Function at 0x521df0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Delete file
Get common file path

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x3b8]
lea esi, [ebp - 0x22d]
push ebx
lea ebx, [ebp - 0x3cc]
sub esp, 0x3f4
mov dword [ebp - 0x3bc], 0x44
rep stosd dword es:[edi], eax
mov ecx, 1
mov eax, 0x84fdc0
mov dword [ebp - 0x390], 1
mov word [ebp - 0x38c], cx
lea edi, [ebp - 0x3bc]
call fcn.0050d8f0
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
mov dword [esp], esi
call fcn.0050d7a0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x2a9
mov dword [esp + 0x20], edi
mov edi, dword [sym.imp.kernel32.dll_CreateProcessA]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
mov dword [ebp - 0x3d4], edi
call edi
lea edi, [ebp - 0x3b8]
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
mov eax, ebx
call fcn.0050e290
mov edx, dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x3d0], edx
call edx
lea eax, [ebp - 0x378]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov eax, dword [ebp - 0x3bc]
mov ecx, 0x5efae5
mov edx, str.StartupInfoA
sub esp, 4
mov dword [esp], eax
mov eax, 0x2ae
call fcn.005104e0
mov ecx, str.lpDesktop
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x370]
mov dword [esp], eax
mov eax, 0x2af
call fcn.00510420
mov eax, dword [ebp - 0x3ac]
mov ecx, 0x5efb29
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2b0
call fcn.005104e0
mov eax, dword [ebp - 0x3a8]
mov ecx, 0x5efb2d
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2b1
call fcn.005104e0
mov eax, dword [ebp - 0x3a4]
mov ecx, str.dwXSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2b2
call fcn.005104e0
mov eax, dword [ebp - 0x3a0]
mov ecx, str.dwYSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2b3
call fcn.005104e0
mov eax, dword [ebp - 0x39c]
mov ecx, str.dwXCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2b4
call fcn.005104e0
mov eax, dword [ebp - 0x398]
mov ecx, str.dwYCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2b5
call fcn.005104e0
mov eax, dword [ebp - 0x394]
mov ecx, str.dwFillAttribute
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2b6
call fcn.005104e0
mov eax, dword [ebp - 0x390]
mov ecx, str.dwFlags
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2b7
call fcn.005104e0
mov edx, str.StartupInfoA
mov ecx, str.wShowWindow
movzx eax, word [ebp - 0x38c]
mov dword [esp], eax
mov eax, 0x2b8
call fcn.005104e0
mov ecx, dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov dword [ebp - 0x3d8], ecx
call ecx
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x3bc], 0x44
rep stosd dword es:[edi], eax
sub esp, 4
mov edi, 1
mov eax, 0x84fdc0
mov word [ebp - 0x38c], di
mov dword [ebp - 0x390], 1
mov dword [ebp - 0x3b0], str.Im_the_title_string
mov dword [ebp - 0x3b4], str.winsta0default
mov dword [ebp - 0x39c], 0x12121212
mov dword [ebp - 0x398], 0x23232323
mov dword [ebp - 0x3ac], 0x34343434
mov dword [ebp - 0x3a8], 0x45454545
mov dword [ebp - 0x3a4], 0x56565656
mov dword [ebp - 0x3a0], 0x67676767
mov dword [ebp - 0x394], 0xa55a
call fcn.0050d8f0
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
mov dword [esp], esi
call fcn.0050d7a0
mov eax, 0x2cd
call fcn.0050dc60
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
mov edi, dword [ebp - 0x3d4]
call edi
lea edi, [ebp - 0x3b8]
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
mov eax, ebx
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x3d0]
call edx
mov eax, dword [ebp - 0x3bc]
mov ecx, 0x5efae5
mov edx, str.StartupInfoA
sub esp, 0x10
mov dword [esp], eax
mov eax, 0x2d1
call fcn.005104e0
mov ecx, str.lpDesktop
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b4]
mov dword [esp], eax
