Function at 0x1001195
Capabilities:
Create process on windows
Query environment variable
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xaa8
mov eax, dword [0x1006084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x1002100
xor esi, esi
push edi
mov dword [ebp - 0xa14], esi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x10025c2
push 0x10020e4
push edi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x10025c2
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10011ff
lea edi, [ebp - 0x210]
cmp dword [ebp + 0x14], esi
je 0x1002618
cmp dword [0x100608c], esi
jne 0x1001242
push 0x100229c
mov dword [ebp - 0xa18], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
je 0x1001313
push 0x1001338
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100608c], eax
cmp eax, esi
je 0x1001313
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call ebx
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xa18], eax
cmp eax, esi
je 0x100348b
push edi
push edi
call ebx
mov ebx, dword [ebp - 0xa18]
inc eax
push eax
push ebx
call fcn.01002170
cmp dword [ebp + 0xc], esi
jne 0x1001292
push ebx
call fcn.010023f4
mov edi, eax
cmp edi, esi
je 0x1001294
cmp word [edi], si
jne 0x1003492
mov edi, esi
push ebx
call fcn.010022b9
push 0x3c
lea eax, [ebp - 0xaa8]
push esi
push eax
call sub.msvcrt.dll_memset
movzx eax, word [ebp + 0x18]
mov dword [ebp - 0xa8c], eax
add esp, 0xc
lea eax, [ebp - 0xaa8]
push eax
mov dword [ebp - 0xaa8], 0x3c
mov dword [ebp - 0xaa4], 0x640
mov dword [ebp - 0xa98], ebx
mov dword [ebp - 0xa94], edi
mov dword [ebp - 0xa9c], 0x100132c
call dword [0x100608c]
mov dword [ebp - 0xa18], eax
cmp eax, esi
je 0x100130c
cmp dword [ebp + 0x10], esi
jne 0x100349e
push dword [ebp - 0xa70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xa18]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001841
leave
ret 0x14
push 0x104
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0xa14], 1
push 0x10025e4
jmp 0x10011ef
mov ax, word [ebp + 0x18]
mov word [ebp - 0xa3c], ax
xor eax, eax
mov word [ebp - 0xa3a], ax
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa6c]
push eax
mov eax, dword [ebp + 0xc]
push esi
mov ecx, eax
xor ebx, ebx
push esi
inc ebx
neg ecx
sbb ecx, ecx
push 0x20
push esi
not ecx
push esi
and ecx, edi
neg eax
push esi
sbb eax, eax
push ecx
and eax, edi
push eax
mov dword [ebp - 0xa6c], 0x44
mov dword [ebp - 0xa68], edi
mov dword [ebp - 0xa60], edi
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa50], esi
mov dword [ebp - 0xa54], esi
mov dword [ebp - 0xa58], esi
mov dword [ebp - 0xa5c], esi
mov dword [ebp - 0xa40], ebx
mov dword [ebp - 0xa38], esi
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_CreateProcessW]
mov dword [ebp - 0xa18], eax
cmp eax, esi
je 0x10034b1
cmp dword [ebp + 0x10], esi
jne 0x1003533
push dword [ebp - 0xa28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xa24]
call esi
jmp 0x1001313
xor eax, eax
jmp 0x1001319
xor eax, eax
mov word [edi], ax
inc edi
inc edi
jmp 0x1001294
push 0xffffffffffffffff
push dword [ebp - 0xa70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1001300
call fcn.01004669
test eax, eax
jne 0x1001313
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp ecx, dword [eax + 0x1d4]
je 0x1001313
cmp dword [ebp - 0xa14], ebx
jne 0x1001313
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0x200
push ebx
lea eax, [ebp - 0xa10]
push eax
push 0x648
push esi
call edi
push ebx
lea eax, [ebp - 0x610]
push eax
push 0x647
push esi
call edi
push esi
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x610]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1001313
push 0xffffffffffffffff
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x10026b6