Function at 0x5b3ea0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5dcf
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x638fe4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.http:__rs.ciggws.net_rd.cgi_
lea ecx, [ebp - 0x2c]
call fcn.00403280
mov dword [ebp - 4], 0
call fcn.00418413
mov ecx, eax
test ecx, ecx
jne 0x5b3ef3
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b3f08
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5b3f0a
call edx
add eax, 0x10
mov dword [ebp - 0x24], eax
push 0xb
push str.FNCSU_INFO
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00403620
call fcn.00418413
mov ecx, eax
test ecx, ecx
jne 0x5b3f38
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b3f4d
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5b3f4f
call edx
add eax, 0x10
mov dword [ebp - 0x20], eax
push 0x23c9
mov edx, esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.005b5f80
add esp, 4
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x20]
push str.LNG_s
push eax
call fcn.00402e70
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
add ecx, 0xfffffff0
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x5b3fe6
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x18], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b3fe1
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x18], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b3fda
push 0
push dword [edx + 4]
call ebx
jmp 0x5b3fe6
mov ecx, edx
call dword [ebp - 0x18]
jmp 0x5b3fe6
mov ecx, edx
call dword [ebp - 0x18]
call fcn.00418413
mov ecx, eax
test ecx, ecx
jne 0x5b3ffb
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b4010
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5b4012
call edx
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 0x20013
mov edx, esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18]
call fcn.005b5f80
add esp, 4
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x1c]
push str.DEV_s
push eax
call fcn.00402e70
mov byte [ebp - 4], 4
add esp, 0xc
mov ecx, dword [ebp - 0x18]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b4086
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b4082
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b4082
push 0
push dword [edx + 4]
call ebx
jmp 0x5b4086
mov ecx, edx
call esi
call fcn.00418413
mov ecx, eax
test ecx, ecx
jne 0x5b409b
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b40b0
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5b40b2
call edx
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
call fcn.00418413
mov ecx, eax
test ecx, ecx
jne 0x5b40d1
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b40e6
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5b40e8
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 7
push 0x610460
push eax
call fcn.00402e70
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push esi
push str.OSV_s
push eax
call fcn.00402e70
add esp, 0x14
call fcn.00418413
mov ecx, eax
test ecx, ecx
jne 0x5b412a
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b413f
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5b4141
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x610d84
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 8
push str.CHA_s
push eax
call fcn.00402e70
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004030d0
add esp, 0xc
push 0x610558
push eax
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 9
push eax
call fcn.004087e0
add esp, 0xc
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xa
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004030d0
add esp, 0xc
push 0x610558
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xb
push eax
call fcn.004087e0
add esp, 0xc
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004030d0
add esp, 0xc
push 0x610558
push eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0xd
push eax
call fcn.004087e0
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xe
push ecx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004030d0
add esp, 0xc
push 0x610558
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xf
push eax
call fcn.004087e0
add esp, 0xc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x10
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004030d0
mov byte [ebp - 4], 0xf
add esp, 0xc
mov ecx, dword [ebp - 0x30]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b4279
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b4274
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b426d
push 0
push dword [edx + 4]
call ebx
jmp 0x5b4279
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b4279
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 0xe
mov eax, edi
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b42d1
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b42cc
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b42c5
push 0
push dword [edx + 4]
call ebx
jmp 0x5b42d1
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b42d1
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 0xd
mov eax, edi
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b4329
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b4324
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b431d
push 0
push dword [edx + 4]
call ebx
jmp 0x5b4329
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b4329
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 0xc
mov eax, edi
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b4381
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b437c
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b4375
push 0
push dword [edx + 4]
call ebx
jmp 0x5b4381
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b4381
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 0xb
mov eax, edi
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b43d9
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b43d4
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b43cd
push 0
push dword [edx + 4]
call ebx
jmp 0x5b43d9
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b43d9
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 0xa
mov eax, edi
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b4431
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b442c
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b4425
push 0
push dword [edx + 4]
call ebx
jmp 0x5b4431
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b4431
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 9
mov eax, edi
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b4489
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b4484
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b447d
push 0
push dword [edx + 4]
call ebx
jmp 0x5b4489
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b4489
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 8
mov eax, edi
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b44de
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b44d9
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b44d2
push 0
push dword [edx + 4]
call ebx
jmp 0x5b44de
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b44de
mov ecx, edx
call dword [ebp - 0x34]
push 5
push 0
push 0x60ab98
push dword [ebp - 0x28]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x28]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b454b
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b4546
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b453f
push 0
push dword [edx + 4]
call ebx
jmp 0x5b454b
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b454b
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 7
mov eax, edi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b45a3
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b459e
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b4597
push 0
push dword [edx + 4]
call ebx
jmp 0x5b45a3
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x5b45a3
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 6
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5b45df
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b45dd
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b45dd
push 0
push dword [ecx + 4]
call ebx
jmp 0x5b45df
call edx
mov byte [ebp - 4], 4
mov eax, edi
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b4620
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b461c
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b461c
push 0
push dword [edx + 4]
call ebx
jmp 0x5b4620
mov ecx, edx
call esi
mov byte [ebp - 4], 2
mov eax, edi
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b4661
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b465d
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b465d
push 0
push dword [edx + 4]
call ebx
jmp 0x5b4661
mov ecx, edx
call esi
mov byte [ebp - 4], 1
mov eax, edi
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b46a2
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b469e
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b469e
push 0
push dword [edx + 4]
call ebx
jmp 0x5b46a2
mov ecx, edx
call esi
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b46e3
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b46df
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b46df
push 0
push dword [edx + 4]
call ebx
jmp 0x5b46e3
mov ecx, edx
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x5b4725
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b4721
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b4721
push 0
push dword [edx + 4]
call ebx
jmp 0x5b4725
mov ecx, edx
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret