Function at 0x101d036
Capabilities:
Check os version
Get common file path
Query environment variable
Read file on windows
Shutdown system
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4dc
mov eax, dword [0x102c22c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov dword [ebp - 0x4c8], eax
xor ebx, ebx
push esi
xor eax, eax
cmp dword [ebp + 0x18], ebx
push edi
mov dword [ebp - 0x4cc], 0x10
je 0x101d075
cmp dword [ebp + 0x14], ebx
setne al
add eax, 0x80020016
jmp 0x101d080
cmp dword [ebp + 0x14], ebx
setne al
add eax, 0x80020010
mov dword [ebp - 0x4bc], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x1007a34
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x101d1f0
push ebx
push ebx
push 3
push ebx
push 7
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x4c4], eax
je 0x101d1f0
push ebx
lea ecx, [ebp - 0x4c0]
push ecx
mov esi, 0x314
push esi
lea ecx, [ebp - 0x4b8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101d1d6
cmp dword [ebp - 0x4c0], esi
jne 0x101d1d6
cmp dword [ebp - 0x4b8], 0x6e776453
jne 0x101d1d6
mov edx, 0x10000
cmp dword [ebp - 0x4b4], edx
jb 0x101d1d6
xor eax, eax
cmp dword [ebp + 8], ebx
mov ecx, 0xc5
lea edi, [ebp - 0x4b8]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x4b8], 0x6e776453
mov dword [ebp - 0x4b4], edx
mov dword [ebp - 0x4ac], eax
je 0x101d155
or dword [ebp - 0x4b0], 1
cmp dword [ebp + 0xc], ebx
je 0x101d161
or dword [ebp - 0x4b0], 2
cmp dword [ebp + 0x10], ebx
je 0x101d16d
or dword [ebp - 0x4b0], 0x10
push 0x1ff
push dword [ebp - 0x4c8]
lea eax, [ebp - 0x4a8]
push eax
call sub.ntdll.dll_strncpy
push 0x103
lea eax, [ebp - 0x2a8]
push 0x106f780
push eax
call sub.ntdll.dll_strncpy
add esp, 0x18
push ebx
push ebx
push ebx
push dword [ebp - 0x4c4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x4c0]
push eax
push esi
lea eax, [ebp - 0x4b8]
push eax
push dword [ebp - 0x4c4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp edi, ebx
je 0x101d1d8
cmp dword [ebp - 0x4c0], esi
je 0x101d1d8
xor edi, edi
push dword [ebp - 0x4c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x101d1f0
xor eax, eax
inc eax
jmp 0x101d3ca
push 0x1007a20
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, eax
cmp edi, ebx
je 0x101d21c
push 0xea60
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x101d233
cmp dword [ebp + 0x10], ebx
je 0x101d228
push 0xea60
jmp 0x101d22d
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x4dc]
push eax
push ebx
push 0x13
call fcn.01015522
test eax, eax
jne 0x101d25e
push 0x10079f0
call fcn.01015c42
xor eax, eax
jmp 0x101d3ca
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x1a4]
push eax
mov dword [ebp - 0x1a4], 0x94
call edi
cmp dword [ebp - 0x1a0], 4
jbe 0x101d293
lea eax, [ebp - 0x1a4]
push eax
mov dword [ebp - 0x1a4], 0x9c
call edi
mov eax, dword [0x106e3e8]
cmp eax, ebx
je 0x101d2ac
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x101d32f
mov esi, 0xbb8
cmp dword [ebp - 0x1a0], 5
jne 0x101d2e8
cmp dword [ebp - 0x19c], 1
jb 0x101d2e8
mov eax, dword [0x102de10]
cmp eax, ebx
je 0x101d2e4
push dword [ebp - 0x4bc]
push dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x4c8]
push ebx
call eax
jmp 0x101d2f7
xor edi, edi
jmp 0x101d2f9
push dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
mov edi, eax
cmp edi, ebx
jne 0x101d3bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x45b
je 0x101d32f
cmp eax, 0x4f7
je 0x101d31a
cmp eax, 0x15
jne 0x101d342
mov eax, dword [0x106e3e8]
cmp eax, ebx
push esi
je 0x101d337
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x101d2b1
xor edi, edi
inc edi
jmp 0x101d3bc
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101d2b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10079bc
call fcn.01015c5a
test byte [ebp - 0x10c], 0x40
pop ecx
pop ecx
je 0x101d3bc
push 0xfffa
mov esi, 0x107f8a0
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x101d3bc
push 0x5c
push esi
call sub.ntdll.dll_strchr
pop ecx
pop ecx
push ebx
push 0x2000000
push 3
push ebx
push 7
push 0xc0000000
push esi
mov byte [eax + 1], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x101d3bc
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x101d3bc
push 1
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
mov edi, eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.0101a33e
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101439a
leave
ret 0x18