mov eax, 0x2d2
call fcn.00510420
mov ecx, str.lpTitle
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b0]
mov dword [esp], eax
mov eax, 0x2d3
call fcn.00510420
mov eax, dword [ebp - 0x3ac]
mov ecx, 0x5efb29
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2d4
call fcn.005104e0
mov eax, dword [ebp - 0x3a8]
mov ecx, 0x5efb2d
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2d5
call fcn.005104e0
mov eax, dword [ebp - 0x3a4]
mov ecx, str.dwXSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2d6
call fcn.005104e0
mov eax, dword [ebp - 0x3a0]
mov ecx, str.dwYSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2d7
call fcn.005104e0
mov eax, dword [ebp - 0x39c]
mov ecx, str.dwXCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2d8
call fcn.005104e0
mov eax, dword [ebp - 0x398]
mov ecx, str.dwYCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2d9
call fcn.005104e0
mov eax, dword [ebp - 0x394]
mov ecx, str.dwFillAttribute
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2da
call fcn.005104e0
mov eax, dword [ebp - 0x390]
mov ecx, str.dwFlags
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2db
call fcn.005104e0
mov edx, str.StartupInfoA
mov ecx, str.wShowWindow
movzx eax, word [ebp - 0x38c]
mov dword [esp], eax
mov eax, 0x2dc
call fcn.005104e0
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov ecx, dword [ebp - 0x3d8]
call ecx
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x3bc], 0x44
rep stosd dword es:[edi], eax
mov eax, 1
sub esp, 4
mov dword [ebp - 0x390], 1
mov word [ebp - 0x38c], ax
mov eax, 0x84fdc0
mov dword [ebp - 0x3b0], str.Im_the_title_string
mov dword [ebp - 0x39c], 0x12121212
mov dword [ebp - 0x398], 0x23232323
mov dword [ebp - 0x3ac], 0x34343434
mov dword [ebp - 0x3a8], 0x45454545
mov dword [ebp - 0x3a4], 0x56565656
mov dword [ebp - 0x3a0], 0x67676767
mov dword [ebp - 0x394], 0xa55a
call fcn.0050d8f0
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
mov dword [esp], esi
call fcn.0050d7a0
mov eax, 0x2f1
call fcn.0050dc60
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
mov edi, dword [ebp - 0x3d4]
call edi
lea edi, [ebp - 0x3b8]
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
mov eax, ebx
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x3d0]
call edx
mov eax, dword [ebp - 0x3bc]
mov ecx, 0x5efae5
mov edx, str.StartupInfoA
sub esp, 0x10
mov dword [esp], eax
mov eax, 0x2f5
call fcn.005104e0
mov ecx, str.lpDesktop
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x370]
mov dword [esp], eax
mov eax, 0x2f6
call fcn.00510420
mov ecx, str.lpTitle
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b0]
mov dword [esp], eax
mov eax, 0x2f7
call fcn.00510420
mov eax, dword [ebp - 0x3ac]
mov ecx, 0x5efb29
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2f8
call fcn.005104e0
mov eax, dword [ebp - 0x3a8]
mov ecx, 0x5efb2d
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2f9
call fcn.005104e0
mov eax, dword [ebp - 0x3a4]
mov ecx, str.dwXSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2fa
call fcn.005104e0
mov eax, dword [ebp - 0x3a0]
mov ecx, str.dwYSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2fb
call fcn.005104e0
mov eax, dword [ebp - 0x39c]
mov ecx, str.dwXCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2fc
call fcn.005104e0
mov eax, dword [ebp - 0x398]
mov ecx, str.dwYCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2fd
call fcn.005104e0
mov eax, dword [ebp - 0x394]
mov ecx, str.dwFillAttribute
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2fe
call fcn.005104e0
mov eax, dword [ebp - 0x390]
mov ecx, str.dwFlags
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x2ff
call fcn.005104e0
mov edx, str.StartupInfoA
