Function at 0x525f40
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5df1a2
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
mov esi, dword [esp + 0x244]
xor ebp, ebp
mov dword [esp + 0x14], ebp
test byte [esi + 0x6c], 1
je 0x526485
push str._shellopen
lea eax, [esi + 0x48]
push eax
lea ecx, [esp + 0xa4]
push ecx
call fcn.00422f00
add esp, 0xc
push ebp
push eax
push ebp
lea ecx, [esp + 0x14c]
mov dword [esp + 0x248], ebp
call fcn.00486a70
mov edx, dword [esp + 0xb8]
push edx
mov byte [esp + 0x240], 2
call fcn.005844d1
mov ebx, 8
add esp, 4
cmp dword [esp + 0xb0], ebx
jb 0x525ff6
mov eax, dword [esp + 0x9c]
push eax
call fcn.00584768
add esp, 4
xor ecx, ecx
mov word [esp + 0x9c], cx
lea ecx, [esp + 0x140]
mov dword [esp + 0xb0], 7
mov dword [esp + 0xac], ebp
call fcn.004863e0
test al, al
jne 0x526072
push str.http_shellopen
lea ecx, [esp + 0x58]
call fcn.00402c90
lea edx, [esp + 0x54]
push edx
push ebp
lea ecx, [esp + 0x148]
mov byte [esp + 0x244], 3
call fcn.004886e0
mov eax, dword [esp + 0x70]
push eax
mov byte [esp + 0x240], 2
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x68], ebx
jb 0x526072
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00584768
add esp, 4
lea ecx, [esp + 0x140]
call fcn.004863e0
test al, al
je 0x52646c
push str.DDEExec
lea ecx, [esp + 0x58]
call fcn.00402c90
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x110]
mov byte [esp + 0x244], 4
call fcn.00486de0
mov ecx, dword [esp + 0x70]
push ecx
mov byte [esp + 0x240], 6
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x68], ebx
jb 0x5260dd
mov edx, dword [esp + 0x54]
push edx
call fcn.00584768
add esp, 4
xor eax, eax
lea ecx, [esp + 0x108]
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], ebp
mov word [esp + 0x54], ax
call fcn.004863e0
test al, al
je 0x526458
xor ecx, ecx
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], ebp
mov word [esp + 0x54], cx
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], ebp
push str.topic
lea ecx, [esp + 0x1d8]
mov byte [esp + 0x240], 7
call fcn.00402c90
lea edx, [esp + 0x1d4]
push edx
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x180]
mov byte [esp + 0x244], 8
call fcn.00486de0
lea ecx, [esp + 0x1d4]
mov byte [esp + 0x23c], 0xa
call fcn.00405eb0
lea ecx, [esp + 0x178]
call fcn.004863e0
test al, al
je 0x5261ba
lea ecx, [esp + 0xe4]
push ecx
lea ecx, [esp + 0x17c]
call fcn.0048dca0
mov edx, dword [str.WWW_OpenURL]
push edx
mov ecx, eax
mov byte [esp + 0x240], 0xb
mov dword [esp + 0x18], 1
call fcn.00420870
test eax, eax
jne 0x5261ba
mov bl, 1
jmp 0x5261bc
xor bl, bl
test byte [esp + 0x14], 1
mov dword [esp + 0x23c], 0xa
je 0x5261da
lea ecx, [esp + 0xe4]
call fcn.00405eb0
test bl, bl
je 0x526436
lea eax, [esp + 0xe4]
push eax
lea ecx, [esp + 0x10c]
call fcn.0048dca0
lea ecx, [esp + 0x54]
mov byte [esp + 0x23c], 0xc
cmp ecx, eax
je 0x52620f
push 0xffffffffffffffff
push ebp
push eax
