Function at 0x5172c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51755e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00518b68
test al, al
je 0x51753b
mov byte [0x52d384], 0
mov dword [0x52d35c], 0
mov dword [0x52d360], 0
mov dword [0x52d364], 0
mov dword [0x52d368], 0
lea edx, [ebp - 0x14]
mov eax, dword [0x52709c]
mov eax, dword [eax]
call fcn.004bbba0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0041328c
mov edx, dword [ebp - 0x10]
mov eax, 0x52d390
call fcn.004068ac
mov eax, 0x52d388
mov edx, 0x517578
call fcn.004068ac
lea edx, [ebp - 0x1c]
mov eax, dword [0x52709c]
mov eax, dword [eax]
call fcn.004bbba0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0041328c
mov edx, dword [ebp - 0x18]
mov eax, 0x52d38c
mov ecx, 0x5175a4
call fcn.00406d68
mov eax, dword [0x52d38c]
call fcn.00413060
test al, al
jne 0x51739d
mov eax, dword [0x52d38c]
call fcn.00413084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x5173bd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.004e83fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
mov edx, dword [eax]
call dword [edx + 0xa0]
mov edx, dword [0x52d388]
mov eax, dword [ebp - 4]
call fcn.00518974
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.005132c4
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5174e9
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
xor eax, eax
push ebp
push 0x5174d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52709c]
mov eax, dword [eax]
call fcn.004bb02c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov cl, 1
mov edx, dword [ebp - 8]
call fcn.00464388
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.005132c4
mov edx, dword [ebp - 8]
call fcn.004f7238
mov eax, dword [eax + 0x1c]
mov edx, 0x5175c0
call fcn.00406f6c
je 0x5174c9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.005132c4
mov edx, dword [ebp - 8]
call fcn.004f7238
mov eax, dword [eax + 0x1c]
mov edx, 0x5175d0
call fcn.00406f6c
je 0x5174c9
xor eax, eax
push ebp
push 0x5174b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.005132c4
mov edx, dword [ebp - 8]
call fcn.004f7238
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 4]
call fcn.00517748
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5174c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5174dd
inc dword [ebp - 8]
dec dword [ebp - 0xc]
jne 0x517404
cmp byte [0x52d384], 1
jne 0x517523
push 0x5175d8
push 0x5175ec
call sub.user32.dll_FindWindowW
test eax, eax
jne 0x517523
push 1
push 0
push 0
push 0x517608
push 0x51761c
mov eax, dword [ebp - 4]
call fcn.00494488
push eax
call sub.shell32.dll_ShellExecuteW
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.004e83fc
mov eax, dword [ebp - 4]
call fcn.004b618c
jmp 0x517543
mov eax, dword [ebp - 4]
call fcn.004b618c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517565
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004068a4
ret