Function at 0x529270
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor edi, edi
mov dword [0x5c6fac], 1
cmp dword [0x5c73c0], edi
je 0x52929a
mov ecx, 0x5c73a0
call sub.mfc90u.dll_CWnd::DestroyWindow
cmp dword [0x5c71f0], edi
je 0x5292ac
mov ecx, 0x5c71d0
call sub.mfc90u.dll_CWnd::DestroyWindow
mov eax, dword [0x5c6f50]
cmp eax, edi
je 0x5292cb
push edi
push 0x10
push 7
lea ecx, [eax + 0x50]
push eax
call fcn.004e8c10
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004dd780
cmp dword [0x5c6f38], edi
je 0x5292dd
call fcn.004d4090
cmp dword [0x5c7000], edi
je 0x5292ea
call fcn.004e32d0
xor ebx, ebx
cmp dword [0x5c704c], edi
je 0x529311
call fcn.004b7e50
mov ecx, dword [0x5c704c]
cmp ecx, edi
je 0x52930b
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x5c704c], edi
cmp dword [0x5c7050], edi
je 0x529336
call fcn.004b8610
mov ecx, dword [0x5c7050]
cmp ecx, edi
je 0x529330
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x5c7050], edi
mov eax, dword [0x5c6f74]
cmp eax, edi
je 0x529349
push 0x57f278
call fcn.004ffb00
mov eax, dword [0x5c6f80]
cmp eax, edi
je 0x529355
mov ebx, dword [eax + 0x1c]
mov ecx, 0x5c7228
call sub.mfc90u.dll_CWnd::Detach
mov eax, dword [0x5c6f74]
cmp eax, edi
je 0x529372
push str.Update_Timer
call fcn.004ffb00
mov eax, dword [0x5c7044]
cmp eax, edi
je 0x5293b1
mov eax, dword [eax + 0xa4]
cmp eax, edi
je 0x5293b1
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5293b1
mov ecx, dword [0x5c7044]
mov edx, dword [ecx + 0xa4]
mov eax, dword [edx + 0x20]
push edi
push 2
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x5c6f3c]
cmp ecx, edi
je 0x5293c0
call fcn.004d61c0
mov ecx, dword [ebp + 0xb8]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov edx, dword [0x5c6f30]
push edi
push edx
call fcn.004d39b0
mov eax, dword [0x5c6f3c]
push edi
push eax
call fcn.004d39b0
mov ecx, dword [0x5c6f28]
push 1
push ecx
call fcn.004d39b0
call fcn.00529550
mov ecx, dword [0x5c6f3c]
cmp ecx, edi
je 0x52940b
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, dword [0x5c7044]
mov dword [0x5c6f3c], edi
cmp eax, edi
je 0x529486
mov ecx, dword [eax + 0xa4]
cmp ecx, edi
je 0x529438
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov eax, dword [0x5c7044]
mov dword [eax + 0xa4], edi
mov esi, dword [eax + 0x20]
push 0x5722b4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x52945d
push str.ShutdownBlockReasonDestroy
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x52945d
push esi
call eax
mov ecx, dword [0x5c7044]
mov edx, dword [ecx]
mov eax, dword [edx + 0x68]
call eax
mov ecx, dword [0x5c7044]
cmp ecx, edi
je 0x52947d
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov dword [0x5c7044], edi
mov dword [ebp + 0x20], edi
mov ecx, dword [0x5c700c]
cmp ecx, edi
je 0x529498
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [0x5c7008]
mov dword [0x5c700c], edi
cmp ecx, edi
je 0x5294ad
call fcn.00513a90
call fcn.0048df30
mov eax, dword [0x5c7008]
mov esi, eax
cmp eax, edi
je 0x5294cc
push eax
call fcn.00513450
push esi
call sub.mfc90u.dll_delete
add esp, 4
mov ecx, dword [0x5c7014]
push ecx
mov dword [0x5c7008], edi
call sub.gdiplus.dll_GdiplusShutdown
call fcn.0040b0d0
push edi
call sub.libIdle.module_libIdleWTSSetHandler
add esp, 4
call dword [sym.imp.libIdle.module_libIdleTerminate]
cmp dword [0x5c6fc0], edi
je 0x529500
dec dword [section..s]
mov eax, dword [0x5c71b4]
cmp dword [eax - 0xc], edi
je 0x529526
cmp ebx, 1
je 0x529526
mov edx, dword [0x5c71b8]
push 5
push edi
push edx
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [0x5c6f28]
cmp ecx, edi
je 0x52953e
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x5c6f28], edi
mov ecx, ebp
call sub.mfc90u.dll_CWinApp::ExitInstance
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret