Function at 0x100839da
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Delete file
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1874
call fcn.100ec810
mov dword [ebp - 0x1050], 0xffffffff
mov dword [ebp - 0x1004], 0
mov dword [ebp - 0x1470], 0
mov dword [ebp - 0x146c], 0
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1008197b
add esp, 8
push str.COMSPEC
call sub.MSVCR70D.dll_getenv
add esp, 4
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
je 0x10083a62
mov edx, dword [ebp - 0x1004]
push edx
mov eax, dword [ebp - 0x1008]
push eax
push str._s__e:4096__c__s_n
lea ecx, [ebp - 0x800]
push ecx
call sub.MSVCR70D.dll_sprintf
add esp, 0x10
jmp 0x10083a69
xor eax, eax
jmp 0x10083d52
push 0x10148a04
call sub.MSVCR70D.dll_getenv
add esp, 4
mov dword [ebp - 0x1470], eax
cmp dword [ebp - 0x1470], 0
jne 0x10083a8c
xor eax, eax
jmp 0x10083d52
mov dword [ebp - 0x1064], 0
jmp 0x10083aa7
mov edx, dword [ebp - 0x1064]
add edx, 1
mov dword [ebp - 0x1064], edx
mov eax, dword [ebp - 0x1064]
push eax
mov ecx, dword [ebp - 0x1470]
push ecx
push str._stempbat_i.bat
lea edx, [ebp - 0x1464]
push edx
call sub.MSVCR70D.dll_sprintf
add esp, 0x10
push 0x180
push 0x4502
lea eax, [ebp - 0x1464]
push eax
call sub.MSVCR70D.dll__open
add esp, 0xc
mov dword [ebp - 0x1050], eax
cmp dword [ebp - 0x1050], 0xffffffff
je 0x10083af3
jmp 0x10083af5
jmp 0x10083a98
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 0x146c], eax
cmp dword [ebp - 0x146c], 0
je 0x10083ba4
mov ecx, dword [ebp - 0x146c]
mov dword [ebp - 0x1874], ecx
mov edx, dword [ebp - 0x146c]
movsx eax, byte [edx]
test eax, eax
je 0x10083b97
mov ecx, dword [ebp - 0x146c]
movsx edx, byte [ecx]
cmp edx, 0x3d
je 0x10083b76
mov eax, dword [ebp - 0x146c]
push eax
push str.set__s_n
lea ecx, [ebp - 0x1000]
push ecx
call sub.MSVCR70D.dll_sprintf
add esp, 0xc
lea edx, [ebp - 0x1000]
push edx
call sub.MSVCR70D.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x1000]
push eax
mov ecx, dword [ebp - 0x1050]
push ecx
call sub.MSVCR70D.dll__write
add esp, 0xc
mov edx, dword [ebp - 0x146c]
push edx
call sub.MSVCR70D.dll_strlen
add esp, 4
mov ecx, dword [ebp - 0x146c]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x146c], edx
jmp 0x10083b1a
mov eax, dword [ebp - 0x1874]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea ecx, [ebp - 0x800]
push ecx
call sub.MSVCR70D.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x800]
push edx
mov eax, dword [ebp - 0x1050]
push eax
call sub.MSVCR70D.dll__write
add esp, 0xc
mov ecx, dword [ebp - 0x1050]
push ecx
call sub.MSVCR70D.dll__close
add esp, 4
mov dword [ebp - 0x104c], 0x44
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1040], 0
mov word [ebp - 0x101a], 0
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x1020], 0x101
mov word [ebp - 0x101c], 0
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x1014], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x1010], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x100c], eax
lea edx, [ebp - 0x1464]
push edx
mov eax, dword [ebp - 0x1008]
push eax
push str._s__e:4096__c__s
lea ecx, [ebp - 0x1870]
push ecx
call sub.MSVCR70D.dll_sprintf
add esp, 0x10
lea edx, [ebp - 0x1060]
push edx
lea eax, [ebp - 0x104c]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea ecx, [ebp - 0x1870]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10083d07
mov dword [ebp - 0x1468], 1
lea edx, [ebp - 0x1870]
push edx
lea eax, [ebp - 0x800]
push eax
push str.Process___s_is_called_via_CreateProcess___s_n
call fcn.100bb012
add esp, 0xc
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1060]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0xc], 0
je 0x10083ceb
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1060]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x1060]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x105c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10083d25
mov dword [ebp - 0x1468], 0
lea eax, [ebp - 0x1464]
push eax
push str.Process___s__failed_n
call fcn.100bb012
add esp, 8
cmp dword [ebp - 0x1050], 0xffffffff
je 0x10083d3d
lea ecx, [ebp - 0x1464]
push ecx
call sub.MSVCR70D.dll_remove
add esp, 4
mov edx, dword [ebp - 0x1004]
push edx
call sub.MSVCR70D.dll_free
add esp, 4
mov eax, dword [ebp - 0x1468]
mov esp, ebp
pop ebp
ret