Function at 0x5c96ed
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1a
push 0
push 0
dec ecx
jne 0x5c919c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5c9889
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x38]
mov ecx, dword [0x61e1c0]
mov edx, dword [0x61e0e4]
call fcn.004047c4
mov eax, dword [ebp - 0x38]
call fcn.00409c58
test al, al
jne 0x5c920c
lea eax, [ebp - 0x3c]
push eax
mov edx, dword [0x61e1c0]
mov eax, 0x5c98a0
call fcn.00404abc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x61e1c0]
call fcn.004049d8
mov edx, dword [ebp - 0x3c]
mov eax, 0x61e1c0
mov ecx, 0x5c98ac
call fcn.004047c4
lea eax, [ebp - 0x40]
mov ecx, dword [0x61e1c0]
mov edx, dword [0x61e0e4]
call fcn.004047c4
mov eax, dword [ebp - 0x40]
call fcn.00409c58
test al, al
je 0x5c980d
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x21], 0
mov eax, 0x5c98bc
call fcn.005c50ac
mov dword [0x61e1cc], eax
mov eax, dword [0x61e1cc]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
jne 0x5c9264
mov dl, 1
mov eax, 0x5c98f4
call fcn.005c9a54
mov dl, 1
mov eax, dword [0x41c44c]
call fcn.00403594
mov esi, eax
lea eax, [ebp - 0x44]
mov ecx, dword [0x61e1c0]
mov edx, dword [0x61e0e4]
call fcn.004047c4
mov edx, dword [ebp - 0x44]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x28]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, esi
call fcn.004035c4
mov edx, 0x5c9924
mov eax, dword [0x61e1cc]
call fcn.004cc68c
lea edx, [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
call fcn.0040b214
fstp qword [ebp - 0x20]
wait
fld xword [0x5c992c]
fadd qword [ebp - 0x20]
fstp qword [ebp - 0x20]
wait
fld qword [ebp - 0x20]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x4c]
call fcn.0040b094
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
mov edx, 0x5c9940
call fcn.004047c4
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x28]
call fcn.00404abc
test eax, eax
je 0x5c9772
push 1
lea eax, [ebp - 0xc]
push eax
push 0x5c9940
fld qword [ebp - 0x20]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x54]
call fcn.0040b094
push dword [ebp - 0x54]
push 0x5c994c
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00404838
mov edx, dword [ebp - 0x50]
mov ecx, 0x5c9940
mov eax, dword [ebp - 0x28]
call fcn.005c89d4
fld qword [ebp - 0x20]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x10]
call fcn.0040b094
push 1
lea eax, [ebp - 0x14]
push eax
push 0x5c9940
fld qword [ebp - 0x20]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x5c]
call fcn.0040b094
push dword [ebp - 0x5c]
push 0x5c9940
push dword [ebp - 0xc]
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404838
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x60]
mov ecx, 0x5c9940
mov edx, dword [ebp - 0x28]
call fcn.004047c4
mov eax, dword [ebp - 0x60]
mov ecx, 0x5c9940
pop edx
call fcn.005c89d4
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404778
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.004049d8
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
call fcn.00415a3c
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x94]
mov edx, 1
mov cl, 1
call fcn.004157e8
lea eax, [ebp - 0x94]
push eax
cmp dword [ebp - 0xc], 0
sete al
pop edx
pop ecx
call fcn.005c9e78
lea edx, [ebp - 0x70]
lea eax, [ebp - 0xc]
call fcn.00414970
mov eax, dword [0x60f138]
mov eax, dword [eax]
mov eax, dword [eax + 0x5c]
call fcn.004d40f8
mov dword [ebp - 0x34], 1
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x14]
call fcn.00409198
mov eax, dword [ebp - 0x98]
mov ecx, 0x5c9958
mov edx, dword [ebp - 0x34]