mov ecx, str.wShowWindow
movzx eax, word [ebp - 0x38c]
mov dword [esp], eax
mov eax, 0x300
call fcn.005104e0
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov ecx, dword [ebp - 0x3d8]
call ecx
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x3bc], 0x44
rep stosd dword es:[edi], eax
mov eax, 1
sub esp, 4
mov dword [ebp - 0x390], 1
mov word [ebp - 0x38c], ax
mov eax, 0x84fdc0
mov dword [ebp - 0x3b0], str.Im_the_title_string
mov dword [ebp - 0x3b4], 0x7ffc64
mov dword [ebp - 0x39c], 0x12121212
mov dword [ebp - 0x398], 0x23232323
mov dword [ebp - 0x3ac], 0x34343434
mov dword [ebp - 0x3a8], 0x45454545
mov dword [ebp - 0x3a4], 0x56565656
mov dword [ebp - 0x3a0], 0x67676767
mov dword [ebp - 0x394], 0xa55a
call fcn.0050d8f0
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
mov dword [esp], esi
call fcn.0050d7a0
mov eax, 0x315
call fcn.0050dc60
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
mov edi, dword [ebp - 0x3d4]
call edi
lea edi, [ebp - 0x3b8]
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
mov eax, ebx
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x3d0]
call edx
mov eax, dword [ebp - 0x3bc]
mov ecx, 0x5efae5
mov edx, str.StartupInfoA
sub esp, 0x10
mov dword [esp], eax
mov eax, 0x319
call fcn.005104e0
mov ecx, str.lpDesktop
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b4]
mov dword [esp], eax
mov eax, 0x31a
call fcn.00510420
mov ecx, str.lpTitle
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b0]
mov dword [esp], eax
mov eax, 0x31b
call fcn.00510420
mov eax, dword [ebp - 0x3ac]
mov ecx, 0x5efb29
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x31c
call fcn.005104e0
mov eax, dword [ebp - 0x3a8]
mov ecx, 0x5efb2d
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x31d
call fcn.005104e0
mov eax, dword [ebp - 0x3a4]
mov ecx, str.dwXSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x31e
call fcn.005104e0
mov eax, dword [ebp - 0x3a0]
mov ecx, str.dwYSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x31f
call fcn.005104e0
mov eax, dword [ebp - 0x39c]
mov ecx, str.dwXCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x320
call fcn.005104e0
mov eax, dword [ebp - 0x398]
mov ecx, str.dwYCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x321
call fcn.005104e0
mov eax, dword [ebp - 0x394]
mov ecx, str.dwFillAttribute
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x322
call fcn.005104e0
mov eax, dword [ebp - 0x390]
mov ecx, str.dwFlags
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x323
call fcn.005104e0
mov edx, str.StartupInfoA
mov ecx, str.wShowWindow
movzx eax, word [ebp - 0x38c]
mov dword [esp], eax
mov eax, 0x324
call fcn.005104e0
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov ecx, dword [ebp - 0x3d8]
call ecx
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x3bc], 0x44
rep stosd dword es:[edi], eax
mov eax, 1
sub esp, 4
mov dword [ebp - 0x390], 1
mov word [ebp - 0x38c], ax
mov eax, 0x84fdc0
mov dword [ebp - 0x3b4], str.winsta0default
mov dword [ebp - 0x39c], 0x12121212
mov dword [ebp - 0x398], 0x23232323
mov dword [ebp - 0x3ac], 0x34343434
mov dword [ebp - 0x3a8], 0x45454545
mov dword [ebp - 0x3a4], 0x56565656
mov dword [ebp - 0x3a0], 0x67676767
mov dword [ebp - 0x394], 0xa55a
call fcn.0050d8f0
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
mov dword [esp], esi
call fcn.0050d7a0
mov eax, 0x339
call fcn.0050dc60
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
mov edi, dword [ebp - 0x3d4]
call edi
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
mov eax, ebx
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x3d0]
call edx
mov eax, dword [ebp - 0x3bc]
mov ecx, 0x5efae5
mov edx, str.StartupInfoA
