Function at 0x5b4a20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
movsx eax, byte [ebp + 0x10]
cmp eax, 0x45
je 0x5b4b4a
mov ecx, 0x326
mov word [ebp - 0x2c], cx
mov dl, byte [ebp + 0xc]
mov byte [ebp - 0x9c], dl
cmp byte [ebp - 0x9c], 0
je 0x5b4a63
cmp byte [ebp - 0x9c], 0xde
je 0x5b4b36
jmp 0x5b4b4a
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x40], ax
mov cl, byte [ebp + 0xc]
mov byte [ebp - 0xa0], cl
cmp byte [ebp - 0xa0], 0
je 0x5b4a8f
cmp byte [ebp - 0xa0], 0xb6
je 0x5b4b0c
jmp 0x5b4b34
movsx edx, word [ebp - 0x40]
mov dword [ebp - 0xa4], edx
cmp dword [ebp - 0xa4], 0x326
je 0x5b4ab3
cmp dword [ebp - 0xa4], 0x6bd
je 0x5b4ae7
jmp 0x5b4b0a
movsx eax, word [ebp - 0x2c]
add eax, 2
movsx ecx, word [ebp - 0x40]
cmp eax, ecx
jle 0x5b4ae5
mov dx, word [ebp + 8]
mov word [ebp - 0x88], dx
mov dword [ebp - 0x14], 0xd96e
mov ax, word [ebp - 0x88]
mov word [ebp - 0x28], ax
mov cl, byte [ebp + 0x10]
mov byte [ebp - 0x41], cl
jmp 0x5b4b0a
movzx edx, byte [ebp + 0xc]
push edx
movzx eax, word [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
movzx edx, byte [ebp + 0xc]
push edx
call fcn.005b4840
mov eax, dword [ebp - 0x14]
sub eax, 0x6bba
mov dword [ebp - 0x14], eax
jmp 0x5b4b34
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x8c]
push edx
push 0xc1
lea eax, [ebp - 0x8c]
push eax
push 0x5a
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WINSPOOL.DRV_EnumFormsA
mov dword [ebp - 0x8c], eax
jmp 0x5b4b4a
push 0x75
push 0x74
movzx edx, word [ebp + 8]
push edx
mov dl, byte [ebp + 0xc]
mov ecx, dword [ebp - 0x28]
call fcn.004012d0
mov al, byte [ebp - 0x41]
mov byte [ebp - 0x21], al
cmp dword [ebp - 0x14], 0x4de4
ja 0x5b4b69
movsx ecx, word [ebp - 0x40]
and ecx, 0x1b7
mov word [ebp - 0x2c], cx
jmp 0x5b4bcb
movzx edx, word [ebp - 0x28]
mov dword [ebp - 0xa8], edx
cmp dword [ebp - 0xa8], 0
je 0x5b4b8a
cmp dword [ebp - 0xa8], 0x68c
je 0x5b4ba8
jmp 0x5b4bcb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x30], ecx
mov dl, byte [ebp + 0xc]
mov byte [ebp - 0xe], dl
mov dword [ebp - 0x20], 0xebf
jmp 0x5b4bcb
movzx eax, byte [ebp - 0xe]
push eax
mov ecx, dword [ebp - 0x30]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x48]
push eax
movzx ecx, byte [ebp - 0xe]
push ecx
call fcn.005b4840
mov edx, dword [ebp - 0x14]
shl edx, 8
mov dword [ebp - 0x48], edx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x90], ecx
mov dl, byte [ebp + 0x10]
mov byte [ebp - 0xac], dl
cmp byte [ebp - 0xac], 0x13
je 0x5b4cb6
cmp byte [ebp - 0xac], 0x56
je 0x5b4c01
jmp 0x5b4cce
mov eax, dword [ebp - 0x34]
push eax
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov dword [ebp - 0x94], eax
movzx edx, byte [ebp - 0xe]
xor edx, 0xd
movzx eax, byte [ebp + 0xc]
cmp edx, eax
je 0x5b4c99
movzx edx, word [ebp - 0x88]
mov eax, dword [ebp - 0x90]
movzx ecx, word [eax]
sar edx, cl
mov ecx, dword [ebp - 0x30]
mov word [ecx], dx
movsx edx, word [ebp - 0x2c]
add edx, 0x7e9
movsx eax, word [ebp - 0x40]
cmp edx, eax
je 0x5b4c72
mov ecx, dword [ebp - 0x14]
and ecx, 0x2077
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 8], eax
mov al, byte [ebp - 0x41]
mov byte [ebp + 0x10], al
jmp 0x5b4c97
movsx ecx, byte [ebp - 0x41]
movsx edx, byte [ebp + 0x10]
sub ecx, edx
movsx eax, byte [ebp - 0x21]
cmp ecx, eax
jge 0x5b4c97
movzx ecx, word [ebp - 0x28]
movzx edx, word [ebp + 8]
add ecx, edx
mov eax, dword [ebp - 0x90]
mov word [eax], cx
jmp 0x5b4cb4
mov ecx, dword [ebp - 0x14]
or ecx, 0x72ab
cmp ecx, dword [ebp - 0x48]
jne 0x5b4cb4
movsx edx, byte [ebp - 0x21]
movsx eax, byte [ebp + 0x10]
sub edx, eax
mov byte [ebp - 0x41], dl
jmp 0x5b4cce
movzx ecx, word [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0x40]
mov cl, byte [ebp - 0x21]
call fcn.00401b70
mov cl, byte [ebp - 0xe]
mov byte [ebp - 1], cl
mov dl, byte [ebp - 0xe]
mov byte [ebp - 0xb0], dl
cmp byte [ebp - 0xb0], 0x14
je 0x5b4ceb
jmp 0x5b4d78
movsx eax, word [ebp - 0x2c]
add eax, 0x2e5
movsx ecx, word [ebp - 0x40]
cmp eax, ecx
jle 0x5b4d67
movzx edx, word [ebp - 0x88]
movzx eax, word [ebp - 0x28]
xor edx, eax
mov ecx, dword [ebp - 0x30]
mov word [ecx], dx
mov edx, dword [ebp - 0x14]
shl edx, 0x69
cmp edx, dword [ebp - 0x48]
ja 0x5b4d65
mov eax, dword [ebp - 0x90]
movzx ecx, word [eax]
movzx edx, word [ebp + 8]
or ecx, edx
mov eax, dword [ebp - 0x30]
mov word [eax], cx
mov cx, word [ebp - 0x88]
mov word [ebp + 8], cx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov word [ebp - 0xc], ax
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax]
push ecx
mov dl, byte [ebp + 0xc]
mov ecx, dword [ebp - 0x88]
call fcn.004012d0
jmp 0x5b4d76
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
sar eax, cl
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x5b4d8d
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x98], eax
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xe]
mov byte [ebp - 0xb4], dl
cmp byte [ebp - 0xb4], 0xa5
je 0x5b4da3
jmp 0x5b4db3
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x90]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x88]
and ecx, edx
mov eax, dword [ebp - 0x90]
mov word [eax], cx
movzx ecx, byte [ebp - 0xd]
movzx edx, byte [ebp - 1]
sub ecx, edx
movzx eax, byte [ebp - 0xe]
movzx edx, byte [ebp + 0xc]
add eax, edx
cmp ecx, eax
jl 0x5b4e13
mov eax, dword [ebp - 0x98]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x48]
mov dword [ebp - 0x38], edx
lea eax, [ebp - 0x3c]
push eax
push 1
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
mov dword [ebp - 0x8c], eax
mov eax, 5
mov esp, ebp
pop ebp
ret