Function at 0x10018f80
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10079a91
mov eax, dword fs:[0]
push eax
sub esp, 0x48c
mov eax, dword [0x10099790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x490], edx
mov esi, ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], 1
call fcn.10008bde
test eax, eax
jne 0x10018fe0
lea ecx, [ebp + 8]
call fcn.100086b0
lea ecx, [ebp + 0xc]
call fcn.100086b0
mov al, 1
jmp 0x10019206
push 0x44
xorps xmm0, xmm0
lea eax, [ebp - 0x478]
push 0
push eax
movq qword [ebp - 0x488], xmm0
movq qword [ebp - 0x480], xmm0
call fcn.1005b850
xor eax, eax
push 0x3ff
push eax
mov word [ebp - 0x448], ax
mov byte [ebp - 0x428], al
lea eax, [ebp - 0x427]
push eax
mov dword [ebp - 0x478], 0x44
mov dword [ebp - 0x44c], 1
call fcn.1005b850
add esp, 0x18
lea eax, [ebp - 0x428]
push 0x400
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], 0x434550
mov word [ebp - 0x17], 0x4d4f
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 0x15], 0x53
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x48c]
mov dword [ebp - 0x48c], 0
call fcn.10008646
mov byte [ebp - 4], 2
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x48c]
push eax
mov dword [ebp - 0x24], 0x2f20642f
mov dword [ebp - 0x1f], 0x732520
mov byte [ebp - 0x20], 0x63
call fcn.1000c729
add esp, 0xc
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x478]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x48c]
xor bl, bl
call fcn.10008bb4
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100191a1
push 0xea60
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x10019141
mov edi, dword [ebp - 0x42c]
cmp edi, 0x103
je 0x10019141
test edi, edi
jne 0x10019122
mov bl, 1
jmp 0x1001917d
mov ecx, esi
call fcn.10008bde
test eax, eax
jne 0x1001917d
push edi
push dword [ebp + 0xc]
push str._s__d
push esi
call fcn.1000c729
add esp, 0x10
jmp 0x1001917d
mov ecx, esi
call fcn.10008bde
test eax, eax
jne 0x1001917d
push 0x100870bc
lea edx, [ebp + 0xc]
lea ecx, [ebp - 0x494]
call fcn.10008a44
add esp, 4
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.100086b5
lea ecx, [ebp - 0x494]
mov byte [ebp - 4], 2
call fcn.100086b0
push dword [ebp - 0x488]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x484]
call esi
push dword [ebp - 0x490]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100191dd
mov ecx, esi
call fcn.10008bde
test eax, eax
jne 0x100191dd
push 0x100870c0
lea edx, [ebp + 0xc]
lea ecx, [ebp - 0x490]
call fcn.10008a44
add esp, 4
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.100086b5
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 2
call fcn.100086b0
push ecx
lea ecx, [ebp - 0x48c]
call fcn.10008bf2
lea ecx, [ebp - 0x48c]
call fcn.100086b0
lea ecx, [ebp + 8]
call fcn.100086b0
lea ecx, [ebp + 0xc]
call fcn.100086b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005801c
mov esp, ebp
pop ebp
ret