call fcn.00402610
lea ecx, [esp + 0xe4]
mov byte [esp + 0x23c], 0xa
call fcn.00405eb0
cmp dword [esp + 0x64], ebp
setne al
test al, al
je 0x526436
push 0x5fbd50
lea ecx, [esp + 0x7c]
call fcn.00402c90
push 0x633a14
lea ecx, [esp + 0xc4]
mov byte [esp + 0x240], 0xd
call fcn.00402c90
push ebp
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x248], 0xe
call fcn.004224a0
lea ecx, [esp + 0xc0]
call fcn.00405eb0
lea ecx, [esp + 0x78]
mov byte [esp + 0x23c], 0xa
call fcn.00405eb0
push 0x633a0c
lea ecx, [esp + 0x7c]
call fcn.00402c90
push ebp
push esi
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0x248], 0xf
call fcn.004224a0
cmp eax, 1
lea ecx, [esp + 0x78]
sete bl
mov byte [esp + 0x23c], 0xa
call fcn.00405eb0
test bl, bl
je 0x526436
lea ecx, [esp + 0x13]
call fcn.00432510
push str.application
lea ecx, [esp + 0x1b4]
mov byte [esp + 0x240], 0x10
call fcn.00402c90
lea edx, [esp + 0x1b0]
push edx
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x200]
mov byte [esp + 0x244], 0x11
call fcn.00486de0
lea ecx, [esp + 0x78]
push ecx
mov ecx, eax
mov byte [esp + 0x240], 0x12
call fcn.00525f20
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x240], 0x13
call fcn.00402b70
lea ecx, [esp + 0x78]
call fcn.00405eb0
lea ecx, [esp + 0x1f8]
mov byte [esp + 0x23c], 0x16
call fcn.00488620
lea ecx, [esp + 0x1b0]
mov byte [esp + 0x23c], 0x17
call fcn.00405eb0
mov eax, dword [str.WWW_OpenURL]
push eax
lea ecx, [esp + 0xe8]
call fcn.00402c90
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0xe8]
push edx
lea eax, [esp + 0xc8]
push eax
mov byte [esp + 0x248], 0x18
call fcn.0043c8b0
add esp, 0xc
lea ecx, [esp + 0xe4]
mov bl, al
call fcn.00405eb0
lea ecx, [esp + 0xc0]
call fcn.00405eb0
lea ecx, [esp + 0x13]
mov byte [esp + 0x23c], 0xa
call fcn.00432550
test bl, bl
je 0x526436
lea ecx, [esp + 0x178]
mov byte [esp + 0x23c], 7
call fcn.00488620
lea ecx, [esp + 0x54]
call fcn.00405eb0
lea ecx, [esp + 0x108]
mov byte [esp + 0x23c], 2
call fcn.00488620
lea ecx, [esp + 0x140]
mov dword [esp + 0x23c], 0xffffffff
call fcn.00488620
mov al, 1
jmp 0x5264f1
lea ecx, [esp + 0x178]
mov byte [esp + 0x23c], 7
call fcn.00488620
lea ecx, [esp + 0x54]
call fcn.00405eb0
mov ebx, 8
lea ecx, [esp + 0x108]
mov byte [esp + 0x23c], 2
call fcn.00488620
lea ecx, [esp + 0x140]
mov dword [esp + 0x23c], 0xffffffff
call fcn.00488620
jmp 0x52648a
mov ebx, 8
push 0x3c
lea ecx, [esp + 0x1c]
push ebp
push ecx
call fcn.00585730
add esp, 0xc
push str.file
lea ecx, [esi + 0x48]
mov dword [esp + 0x1c], 0x3c
call fcn.00420870
test eax, eax
lea eax, [esi + 0x24]
je 0x5264b8
mov eax, esi
cmp dword [eax + 0x14], ebx
jb 0x5264c5
mov edx, dword [eax]
mov dword [esp + 0x28], edx
jmp 0x5264c9
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x28], str.open
mov dword [esp + 0x38], 1
mov dword [esp + 0x20], 0x400
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00585b7b
add esp, 0x230
ret