sub esp, 0x10
mov dword [esp], eax
mov eax, 0x33d
call fcn.005104e0
mov ecx, str.lpDesktop
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b4]
mov dword [esp], eax
mov eax, 0x33e
call fcn.00510420
mov edx, str.lpTitle
mov eax, str.StartupInfoA
call fcn.0050dfd0
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x340
mov eax, dword [0x8f0770]
test eax, eax
jne 0x523220
mov eax, 1
test edi, edi
jne 0x523230
mov dword [esp + 0xc], edi
lea edi, [ebp - 0x3b8]
mov dword [esp], eax
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.expected__s_or_null__got__s_n
call fcn.0050e8b0
mov eax, dword [ebp - 0x3ac]
mov ecx, 0x5efb29
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x342
call fcn.005104e0
mov eax, dword [ebp - 0x3a8]
mov ecx, 0x5efb2d
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x343
call fcn.005104e0
mov eax, dword [ebp - 0x3a4]
mov ecx, str.dwXSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x344
call fcn.005104e0
mov eax, dword [ebp - 0x3a0]
mov ecx, str.dwYSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x345
call fcn.005104e0
mov eax, dword [ebp - 0x39c]
mov ecx, str.dwXCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x346
call fcn.005104e0
mov eax, dword [ebp - 0x398]
mov ecx, str.dwYCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x347
call fcn.005104e0
mov eax, dword [ebp - 0x394]
mov ecx, str.dwFillAttribute
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x348
call fcn.005104e0
mov eax, dword [ebp - 0x390]
mov ecx, str.dwFlags
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x349
call fcn.005104e0
mov edx, str.StartupInfoA
mov ecx, str.wShowWindow
movzx eax, word [ebp - 0x38c]
mov dword [esp], eax
mov eax, 0x34a
call fcn.005104e0
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov eax, dword [ebp - 0x3d8]
call eax
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x3bc], 0x44
rep stosd dword es:[edi], eax
sub esp, 4
lea edi, [ebp - 0x331]
mov eax, 1
mov dword [ebp - 0x390], 1
mov word [ebp - 0x38c], ax
mov dword [ebp - 0x3b0], 0x7ffc64
mov dword [ebp - 0x3b4], str.winsta0default
mov dword [ebp - 0x39c], 0x12121212
mov dword [ebp - 0x398], 0x23232323
mov dword [ebp - 0x3ac], 0x34343434
mov dword [ebp - 0x3a8], 0x45454545
mov dword [ebp - 0x3a4], 0x56565656
mov dword [ebp - 0x3a0], 0x67676767
mov dword [ebp - 0x394], 0xa55a
mov byte [0x84fdc0], 0
mov dword [esp + 4], edi
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
sub esp, 8
mov dword [esp], edi
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5eee65
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
call fcn.0050d7a0
mov eax, 0x35f
call fcn.0050dc60
lea edx, [ebp - 0x3bc]
mov dword [esp + 0x24], ebx
mov dword [esp + 4], esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x3d4]
call edx
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
mov eax, ebx
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp - 0x3d0]
call ecx
mov eax, dword [ebp - 0x3bc]
mov ecx, 0x5efae5
mov edx, str.StartupInfoA
sub esp, 0x10
mov dword [esp], eax
mov eax, 0x363
call fcn.005104e0
mov ecx, str.lpDesktop
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b4]
mov dword [esp], eax
mov eax, 0x364
call fcn.00510420
mov ecx, str.lpTitle
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b0]
mov dword [esp], eax
mov eax, 0x365
call fcn.00510420
mov eax, dword [ebp - 0x3ac]
mov ecx, 0x5efb29
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x366
call fcn.005104e0
mov eax, dword [ebp - 0x3a8]
mov ecx, 0x5efb2d
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x367
call fcn.005104e0
mov eax, dword [ebp - 0x3a4]
mov ecx, str.dwXSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x368
call fcn.005104e0
