Function at 0x725068
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd
push 0
push 0
dec ecx
jne 0x725070
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x7252ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov dl, 1
mov eax, dword [0x459168]
call fcn.0045b308
mov esi, eax
mov edx, 0x80000000
mov eax, esi
call fcn.0045b3ac
xor ecx, ecx
mov edx, 0x725308
mov eax, esi
call fcn.0045b4f4
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0045bf24
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.00414284
mov eax, dword [ebp - 0x44]
push eax
lea edx, [ebp - 0x4c]
mov eax, dword [0x74eea4]
mov eax, dword [eax]
call fcn.00525950
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00414284
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408a14
test eax, eax
setg bl
test bl, bl
je 0x725150
xor ecx, ecx
mov edx, 0x725348
mov eax, esi
call fcn.0045b4f4
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0045bf24
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.00414284
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x58]
mov eax, dword [0x74eea4]
mov eax, dword [eax]
call fcn.00525950
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00414284
mov eax, dword [ebp - 0x54]
pop edx
call fcn.00408a14
test eax, eax
setg bl
test bl, bl
je 0x7251a5
mov cl, 1
mov edx, 0x725388
mov eax, esi
call fcn.0045b4f4
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0045bf24
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00414284
mov eax, dword [ebp - 0x5c]
push eax
lea edx, [ebp - 0x64]
mov eax, dword [0x74eea4]
mov eax, dword [eax]
call fcn.00525950
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00414284
mov eax, dword [ebp - 0x60]
pop edx
call fcn.00408a14
test eax, eax
setg bl
test bl, bl
jne 0x7252c0
mov ecx, dword [0x74f04c]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x68d5d4]
call fcn.0051a518
mov edx, dword [0x74e660]
mov dword [edx], eax
mov eax, dword [0x74e660]
mov eax, dword [eax]
mov eax, dword [eax + 0x388]
mov edx, 0x7253f4
call fcn.004f4c9c
mov eax, dword [0x74e660]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x110]
mov eax, dword [0x74e660]
mov eax, dword [eax]
cmp dword [eax + 0x2b8], 1
jne 0x72526c
mov eax, dword [0x74e95c]
cmp dword [eax], 6
jl 0x725265
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.004050e0
mov dword [ebp - 0x40], 0x3c
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0x500
lea edx, [ebp - 0x68]
mov eax, dword [0x74eea4]
mov eax, dword [eax]
call fcn.00525950
mov eax, dword [ebp - 0x68]
call fcn.00407f40
mov dword [ebp - 0x30], eax
mov eax, 0x72542c
mov dword [ebp - 0x34], eax
mov eax, 0x725438
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
jmp 0x72526c
mov eax, edi
call fcn.00725484
mov eax, dword [0x74e660]
mov eax, dword [eax]
mov eax, dword [eax + 0x398]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x7252b4
mov eax, dword [0x74e754]
mov eax, dword [eax]
mov byte [eax + 0x28], 0
mov edx, dword [0x74e9c8]
mov edx, dword [edx]
lea eax, [ebp - 0x6c]
mov ecx, 0x72546c
call fcn.00408398
mov edx, dword [ebp - 0x6c]
mov eax, dword [0x74e754]
mov eax, dword [eax]
call fcn.0072d8ac
mov eax, dword [0x74e660]
mov eax, dword [eax]
call fcn.004059f4
mov eax, esi
call fcn.004059f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7252f1
lea eax, [ebp - 0x6c]
mov edx, 0xb
call fcn.00407eac
lea eax, [ebp - 4]
call fcn.00407ea4
ret