Function at 0x1002c92
Capabilities:
Accept command line arguments
Query environment variable
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1005794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [0x1006c20], eax
push esi
push edi
xor eax, eax
mov word [0x1006200], ax
mov edi, 0x10061e0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
push eax
xor ebx, ebx
mov dword [ebp - 0x228], 8
mov dword [0x10061f0], esi
mov dword [0x1006408], esi
mov dword [0x100640c], esi
mov dword [0x10061fc], esi
call fcn.01004617
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov edi, eax
lea eax, [ebp - 0x224]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp edi, 0x3a4
je 0x1002d41
cmp edi, 0x3a8
je 0x1002d41
cmp edi, 0x3b4
jbe 0x1002d36
cmp edi, 0x3b6
jbe 0x1002d41
xor edi, edi
mov dword [0x10061f4], esi
inc edi
jmp 0x1002d4a
xor edi, edi
inc edi
mov dword [0x10061f4], edi
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0x1001300
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1002d89
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2710
call fcn.01001836
pop ecx
pop ecx
mov ebx, 0xec0
jmp 0x1002f21
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10061f8], eax
cmp eax, esi
je 0x1002d6c
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp eax, esi
jne 0x1002dcc
push 0x2711
call fcn.01001836
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1002f21
lea ecx, [ebp - 0x230]
push ecx
push eax
push dword [ebp + 8]
call fcn.01002282
test eax, eax
jne 0x1002df0
push esi
call fcn.0100221c
mov ebx, 0x85c
jmp 0x1002f21
mov eax, dword [ebp - 0x230]
sub eax, esi
je 0x1002ed6
dec eax
je 0x1002ec5
dec eax
je 0x1002e8f
dec eax
dec eax
je 0x1002e71
dec eax
je 0x1002e31
dec eax
jne 0x1002ee7
push edi
call fcn.0100221c
xor ebx, ebx
mov dword [ebp - 0x228], 8
jmp 0x1002ee7
call fcn.0100263e
test eax, eax
je 0x1002ee7
push 0xffffffffffffffff
push esi
push dword [0x10061fc]
call sub.schedcli.dll_NetScheduleJobDel
mov ebx, eax
mov dword [ebp - 0x228], 7
cmp ebx, esi
je 0x1002ee7
cmp ebx, 0xede
je 0x1002ee7
push ebx
call fcn.01001836
pop ecx
jmp 0x1002ee7
mov eax, dword [0x1006c24]
push eax
push eax
push dword [0x10061fc]
call sub.schedcli.dll_NetScheduleJobDel
mov ebx, eax
mov dword [ebp - 0x228], edi
cmp ebx, esi
jmp 0x1002e66
test byte [0x10061e9], 0x10
jne 0x1002eb8
mov eax, dword [0x10061fc]
cmp eax, esi
je 0x1002ead
cmp word [eax], si
je 0x1002ead
push 0x271d
jmp 0x1002eb2
push 0x271c
call fcn.01001836
pop ecx
call fcn.01001bd7
mov dword [ebp - 0x228], esi
jmp 0x1002ee5
call fcn.01002a55
mov dword [ebp - 0x228], 2
jmp 0x1002ee5
call fcn.01002871
mov dword [ebp - 0x228], 4
mov ebx, eax
push section..data
call fcn.010019ad
push 0x1005088
call fcn.010019ad
push dword [0x1005820]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
call edi
push dword [0x1005824]
call edi
push dword [0x1005834]
call edi
push dword [0x1005838]
call edi
lea eax, [ebp - 0x22c]
push eax
call fcn.010019fe
push ebx
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x228]
push esi
call fcn.01004643
xor eax, eax
cmp ebx, esi
setne al
push eax
call dword [sym.imp.msvcrt.dll_exit]
int3