Function at 0x100113c1
Capabilities:
Accept command line arguments
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb7c
mov eax, dword [0x1013a420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x210], ax
mov edi, ecx
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.1003e9c0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push 0x7fe
mov word [ebp - 0xa10], ax
lea eax, [ebp - 0xa0e]
push esi
push eax
call fcn.1003e9c0
add esp, 0xc
lea eax, [ebp - 0xa10]
push str._LevelHigh__Guid
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [edi + 0x30]
cmp dword [eax + 0x14], 8
jb 0x10011447
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
lea eax, [ebp - 0xa10]
push eax
call ebx
push str.__ProcessId
lea eax, [ebp - 0xa10]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0xa28]
call fcn.1001026c
cmp dword [eax + 0x14], 8
jb 0x10011480
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xa10]
push eax
call ebx
push esi
push 1
lea ecx, [ebp - 0xa28]
call fcn.10002f54
push str.__NCRC
lea eax, [ebp - 0xa10]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x22
pop edx
movzx ecx, word [eax]
cmp cx, dx
jne 0x100114f4
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x100114f4
mov esi, dword [sym.imp.USER32.dll_CharNextW]
push edx
pop ebx
cmp cx, bx
je 0x100114da
push eax
call esi
movzx ecx, word [eax]
test cx, cx
jne 0x100114ca
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
cmp word [eax], cx
je 0x100114ee
push eax
call esi
xor esi, esi
jmp 0x10011511
xor esi, esi
mov eax, esi
jmp 0x10011511
cmp cx, 0x2f
je 0x10011511
jmp 0x1001150c
cmp cx, 0x20
je 0x10011511
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
test cx, cx
jne 0x100114fc
push eax
lea eax, [ebp - 0xa10]
push eax
call ebx
push 0x38
lea eax, [ebp - 0xb78]
push esi
push eax
call fcn.1003e9c0
add esp, 0xc
mov dword [ebp - 0xb7c], 0x3c
lea eax, [ebp - 0x210]
mov dword [ebp - 0xb60], 1
mov dword [ebp - 0xb6c], eax
lea eax, [ebp - 0xa10]
mov dword [ebp - 0xb68], eax
lea eax, [ebp - 0xb3c]
push 0x110
push esi
push eax
mov dword [ebp - 0xb78], 0x800140
mov dword [ebp - 0xb70], str.runas
call fcn.1003e9c0
add esp, 0xc
mov dword [ebp - 0xb40], 0x114
lea eax, [ebp - 0xb40]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0xb3c]
cmp eax, 5
jne 0x100115ba
call fcn.10010549
test al, al
jne 0x100115b4
mov esi, 0x426
jmp 0x1001162b
mov eax, dword [ebp - 0xb3c]
cmp eax, 6
jb 0x100115d3
xor edx, edx
xor ecx, ecx
call fcn.100105ca
test al, al
jne 0x100115d3
mov esi, 0x2766
jmp 0x1001162b
cmp dword [edi + 0x1c], esi
jne 0x100115e2
mov ecx, edi
call fcn.10010eea
mov dword [edi + 0x1c], eax
call fcn.10008616
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0xb7c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10148428]
mov esi, eax
mov eax, dword [ebp - 0xb44]
mov dword [edi + 0x28], eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor ecx, ecx
mov eax, 0x2767
cmp dword [edi + 0x1c], ecx
mov dword [0x10148428], ecx
cmove esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003890f
mov esp, ebp
pop ebp
ret