Function at 0x101644c0
Capabilities:
Create process on windows
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b4f28
mov eax, dword fs:[0]
push eax
mov eax, 0x10084
call fcn.101742d0
mov eax, dword [0x1022c684]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10070], ecx
lea ecx, [ebp - 0x1001c]
call fcn.10005d40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10070]
add ecx, 0x38
call fcn.10004400
movzx eax, al
test eax, eax
jne 0x101645ff
lea ecx, [ebp - 0x1003c]
call fcn.10012560
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10070]
add ecx, 0x38
call fcn.10004390
push eax
lea ecx, [ebp - 0x10028]
call fcn.10003dd0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1003c]
push ecx
lea ecx, [ebp - 0x10028]
call fcn.10013030
push eax
mov edx, dword [ebp - 0x10070]
mov eax, dword [edx + 0x1c]
mov ecx, dword [eax + 0x434]
mov edx, dword [ebp - 0x10070]
mov eax, dword [edx + 0x1c]
mov edx, dword [eax + 0x434]
add edx, 0x14
mov eax, dword [ecx + 0x14]
push edx
mov ecx, dword [eax + 0x104]
call ecx
test eax, eax
jne 0x101645df
lea edx, [ebp - 0x1003c]
push edx
lea ecx, [ebp - 0x10058]
call fcn.1010efd0
mov dword [ebp - 0x10074], eax
mov eax, dword [ebp - 0x10074]
mov dword [ebp - 0x10078], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10078]
call fcn.100043a0
push eax
lea ecx, [ebp - 0x1001c]
call fcn.10005e20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10058]
call fcn.10005e00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10028]
call fcn.100058a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1003c]
call fcn.10012580
jmp 0x1016464c
push 0
lea ecx, [ebp - 0x1005c]
push ecx
call fcn.100e14d0
add esp, 8
mov dword [ebp - 0x1007c], eax
mov edx, dword [ebp - 0x1007c]
mov dword [ebp - 0x10080], edx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10080]
call fcn.100043a0
push eax
lea ecx, [ebp - 0x1001c]
call fcn.10005e20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1005c]
call fcn.10005e00
push 0xfde9
push 1
mov eax, dword [ebp - 0x10070]
add eax, 0x28
push ecx
mov ecx, esp
mov dword [ebp - 0x10060], esp
push eax
call fcn.10005d60
mov dword [ebp - 0x10084], eax
lea ecx, [ebp - 0x10024]
push ecx
mov edx, dword [ebp - 0x10070]
mov ecx, dword [edx + 0x1c]
call fcn.1011d720
mov dword [ebp - 0x10088], eax
mov byte [ebp - 4], 5
push 0xfde9
push 1
mov eax, dword [ebp - 0x10070]
add eax, 0x2c
push ecx
mov ecx, esp
mov dword [ebp - 0x10064], esp
push eax
call fcn.10005d60
mov dword [ebp - 0x1008c], eax
lea ecx, [ebp - 0x10018]
push ecx
mov edx, dword [ebp - 0x10070]
mov ecx, dword [edx + 0x1c]
call fcn.1011d720
mov dword [ebp - 0x10090], eax
mov byte [ebp - 4], 6
mov ax, word [0x101ea7d0]
mov word [ebp - 0x10014], ax
push 0xfffc
push 0
lea ecx, [ebp - 0x10012]
push ecx
call fcn.1016f6c0
add esp, 0xc
push 0x7ffe
lea edx, [ebp - 0x10014]
push edx
lea ecx, [ebp - 0x10024]
call fcn.10004390
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x10014]
push eax
lea ecx, [ebp - 0x10024]
call fcn.10005e20
push 0x7ffe
lea ecx, [ebp - 0x10014]
push ecx
lea ecx, [ebp - 0x10018]
call fcn.10004390
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0x10014]
push edx
lea ecx, [ebp - 0x10018]
call fcn.10005e20
lea ecx, [ebp - 0x1001c]
call fcn.10004390
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
lea ecx, [ebp - 0x1001c]
call fcn.10004390
push eax
lea ecx, [ebp - 0x10018]
call fcn.10004390
push eax
lea ecx, [ebp - 0x10024]
call fcn.10004390
push eax
push 0x101ea7d4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10020], eax
cmp dword [ebp - 0x10020], 0x20
jge 0x101648df
mov ecx, dword [ebp - 0x10070]
add ecx, 0x34
call fcn.10004400
movzx eax, al
test eax, eax
jne 0x10164836
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x70]
call eax
mov dword [ebp - 0x10050], eax
lea ecx, [ebp - 0x1004c]
call fcn.10012560
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1004c]
push ecx
lea edx, [ebp - 0x1004c]
push edx
lea eax, [ebp - 0x1004c]
push eax
lea ecx, [ebp - 0x1004c]
push ecx
mov ecx, dword [ebp - 0x10070]
add ecx, 0x34
call fcn.100043a0
push eax
mov edx, dword [ebp - 0x10050]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10050]
push ecx
mov edx, dword [eax + 0x2c]
call edx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1004c]
call fcn.10012580
jmp 0x1016489d
push str.Error
push str.ErrorMsg
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xb4]
call eax
mov dword [ebp - 0x10054], eax
push 0x10
mov ecx, dword [ebp - 0x10054]
push ecx
mov ecx, dword [ebp - 0x10070]
add ecx, 0x30
call fcn.10004390
push eax
mov edx, dword [ebp - 0x10070]
mov ecx, dword [edx + 0x1c]
add ecx, 4
call fcn.10004cb0
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x10054]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xa8]
call eax
mov dword [ebp - 0x10068], 0xfffffffb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10018]
call fcn.10005e00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10024]
call fcn.10005e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1001c]
call fcn.10005e00
mov eax, dword [ebp - 0x10068]
jmp 0x1016491f
mov dword [ebp - 0x1006c], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10018]
call fcn.10005e00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10024]
call fcn.10005e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1001c]
call fcn.10005e00
mov eax, dword [ebp - 0x1006c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1016f6a2
mov esp, ebp
pop ebp
ret 8