mov edi, eax
call main
lea edi, [edi + eax + 0x10]
push edi
push 0x40
call esi
mov esi, eax
test esi, esi
je 0x100228f
push 0x1001298
push edi
push esi
call fcn.01001655
push dword [ebp + 0x10]
push esi
call main
mov ecx, edi
sub ecx, eax
push ecx
push esi
call fcn.0100168e
push 0x1001330
push esi
call main
mov ecx, edi
sub ecx, eax
push ecx
push esi
call fcn.0100168e
push ebx
push esi
call main
sub edi, eax
push edi
push esi
call fcn.0100168e
xor ebx, ebx
cmp dword [0x100c2a4], ebx
je 0x1002204
push ebx
push 0x1001308
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [ebp - 8]
push edi
push dword [ebp - 0xc]
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 4]
push eax
mov dword [eax], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 2
jne 0x1002263
push 0x10012fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x1002263
push 0x10012e0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x100225a
push dword [edi + 8]
call eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [edi + 4]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [ebp - 0xc]
pop edi
cmp dword [ebp - 4], 0
je 0x10022a2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x10022b1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x10022bc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
leave
ret 0x10