call fcn.005c9ae8
jmp 0x5c9715
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0xc]
call fcn.00409198
mov eax, dword [ebp - 0x9c]
mov edx, 0x5c9964
call fcn.004048c4
jne 0x5c960a
xor eax, eax
push ebp
push 0x5c94df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x60f138]
mov eax, dword [eax]
mov eax, dword [eax + 0x60]
call fcn.004cb590
mov eax, dword [0x60f138]
mov eax, dword [eax]
mov eax, dword [eax + 0x60]
call fcn.004dfd90
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x60f138]
mov eax, dword [eax]
mov eax, dword [eax + 0x60]
call fcn.004dfd90
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x60f138]
mov eax, dword [eax]
mov eax, dword [eax + 0x60]
call fcn.004dfcb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c95fb
cmp byte [ebp - 0x22], 0
jne 0x5c973c
jmp 0x5c96ed
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 0xc]
call fcn.00409198
mov eax, dword [ebp - 0xb0]
mov edx, 0x5c99e8
call fcn.004048c4
jne 0x5c96ed
cmp byte [ebp - 0x21], 0
jne 0x5c964c
mov eax, 0x5c99f4
call fcn.00409c58
test al, al
je 0x5c964c
mov eax, 0x5c99f4
call fcn.00409d80
mov byte [ebp - 0x21], 1
lea edx, [ebp - 0xb8]
mov eax, dword [0x60ece4]
mov eax, dword [eax]
call fcn.0049326c
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.00409e18
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 0x30]
mov ecx, 0x5c99f4
call fcn.004047c4
xor eax, eax
push ebp
push 0x5c96e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c44c]
call fcn.00403594
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
call fcn.00409c58
test al, al
je 0x5c96ba
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c96ed
mov eax, dword [ebp - 0x2c]
call fcn.004035c4
ret
inc dword [ebp - 0x34]
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0x14]
call fcn.00409198
mov eax, dword [ebp - 0xbc]
mov ecx, 0x5c9958
mov edx, dword [ebp - 0x34]
call fcn.005c9ae8
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 8]
call fcn.00409198
cmp dword [ebp - 0xc0], 0
je 0x5c973c
mov eax, dword [ebp - 8]
call fcn.00404778
test eax, eax
jg 0x5c9457
cmp byte [ebp - 0x22], 0
je 0x5c9753
mov eax, dword [0x60f138]
mov eax, dword [eax]
mov eax, dword [eax + 0x5c]
call fcn.004d4144
jmp 0x5c9772
mov eax, dword [0x60f138]
mov eax, dword [eax]
mov eax, dword [eax + 0x5c]
call fcn.004d4118
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404550
jmp 0x5c92c4
cmp dword [ebp - 0x18], 0
je 0x5c97d0
mov eax, dword [ebp - 0x18]
call fcn.00404778
test eax, eax
jle 0x5c97d0
mov eax, dword [ebp - 0x18]
call fcn.0040b214
fstp xword [ebp - 0xcc]
wait
mov eax, dword [ebp - 4]
call fcn.0040b214
fld xword [ebp - 0xcc]
fcompp
fnstsw ax
sahf
jbe 0x5c97d0
push 0x5c9a04
push dword [ebp - 0x18]
push 0x5c9a28
lea eax, [ebp - 0xd0]
mov edx, 3
call fcn.00404838
mov eax, dword [ebp - 0xd0]
call fcn.005c4b94
cmp byte [ebp - 0x21], 0
je 0x5c97fc
push 1
push 0x5c9a40
push 0x5c9a40
push 0x5c9a44
push 0x5c9a4c
mov eax, dword [0x60ece4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x60f138]
mov eax, dword [eax]
mov eax, dword [eax + 0x64]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c9890
lea eax, [ebp - 0xd0]
call fcn.004044b8
lea eax, [ebp - 0xc0]
mov edx, 0xb
call fcn.004044dc
lea eax, [ebp - 0x94]
call fcn.004112f0
lea eax, [ebp - 0x84]
call fcn.004044b8
lea eax, [ebp - 0x80]
mov edx, dword [0x40113c]
mov ecx, 2
call fcn.00405118
lea eax, [ebp - 0x60]
mov edx, 0xb
call fcn.004044dc
lea eax, [ebp - 0x30]
call fcn.004044b8
lea eax, [ebp - 0x28]
call fcn.004044b8
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004044dc
ret