Function at 0x1b0010a2
Capabilities:
Create process on windows
Query environment variable
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xccc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0xc64], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, edi
je 0x1b001127
cmp eax, esi
jae 0x1b001127
lea eax, [ebp - 0x20c]
push eax
call fcn.1b00158e
pop ecx
push edi
mov ebx, eax
push edi
xor eax, eax
push 0x1b003120
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1b00112f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x1b001127
lea eax, [ebp - 0x20c]
push eax
push str.UNO_PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x1b00112f
push 1
call dword [sym.imp.MSVCR90.dll_exit]
push 0xb
pop ecx
mov esi, str.vnd.sun.star.pathname:
lea edi, [ebp - 0x440]
rep movsd dword es:[edi], dword [esi]
push 0x206
lea eax, [ebp - 0x412]
push 0
push eax
movsw word es:[edi], word [esi]
call sub.MSVCR90.dll_memset
push 0xf
push str.fundamental.ini
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.1b0015ae
add esp, 0x20
test eax, eax
je 0x1b001127
push 0x15
push str.python_core_2.7.6lib
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa58]
push eax
call fcn.1b0015ae
add esp, 0x14
mov dword [ebp - 0xc74], eax
test eax, eax
je 0x1b001127
push 0x23
push str.python_core_2.7.6lib_site_packages
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc60]
push eax
call fcn.1b0015ae
add esp, 0x14
mov dword [ebp - 0xc78], eax
test eax, eax
je 0x1b001127
push 0x11
push str.python_core_2.7.6
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.1b0015ae
add esp, 0x14
test eax, eax
je 0x1b001127
push 0x20
push str.python_core_2.7.6_binpython.exe
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x648]
push eax
call fcn.1b0015ae
add esp, 0x14
test eax, eax
je 0x1b001127
lea ecx, [ebp - 0x648]
sub eax, ecx
xor edx, edx
sar eax, 1
inc edx
cmp dword [ebp + 8], edx
lea eax, [eax*4 + 3]
jle 0x1b001253
mov ecx, dword [ebp - 0xc64]
mov ecx, dword [ecx + edx*4]
lea edi, [ecx + 2]
mov si, word [ecx]
inc ecx
inc ecx
test si, si
jne 0x1b00123b
sub ecx, edi
sar ecx, 1
inc edx
cmp edx, dword [ebp + 8]
lea eax, [eax + ecx*4 + 3]
jl 0x1b00122f
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0xc70], eax
test eax, eax
je 0x1b001127
lea ecx, [ebp - 0x850]
push ecx
push eax
call fcn.1b001000
xor esi, esi
inc esi
cmp dword [ebp + 8], esi
pop ecx
pop ecx
jle 0x1b0012ad
push 0x20
pop ecx
mov word [eax], cx
mov ecx, dword [ebp - 0xc64]
push dword [ecx + esi*4]
add eax, 2
push eax
call fcn.1b001000
inc esi
cmp esi, dword [ebp + 8]
pop ecx
pop ecx
jl 0x1b00128d
xor ecx, ecx
push ecx
push ecx
push 0x1b003274
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x1b0012e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x1b001127
mov dword [ebp - 0xc68], 0x1b003280
jmp 0x1b00131f
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0xc68], eax
test eax, eax
je 0x1b001127
push esi
push eax
push 0x1b003284
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x1b001127
lea eax, [ebp - 0x20c]
sub ebx, eax
sar ebx, 1
xor ecx, ecx
push 2
pop edx
lea eax, [ebx + esi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov dword [ebp - 0xc64], eax
pop ecx
mov eax, 0x1b003290
test esi, esi
je 0x1b001356
mov eax, 0x1b003294
push dword [ebp - 0xc68]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1b003298
push dword [ebp - 0xc64]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0x14
push dword [ebp - 0xc64]
push str.PATH
call edi
test eax, eax
je 0x1b001127
test esi, esi
je 0x1b0013a5
push dword [ebp - 0xc68]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0xc64]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
pop ecx
push 0
push 0
push 0x1b0032b4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x1b0013e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x1b001127
mov dword [ebp - 0xc68], 0x1b0032cc
jmp 0x1b001420
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0xc68], eax
test eax, eax
je 0x1b001127
push esi
push eax
push 0x1b0032d0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x1b001127
mov eax, dword [ebp - 0xc78]
lea ecx, [ebp - 0xc60]
sub eax, ecx
mov ecx, dword [ebp - 0xc74]
sar eax, 1
lea edx, [ebp - 0xa58]
sub ecx, edx
sar ecx, 1
add eax, esi
lea eax, [ecx + eax + 2]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov dword [ebp - 0xc64], eax
pop ecx
mov eax, 0x1b0032e8
test esi, esi
je 0x1b00146f
mov eax, 0x1b0032ec
push dword [ebp - 0xc68]
push eax
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0xa58]
push eax
push 0x1b0032f0
push dword [ebp - 0xc64]
call ebx
add esp, 0x18
push dword [ebp - 0xc64]
push str.PYTHONPATH
call edi
test eax, eax
je 0x1b001127
xor ebx, ebx
cmp esi, ebx
je 0x1b0014bb
push dword [ebp - 0xc68]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0xc64]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
pop ecx
lea eax, [ebp - 0x850]
push eax
push str.PYTHONHOME
call edi
test eax, eax
je 0x1b001127
push ebx
push ebx
push 0x1b003334
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1b001515
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x1b001127
lea eax, [ebp - 0x440]
push eax
push str.URE_BOOTSTRAP
call edi
test eax, eax
je 0x1b001127
push 0x44
pop esi
push esi
lea eax, [ebp - 0xccc]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc88]
push eax
lea eax, [ebp - 0xccc]
push eax
push ebx
push ebx
push 0x400
push ebx
push ebx
push ebx
push dword [ebp - 0xc70]
lea eax, [ebp - 0x648]
push eax
mov dword [ebp - 0xccc], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1b001127
push 0xffffffffffffffff
push dword [ebp - 0xc88]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xc6c]
push eax
push dword [ebp - 0xc88]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xc6c]
jmp 0x1b001129