Function at 0x1015a7d0
Capabilities:
Create process on windows
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aa828
mov eax, dword fs:[0]
push eax
mov eax, 0x10084
call fcn.10166520
mov eax, dword [0x10222354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10070], ecx
lea ecx, [ebp - 0x1001c]
call fcn.1000b9c0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10070]
add ecx, 0x38
call fcn.10008000
movzx eax, al
test eax, eax
jne 0x1015a90f
lea ecx, [ebp - 0x1003c]
call fcn.10016fb0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10070]
add ecx, 0x38
call fcn.10007f90
push eax
lea ecx, [ebp - 0x10028]
call fcn.10007b00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1003c]
push ecx
lea ecx, [ebp - 0x10028]
call fcn.10009e70
push eax
mov edx, dword [ebp - 0x10070]
mov eax, dword [edx + 0x1c]
mov ecx, dword [eax + 0x424]
mov edx, dword [ebp - 0x10070]
mov eax, dword [edx + 0x1c]
mov edx, dword [eax + 0x424]
add edx, 0x14
mov eax, dword [ecx + 0x14]
push edx
mov ecx, dword [eax + 0x11c]
call ecx
test eax, eax
jne 0x1015a8ef
lea edx, [ebp - 0x1003c]
push edx
lea ecx, [ebp - 0x10058]
call fcn.10107220
mov dword [ebp - 0x10074], eax
mov eax, dword [ebp - 0x10074]
mov dword [ebp - 0x10078], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10078]
call fcn.10007fa0
push eax
lea ecx, [ebp - 0x1001c]
call fcn.1000baa0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10058]
call fcn.1000ba80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10028]
call fcn.10009fb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1003c]
call fcn.10016fd0
jmp 0x1015a95c
push 0
lea ecx, [ebp - 0x1005c]
push ecx
call fcn.100de0f0
add esp, 8
mov dword [ebp - 0x1007c], eax
mov edx, dword [ebp - 0x1007c]
mov dword [ebp - 0x10080], edx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10080]
call fcn.10007fa0
push eax
lea ecx, [ebp - 0x1001c]
call fcn.1000baa0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1005c]
call fcn.1000ba80
push 0xfde9
push 1
mov eax, dword [ebp - 0x10070]
add eax, 0x28
push ecx
mov ecx, esp
mov dword [ebp - 0x10060], esp
push eax
call fcn.1000b9e0
mov dword [ebp - 0x10084], eax
lea ecx, [ebp - 0x10024]
push ecx
mov edx, dword [ebp - 0x10070]
mov ecx, dword [edx + 0x1c]
call fcn.10114bc0
mov dword [ebp - 0x10088], eax
mov byte [ebp - 4], 5
push 0xfde9
push 1
mov eax, dword [ebp - 0x10070]
add eax, 0x2c
push ecx
mov ecx, esp
mov dword [ebp - 0x10064], esp
push eax
call fcn.1000b9e0
mov dword [ebp - 0x1008c], eax
lea ecx, [ebp - 0x10018]
push ecx
mov edx, dword [ebp - 0x10070]
mov ecx, dword [edx + 0x1c]
call fcn.10114bc0
mov dword [ebp - 0x10090], eax
mov byte [ebp - 4], 6
mov ax, word [0x101e1548]
mov word [ebp - 0x10014], ax
push 0xfffc
push 0
lea ecx, [ebp - 0x10012]
push ecx
call fcn.10166680
add esp, 0xc
push 0x7ffe
lea edx, [ebp - 0x10014]
push edx
lea ecx, [ebp - 0x10024]
call fcn.10007f90
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x10014]
push eax
lea ecx, [ebp - 0x10024]
call fcn.1000baa0
push 0x7ffe
lea ecx, [ebp - 0x10014]
push ecx
lea ecx, [ebp - 0x10018]
call fcn.10007f90
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0x10014]
push edx
lea ecx, [ebp - 0x10018]
call fcn.1000baa0
lea ecx, [ebp - 0x1001c]
call fcn.10007f90
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
lea ecx, [ebp - 0x1001c]
call fcn.10007f90
push eax
lea ecx, [ebp - 0x10018]
call fcn.10007f90
push eax
lea ecx, [ebp - 0x10024]
call fcn.10007f90
push eax
push 0x101e154c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10020], eax
cmp dword [ebp - 0x10020], 0x20
jge 0x1015abef
mov ecx, dword [ebp - 0x10070]
add ecx, 0x34
call fcn.10008000
movzx eax, al
test eax, eax
jne 0x1015ab46
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x70]
call eax
mov dword [ebp - 0x10050], eax
lea ecx, [ebp - 0x1004c]
call fcn.10016fb0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1004c]
push ecx
lea edx, [ebp - 0x1004c]
push edx
lea eax, [ebp - 0x1004c]
push eax
lea ecx, [ebp - 0x1004c]
push ecx
mov ecx, dword [ebp - 0x10070]
add ecx, 0x34
call fcn.10007fa0
push eax
mov edx, dword [ebp - 0x10050]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10050]
push ecx
mov edx, dword [eax + 0x2c]
call edx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1004c]
call fcn.10016fd0
jmp 0x1015abad
push str.Error
push str.ErrorMsg
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xb4]
call eax
mov dword [ebp - 0x10054], eax
push 0x10
mov ecx, dword [ebp - 0x10054]
push ecx
mov ecx, dword [ebp - 0x10070]
add ecx, 0x30
call fcn.10007f90
push eax
mov edx, dword [ebp - 0x10070]
mov ecx, dword [edx + 0x1c]
add ecx, 4
call fcn.10008fd0
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x10054]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xa8]
call eax
mov dword [ebp - 0x10068], 0xfffffffb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10018]
call fcn.1000ba80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10024]
call fcn.1000ba80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1001c]
call fcn.1000ba80
mov eax, dword [ebp - 0x10068]
jmp 0x1015ac2f
mov dword [ebp - 0x1006c], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10018]
call fcn.1000ba80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10024]
call fcn.1000ba80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1001c]
call fcn.1000ba80
mov eax, dword [ebp - 0x1006c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10165d18
mov esp, ebp
pop ebp
ret 8