Function at 0x59ecb4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 8
push 0
push 0
dec ecx
jne 0x59ecbd
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x59f1c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x364]
mov edx, dword [0x46c994]
call fcn.0040407c
test al, al
je 0x59ed18
mov eax, dword [edi + 0x364]
mov edx, dword [0x46c994]
call fcn.004040a0
cmp byte [eax + 0x20e], 0
jne 0x59f1a1
jmp 0x59ed4b
mov eax, dword [edi + 0x364]
mov edx, dword [0x46d468]
call fcn.0040407c
test al, al
je 0x59ed4b
mov eax, dword [edi + 0x364]
mov edx, dword [0x46d468]
call fcn.004040a0
cmp byte [eax + 0x20e], 0
jne 0x59f1a1
cmp word [esi], 0x59
jne 0x59ed6a
mov al, byte [0x59f1d4]
cmp al, bl
jne 0x59ed6a
mov eax, dword [edi + 0x364]
call fcn.00593f94
jmp 0x59f067
cmp word [esi], 0x56
jne 0x59ed96
mov al, byte [0x59f1d4]
cmp al, bl
jne 0x59ed96
push 0x40
mov ecx, 0x59f1d8
mov edx, 0x59f1e0
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a04e8
jmp 0x59f067
cmp word [esi], 0x45
jne 0x59f067
mov al, byte [0x59f1d4]
cmp al, bl
jne 0x59f067
cmp dword [0x67c834], 1
sbb eax, eax
inc eax
test al, al
je 0x59edd5
xor edx, edx
mov eax, 0x59f1fc
call fcn.005938c8
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x59f1a1
xor eax, eax
mov dword [edi + 0x360], eax
mov eax, dword [edi + 0x26c]
call fcn.004563d8
mov eax, dword [edi + 0x26c]
call fcn.00455f44
mov eax, dword [edi + 0x26c]
call fcn.00456424
mov eax, dword [edi + 0x364]
mov edx, dword [eax + 0x80]
mov eax, 0x59f210
call fcn.00405284
dec eax
jle 0x59ee57
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [edi + 0x364]
mov eax, dword [eax + 0x80]
call fcn.004094f8
mov edx, dword [ebp - 0x10]
mov eax, 0x59f210
call fcn.00405284
mov ecx, eax
dec ecx
mov eax, dword [edi + 0x364]
mov eax, dword [eax + 0x80]
mov edx, 1
call fcn.004051a0
jmp 0x59ee6b
lea eax, [ebp - 8]
mov edx, dword [edi + 0x364]
mov edx, dword [edx + 0x80]
call fcn.00404d18
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00523a78
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.00404d18
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004094f8
mov edx, dword [ebp - 0x18]
mov eax, 0x59f21c
call fcn.00405284
test eax, eax
jle 0x59ef1b
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x59f230
call fcn.00405284
mov edx, eax
inc edx
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
call fcn.004051a0
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x59f23c
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004051a0
push 0x40
push 0x59f248
push dword [ebp - 8]
push 0x59f25c
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405000
mov eax, dword [ebp - 0x1c]
call fcn.00405140
mov edx, eax
mov ecx, 0x59f1d8
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a04e8
jmp 0x59f067
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.004094f8
mov edx, dword [ebp - 0x20]
mov eax, 0x59f274
call fcn.00405284
test eax, eax
jg 0x59ef53
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.004094f8
mov edx, dword [ebp - 0x24]
mov eax, 0x59f284
call fcn.00405284
test eax, eax
jle 0x59ef70
push 0x40
mov ecx, 0x59f1d8
mov edx, 0x59f28c
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a04e8
jmp 0x59f067
mov edx, dword [ebp - 8]
mov eax, 0x59f2b0
call fcn.00405284
dec eax
je 0x59ef8b
xor eax, eax
call fcn.005282d4
test eax, eax
je 0x59efa0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00528cbc
jmp 0x59f067
lea edx, [ebp - 0x30]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040a5a0
push dword [ebp - 0x2c]
push 0x59f2bc
push dword [ebp - 8]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405000
mov eax, dword [ebp - 0x28]
call fcn.0040a15c
test al, al
je 0x59f02d
push 1
push 0
push 0
lea edx, [ebp - 0x3c]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040a5a0
push dword [ebp - 0x38]
push 0x59f2bc
push dword [ebp - 8]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00405000
mov eax, dword [ebp - 0x34]
call fcn.00405140
push eax
push 0x59f2c8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x59f067
lea edx, [ebp - 0x48]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.0040a5a0
push dword [ebp - 0x44]
push 0x59f2bc
push dword [ebp - 8]
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.00405000
mov eax, dword [ebp - 0x40]
call fcn.00593b78
movzx eax, word [esi]
cmp eax, 0x21
jge 0x59f08b
sub eax, 8
je 0x59f122
sub eax, 5
je 0x59f0a3
sub eax, 0xe
je 0x59f117
jmp 0x59f13a
add eax, 0xffffffdf
sub eax, 7
jb 0x59f0ed
je 0x59f0be
sub eax, 6
je 0x59f122
jmp 0x59f13a
mov eax, edi
call fcn.0059f790
test eax, eax
je 0x59f186
mov eax, edi
call fcn.005a1cd8
jmp 0x59f186
mov eax, edi
call fcn.0059f790
test eax, eax
jne 0x59f0df
or edx, 0xffffffff
mov eax, edi
call fcn.0059f990
mov eax, edi
call fcn.0059e7e8
jmp 0x59f186
xor edx, edx
mov eax, edi
call fcn.0059f990
jmp 0x59f186
mov eax, edi
call fcn.0059f790
test eax, eax
je 0x59f10e
push 0
push 0x26
push pe_nt_image_headers32
mov eax, edi
call fcn.00485df4
push eax
call sub.user32.dll_PostMessageA
mov eax, edi
call fcn.0047f884
jmp 0x59f186
xor edx, edx
mov eax, edi
call fcn.0059f798
jmp 0x59f186
cmp dword [edi + 0x34c], 0
jne 0x59f186
xor edx, edx
mov eax, dword [edi + 0x364]
call fcn.0047f338
jmp 0x59f186
cmp dword [edi + 0x34c], 0
jne 0x59f186
mov al, byte [0x59f2d0]
cmp al, bl
jne 0x59f186
or edx, 0xffffffff
mov eax, edi
call fcn.0059f990
mov word [ebp - 0xa], 0x20
mov al, byte [0x59f2d0]
push eax
lea ecx, [ebp - 0xa]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.005a2110
cmp dword [edi + 0x350], 0
je 0x59f186
mov eax, dword [edi + 0x350]
mov edx, dword [eax]
call dword [edx + 0xc4]
cmp dword [edi + 0x378], 0
je 0x59f1a1
push ebx
mov ecx, esi
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x37c]
call dword [edi + 0x378]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59f1cb
lea eax, [ebp - 0x48]
mov edx, 0xf
call fcn.00404ca4
lea eax, [ebp - 8]
call fcn.00404c80
ret