Function at 0x1001ec7
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x21c], edi
xor esi, esi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x228], edi
call fcn.01002a67
mov eax, dword [ebp + 8]
push edi
push edi
push 1
push edi
mov dword [0x100401c], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test eax, eax
jne 0x1001f40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1002091
and eax, 0xffff
or eax, 0x80070000
jmp 0x1002091
call fcn.01001daf
mov ebx, eax
cmp ebx, edi
jne 0x1002093
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, edi
jne 0x1001f63
mov ebx, 0x80004005
jmp 0x1002093
lea ecx, [ebp - 0x22c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [ebp - 0x224], ebx
cmp ebx, edi
je 0x1001f23
cmp dword [ebp - 0x22c], 2
je 0x1001f90
mov ebx, 0x80070057
jmp 0x1002093
push 0xa50
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, edi
je 0x1001faa
mov ecx, eax
call sub.BDEUI.dll_public:_void___thiscall_BuiVolume::constructor_void_
mov esi, eax
jmp 0x1001fac
xor esi, esi
cmp esi, edi
jne 0x1001fba
mov ebx, 0x8007000e
jmp 0x1002093
push dword [ebx + 4]
mov ecx, esi
call sub.BDEUI.dll_public:_long_int___thiscall_BuiVolume::Init_unsigned_short_int__
mov ebx, eax
cmp ebx, edi
jne 0x1002093
lea eax, [esi + 0x210]
push eax
lea ebx, [ebp - 0x228]
call fcn.01001895
mov ebx, eax
cmp ebx, edi
jne 0x1002093
cmp dword [ebp - 0x228], edi
jne 0x1002093
push esi
lea edi, [ebp - 0x220]
call fcn.0100198a
test eax, eax
jne 0x1002093
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
mov eax, dword [ebp - 0x224]
push 0x1001318
push dword [eax + 4]
call sub.BDEUI.dll_long_int___stdcall_BuisDetectExistingWizard_unsigned_short_int_const___unsigned_short_int_const___unsigned_short_int_const___void___
mov ebx, eax
test ebx, ebx
jne 0x1002093
lea eax, [esi + 0x210]
push eax
lea ecx, [ebp - 0x218]
call fcn.01002cf8
mov ebx, eax
test ebx, ebx
jne 0x1002093
test byte [esi], 1
je 0x1002085
mov eax, dword [esi]
shr eax, 2
test al, 1
jne 0x1002085
mov ecx, esi
call sym.fveprompt.exe_public:_bool___thiscall_VolumeFveStatus::IsDisabled_void_
test al, al
jne 0x1002085
mov ecx, esi
call sym.fveprompt.exe_public:_bool___thiscall_VolumeFveStatus::IsConverting_void_
test al, al
je 0x1002093
push 1
xor eax, eax
push eax
push eax
push 0x10012fc
push 0x1001230
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1002093
push esi
push dword [ebp - 0x220]
call fcn.01001d6c
mov ebx, eax
push dword [ebp - 0x220]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
call edi
push dword [ebp - 0x224]
call edi
test esi, esi
je 0x10020b6
push 1
mov ecx, esi
call fcn.01001719
cmp dword [ebp - 0x21c], 0
je 0x10020d2
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x218]
call fcn.010028fd
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
setge al
pop edi
pop esi
xor ecx, ebp
pop ebx
dec eax
call fcn.0100242b
leave
ret 0x10