Function at 0x10015f1
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1003004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
xor ebx, ebx
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, 0x1001404
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
push 0x20a
mov word [ebp - 0x220], ax
xor edi, edi
lea eax, [ebp - 0x21e]
push edi
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_HeapSetInformation]
add esp, 0x18
push edi
push edi
push 1
push edi
mov dword [ebp - 0x434], 2
mov dword [ebp - 0x42c], edi
call esi
test eax, eax
jne 0x100167f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jg 0x10016cf
jmp 0x10016d9
push 4
lea eax, [ebp - 0x434]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
call sub.FVEWIZ.dll_FveuipClearFveWizOnStartup
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, edi
jne 0x10016ab
mov ebx, 0x80004005
jmp 0x100189e
lea ecx, [ebp - 0x42c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [ebp - 0x438], edi
test edi, edi
jne 0x10016e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10016d9
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x100189e
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffffd
cmp eax, 1
ja case.0x1001793.81
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [ebp - 0x430], eax
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1001702
sub eax, esi
sar eax, 1
cmp eax, 2
jb 0x1001759
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100171a
sub eax, esi
sar eax, 1
cmp eax, 3
ja 0x1001759
movzx eax, word [edx]
cmp ax, 0x61
jb 0x100173c
cmp ax, 0x7a
jbe 0x1001748
cmp ax, 0x41
jb 0x1001759
cmp ax, 0x5a
ja 0x1001759
cmp word [edx + 2], 0x3a
jne 0x1001759
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x14]
push eax
jmp 0x100175a
push edx
mov esi, 0x104
push esi
lea eax, [ebp - 0x428]
push eax
call fcn.01001576
mov ebx, eax
test ebx, ebx
jne 0x100189e
mov eax, dword [edi + 8]
movzx eax, word [eax]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
movzx eax, ax
add eax, 0xffffffb0
pop ecx
cmp eax, 8
ja case.0x1001793.81
jmp dword [eax*4 + 0x10018b9]
push 0x40
pop edi
jmp 0x10017c0
push 0x20
jmp 0x100179c
xor edi, edi
inc edi
jmp 0x10017c0
push 2
jmp 0x100179c
push 3
jmp 0x100179c
push 4
jmp 0x100179c
mov edi, 0x80
jmp 0x10017c0
mov edi, 0x100
cmp dword [ebp - 0x42c], 4
jne 0x100185a
mov edi, dword [ebp - 0x438]
mov eax, dword [edi + 0xc]
movzx eax, word [eax]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x46
jne case.0x1001793.81
lea eax, [ebp - 0x428]
push eax
mov esi, 0x106
push esi
lea eax, [ebp - 0x220]
push eax
call fcn.01001576
mov ebx, eax
test ebx, ebx
jne 0x100189e
push 0x1001400
push esi
lea eax, [ebp - 0x220]
push eax
call fcn.010015b0
mov ebx, eax
test ebx, ebx
jne 0x100189e
push dword [edi + 8]
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.010015b0
mov ebx, eax
test ebx, ebx
jne 0x100189e
push 1
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x430]
push 0x10013f4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100189e
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
test ebx, ebx
je 0x100186d
cmp ebx, 1
jne 0x100189e
push esi
lea eax, [ebp - 0x428]
push eax
push edi
push 0
call sub.FVEWIZ.dll_FveuiWizard
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x100189e
mov eax, dword [sym.imp.msvcrt.dll__iob]
push dword [section..data]
add eax, 0x40
push eax
call dword [sym.imp.msvcrt.dll_fwprintf]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
setne al
pop esi
xor ecx, ebp
pop ebx
call fcn.01001bfb
leave
ret 0x10