Function at 0x10020bc
Capabilities:
Create process on windows
Create process suspended
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x10
push 0x40
call esi
push 0x44
push 0x40
mov dword [ebp - 8], eax
call esi
push 0x94
mov ebx, eax
push 0x40
mov dword [ebp - 0xc], ebx
call esi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], eax
je 0x100229b
test ebx, ebx
je 0x100229b
test eax, eax
je 0x10022aa
push edi
push 0x11
xor eax, eax
mov edi, ebx
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebx], 0x44
mov dword [ebx + 0x2c], 1
mov word [ebx + 0x30], 5
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1002297
push 0x1001344
push ebx
call main
mov edi, dword [ebp + 0x14]
mov ecx, edi
sub ecx, eax
push ecx
push ebx
call fcn.01001696
push dword [ebp + 0xc]
push ebx
call main
mov ecx, edi
sub ecx, eax
push ecx
push ebx
call fcn.01001696
push 0x1001298
push ebx
call main
sub edi, eax
push edi
push ebx
call fcn.01001696
cmp dword [ebp + 0x10], 0
je 0x1002297
push dword [ebp + 0xc]
push 0x1001334
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push dword [ebp + 0x10]
call main
push ebx
mov edi, eax
call main
lea edi, [edi + eax + 0x10]
push edi
push 0x40
call esi
mov esi, eax
test esi, esi
je 0x1002297
push 0x1001298
push edi
push esi
call fcn.0100165d
push dword [ebp + 0x10]
push esi
call main
mov ecx, edi
sub ecx, eax
push ecx
push esi
call fcn.01001696
push 0x1001330
push esi
call main
mov ecx, edi
sub ecx, eax
push ecx
push esi
call fcn.01001696
push ebx
push esi
call main
sub edi, eax
push edi
push esi
call fcn.01001696
xor ebx, ebx
cmp dword [0x100c2a4], ebx
je 0x100220c
push ebx
push 0x1001308
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [ebp - 8]
push edi
push dword [ebp - 0xc]
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 4]
push eax
mov dword [eax], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 2
jne 0x100226b
push 0x10012fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x100226b
push 0x10012e0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1002262
push dword [edi + 8]
call eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [edi + 4]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [ebp - 0xc]
pop edi
cmp dword [ebp - 4], 0
je 0x10022aa
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x10022b9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x10022c4
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
leave
ret 0x10