mov eax, dword [ebp - 0x3a0]
mov ecx, str.dwYSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x369
call fcn.005104e0
mov eax, dword [ebp - 0x39c]
mov ecx, str.dwXCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x36a
call fcn.005104e0
mov eax, dword [ebp - 0x398]
mov ecx, str.dwYCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x36b
call fcn.005104e0
mov eax, dword [ebp - 0x394]
mov ecx, str.dwFillAttribute
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x36c
call fcn.005104e0
mov eax, dword [ebp - 0x390]
mov ecx, str.dwFlags
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x36d
call fcn.005104e0
mov ecx, str.wShowWindow
mov edx, str.StartupInfoA
movzx eax, word [ebp - 0x38c]
mov dword [esp], eax
mov eax, 0x36e
call fcn.005104e0
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov edi, dword [ebp - 0x3d8]
call edi
lea edi, [ebp - 0x3b8]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
sub esp, 4
mov edx, 1
mov eax, 0x84fdc0
mov word [ebp - 0x38c], dx
mov dword [ebp - 0x3bc], 0x44
mov dword [ebp - 0x390], 1
mov dword [ebp - 0x3b0], 0x7ffc64
mov dword [ebp - 0x3b4], 0x7ffc64
mov dword [ebp - 0x39c], 0x12121212
mov dword [ebp - 0x398], 0x23232323
mov dword [ebp - 0x3ac], 0x34343434
mov dword [ebp - 0x3a8], 0x45454545
mov dword [ebp - 0x3a4], 0x56565656
mov dword [ebp - 0x3a0], 0x67676767
mov dword [ebp - 0x394], 0xa55a
call fcn.0050d8f0
mov dword [esp], esi
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
call fcn.0050d7a0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x383
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x24], ebx
mov dword [esp + 4], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x3d4]
call edx
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
mov eax, ebx
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp - 0x3d0]
call ecx
mov eax, dword [ebp - 0x3bc]
mov ecx, 0x5efae5
mov edx, str.StartupInfoA
sub esp, 0x10
mov dword [esp], eax
mov eax, 0x387
call fcn.005104e0
mov ecx, str.lpDesktop
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b4]
mov dword [esp], eax
mov eax, 0x388
call fcn.00510420
mov ecx, str.lpTitle
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3b0]
mov dword [esp], eax
mov eax, 0x389
call fcn.00510420
mov eax, dword [ebp - 0x3ac]
mov ecx, 0x5efb29
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x38a
call fcn.005104e0
mov eax, dword [ebp - 0x3a8]
mov ecx, 0x5efb2d
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x38b
call fcn.005104e0
mov eax, dword [ebp - 0x3a4]
mov ecx, str.dwXSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x38c
call fcn.005104e0
mov eax, dword [ebp - 0x3a0]
mov ecx, str.dwYSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x38d
call fcn.005104e0
mov eax, dword [ebp - 0x39c]
mov ecx, str.dwXCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x38e
call fcn.005104e0
mov eax, dword [ebp - 0x398]
mov ecx, str.dwYCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x38f
call fcn.005104e0
mov eax, dword [ebp - 0x394]
mov ecx, str.dwFillAttribute
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x390
call fcn.005104e0
mov eax, dword [ebp - 0x390]
mov ecx, str.dwFlags
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x391
call fcn.005104e0
mov ecx, str.wShowWindow
mov edx, str.StartupInfoA
movzx eax, word [ebp - 0x38c]
mov dword [esp], eax
mov eax, 0x392
call fcn.005104e0
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov edi, dword [ebp - 0x3d8]
call edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
test edi, edi
je 0x522ade
lea esi, [esi]
mov dword [esp + 4], 0x84fee0
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
sete al
movzx eax, al
jmp 0x522ade