Function at 0x10009d66
Capabilities:
Check if file exists
Create process on windows
Query environment variable
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
mov eax, dword [0x1000e008]
xor eax, esp
mov dword [esp + reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex], eax
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [esp + 0x34]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [esp + 0x88]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp + 0x3c], esi
add esp, 0xc
stosd dword es:[edi], eax
mov esi, 0x105
push esi
lea edi, [esp + 0x8c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call fcn.1000843f
mov dword [esp + 0xc], eax
test eax, eax
jne 0x10009e42
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10009dee
mov eax, edi
push eax
push 0x10004668
call fcn.10009770
pop ecx
pop ecx
mov eax, 0x643
jmp 0x10009e42
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x20a
push 0x40
call edi
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x10009de7
push esi
push ebx
xor eax, eax
mov esi, 0x100046b4
push esi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x10009e57
push esi
push 0x100046ec
call fcn.10009770
pop ecx
pop ecx
mov dword [esp + 0xc], reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000cace
mov esp, ebp
pop ebp
ret
lea esi, [esp + 0x1c]
mov ecx, eax
call fcn.1000958f
test eax, eax
js 0x10009e2f
lea esi, [esp + 0x14]
mov ecx, 0x105
call fcn.1000958f
test eax, eax
js 0x10009e2f
mov eax, dword [esp + 0x14]
lea esi, [eax + 0x2a]
cmp esi, eax
jb 0x10009e2f
push esi
push 0x40
call edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10009e2f
push 0x10004718
lea ecx, [esp + 0x8c]
push ecx
push 0x10004740
push esi
push eax
call fcn.100094a8
add esp, 0x14
test eax, eax
jns 0x10009ece
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10009788
push eax
push 0x10004750
call fcn.10009770
pop ecx
pop ecx
jmp 0x1000a06c
mov ebx, dword [esp + 0x1c]
add ebx, esi
cmp ebx, esi
jb 0x1000a068
push 1
lea edi, [esp + 0x80]
call fcn.1000a2e8
test eax, eax
js 0x1000a068
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [esp + 0x18], esi
mov edi, 0x643
test esi, esi
jne 0x10009f17
mov ebx, dword [esp + 0x10]
mov dword [esp + 0xc], edi
jmp 0x1000a054
push dword [esp + 0x14]
shr ebx, 1
push dword [esp + 0x14]
push 0x100047b0
push ebx
push esi
call fcn.100078f5
add esp, 0x14
test eax, eax
jns 0x10009f4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10009788
push eax
push 0x100047c0
call fcn.10009770
pop ecx
pop ecx
jmp 0x10009f0a
push esi
push 0x10004810
call fcn.10009770
pop ecx
mov ebx, dword [esp + 0x14]
pop ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10009fa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esp + 0x10], eax
call fcn.10009788
push eax
push 0x10004830
call fcn.10009770
pop ecx
pop ecx
jmp 0x1000a054
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0xc], eax
test eax, eax
je 0x10009fc1
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x1000a032
cmp eax, 0x240006
je 0x1000a032
test eax, eax
je 0x1000a01e
cmp eax, 0xbc2
je 0x1000a01e
cmp eax, 0x422
jne 0x10009ffe
push 0x100048e8
call fcn.10009770
jmp 0x1000a041
push eax
call fcn.10009788
push eax
push 0x100049b0
call fcn.10009770
push 0x10004a10
call fcn.10009770
add esp, 0xc
jmp 0x1000a042
push eax
call fcn.10009788
push eax
push 0x10004b00
call fcn.10009770
pop ecx
jmp 0x1000a041
push 0x10004880
call fcn.10009770
and dword [esp + 0x10], 0
pop ecx
push dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x24]
call esi
push 0
lea edi, [esp + 0x80]
call fcn.1000a2e8
test eax, eax
jns 0x1000a074
jmp 0x1000a06c
mov ebx, dword [esp + 0x10]
mov dword [esp + 0xc], reloc.SETUPAPI.dll_CM_Set_DevNode_Problem_Ex
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10009e37
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10009e37