Function at 0x52d854
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff900
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x700], ecx
mov dword [ebp - 0x6f0], ecx
mov dword [ebp - 0x6f4], ecx
mov dword [ebp - 0x6f8], ecx
mov dword [ebp - 0x6fc], ecx
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x6e8], ecx
mov esi, edx
lea edi, [ebp - 0x104]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52dbff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.0040520c
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
xor ecx, ecx
mov edx, 0x52dc18
call fcn.0040510c
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.00404d40
xor ecx, ecx
mov edx, 0x52dc40
lea eax, [ebp - 0x3e0]
call fcn.0040510c
lea eax, [ebp - 0x3e0]
call fcn.00404d4c
lea edx, [ebp - 0x4e0]
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
mov ecx, 0xff
call fcn.00405ca8
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.00405db8
lea edx, [ebp - 0x4e0]
lea eax, [ebp - 0x3e0]
call fcn.00406584
call fcn.004069b4
lea eax, [ebp - 0x4e0]
mov edx, 0x52dc5c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00409750
jne 0x52d8f6
lea edx, [ebp - 0x4e0]
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
mov ecx, 0xff
call fcn.00405ca8
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.00405db8
mov eax, dword [ebp + 8]
lea edx, [eax - 0x4dc]
lea eax, [ebp - 0x3e0]
call fcn.00406584
call fcn.004069b4
lea edx, [ebp - 0x4e0]
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
mov ecx, 0xff
call fcn.00405ca8
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.00405db8
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x3e0]
call fcn.0040657c
call fcn.004069b4
lea edx, [ebp - 0x4e0]
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
mov ecx, 0xff
call fcn.00405ca8
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.00405db8
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x3e0]
call fcn.00406584
call fcn.004069b4
lea edx, [ebp - 0x4e0]
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
mov ecx, 0xff
call fcn.00405ca8
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.00405db8
lea edx, [ebp - 0x4e0]
lea eax, [ebp - 0x3e0]
call fcn.00406584
call fcn.004069b4
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.00405264
test al, al
je 0x52d9f9
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.0040520c
mov eax, dword [ebp + 8]
add eax, 0xfffffc24
call fcn.00405290
lea eax, [ebp - 0x3e0]
call fcn.0040520c
mov edx, 0x52dc18
lea eax, [ebp - 0x3e0]
call fcn.00405e2c
lea edx, [ebp - 0x6e8]
mov eax, 2
call fcn.004049bc
mov edx, dword [ebp - 0x6e8]
lea eax, [ebp - 0x5e0]
mov ecx, 0xff
call fcn.00409fc4
lea edx, [ebp - 0x6ec]
mov eax, 4
call fcn.004049bc
mov edx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x6e0]
mov ecx, 0xff
call fcn.00409fc4
jmp 0x52dae5
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x100]
mov eax, dword [ebp + 8]
add eax, 0xffffff00
mov ecx, 1
call fcn.0040985c
mov eax, dword [ebp + 8]
cmp byte [eax - 0x100], 2
ja 0x52dac8
push 0x52dc80
lea eax, [ebp - 0x6f4]
mov edx, dword [ebp + 8]
add edx, 0xffffff00
mov ecx, 0
call fcn.0040996c
push dword [ebp - 0x6f4]
push 0x52dc9c
lea eax, [ebp - 0x6f8]
lea edx, [ebp - 0x5e0]
mov ecx, 0
call fcn.0040996c
push dword [ebp - 0x6f8]
push 0x52dc9c
lea eax, [ebp - 0x6fc]
lea edx, [ebp - 0x6e0]
mov ecx, 0
call fcn.0040996c
push dword [ebp - 0x6fc]
push 0x52dcac
lea eax, [ebp - 0x6f0]
mov edx, 7
call fcn.00409a98
mov edx, dword [ebp - 0x6f0]
lea eax, [ebp - 0x4e0]
mov ecx, 0xff
call fcn.00409998
call fcn.0040495c
cmp eax, 3
jle 0x52dbae
lea edx, [ebp - 0x700]
mov eax, 4
call fcn.004049bc
mov eax, dword [ebp - 0x700]
mov edx, 0x52dcbc
call fcn.0040a24c
je 0x52dbbc
push 1
lea eax, [ebp - 0x4df]
push eax
call sub.kernel32.dll_WinExec
mov eax, 0x1b
call fcn.00408f58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52dc06
lea eax, [ebp - 0x700]
call fcn.004090fc
lea eax, [ebp - 0x6fc]
mov edx, 4
call fcn.0040918c
lea eax, [ebp - 0x6ec]
mov edx, 2
call fcn.0040915c
ret