Function at 0x525b78
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x6b
push 0
push 0
dec ecx
jne 0x525b80
push ebx
push esi
mov ebx, eax
lea esi, [ebp - 0x2d4]
xor eax, eax
push ebp
push 0x525ee7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x318]
xor eax, eax
call fcn.004048bc
mov eax, dword [ebp - 0x318]
lea edx, [ebp - 0x314]
call fcn.004138f4
mov edx, dword [ebp - 0x314]
lea eax, [ebp - 4]
mov ecx, 0x525f00
call fcn.00407b90
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00404c6c
mov eax, esi
call fcn.00404a04
call fcn.00404650
mov edx, 0x525f2c
mov eax, esi
call fcn.0040806c
call fcn.004050c8
call fcn.00404650
mov edx, 0x525f4c
mov eax, esi
call fcn.0040806c
call fcn.004050c8
call fcn.00404650
push 0x525f64
lea edx, [ebp - 0x320]
xor eax, eax
call fcn.004048bc
push dword [ebp - 0x320]
push 0x525f7c
lea eax, [ebp - 0x31c]
mov edx, 3
call fcn.00407c74
mov edx, dword [ebp - 0x31c]
mov eax, esi
call fcn.0040806c
call fcn.004050c8
call fcn.00404650
push 0x525f8c
lea edx, [ebp - 0x328]
xor eax, eax
call fcn.004048bc
push dword [ebp - 0x328]
push 0x525f7c
push 0x525fb0
lea eax, [ebp - 0x324]
mov edx, 4
call fcn.00407c74
mov edx, dword [ebp - 0x324]
mov eax, esi
call fcn.0040806c
call fcn.004050c8
call fcn.00404650
mov edx, 0x525fd4
mov eax, esi
call fcn.0040806c
call fcn.004050c8
call fcn.00404650
push 0x525ff0
push dword [ebx + 0x3dc]
lea edx, [ebp - 0x334]
mov eax, dword [0x534dc8]
mov eax, dword [eax]
call fcn.004a5344
mov eax, dword [ebp - 0x334]
lea edx, [ebp - 0x330]
call fcn.00413930
push dword [ebp - 0x330]
push 0x52600c
push dword [ebx + 0x3d8]
lea edx, [ebp - 0x33c]
mov eax, dword [0x534dc8]
mov eax, dword [eax]
call fcn.004a5344
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x338]
call fcn.00413930
push dword [ebp - 0x338]
push 0x525f7c
lea eax, [ebp - 0x32c]
mov edx, 7
call fcn.00407c74
mov edx, dword [ebp - 0x32c]
mov eax, esi
call fcn.0040806c
call fcn.004050c8
call fcn.00404650
push 0x526020
push dword [ebx + 0x3d8]
lea edx, [ebp - 0x348]
mov eax, dword [0x534dc8]
mov eax, dword [eax]
call fcn.004a5344
mov eax, dword [ebp - 0x348]
lea edx, [ebp - 0x344]
call fcn.00413930
push dword [ebp - 0x344]
push 0x525f7c
push 0x52604c
lea eax, [ebp - 0x340]
mov edx, 5
call fcn.00407c74
mov edx, dword [ebp - 0x340]
mov eax, esi
call fcn.0040806c
call fcn.004050c8
call fcn.00404650
push 0x525f64
push dword [ebx + 0x3dc]
lea edx, [ebp - 0x354]
mov eax, dword [0x534dc8]
mov eax, dword [eax]
call fcn.004a5344
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
call fcn.00413930
push dword [ebp - 0x350]
push 0x525f7c
lea eax, [ebp - 0x34c]
mov edx, 4
call fcn.00407c74
mov edx, dword [ebp - 0x34c]
mov eax, esi
call fcn.0040806c
call fcn.004050c8
call fcn.00404650
push 0x525f64
push dword [ebp - 4]
push 0x525f7c
lea eax, [ebp - 0x358]
mov edx, 3
call fcn.00407c74
mov edx, dword [ebp - 0x358]
mov eax, esi
call fcn.0040806c
call fcn.004050c8
call fcn.00404650
mov eax, esi
call fcn.00404d30
call fcn.00404650
lea eax, [ebp - 0x310]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404e14
mov dword [ebp - 0x310], 0x3c
mov dword [ebp - 0x30c], 0x40
xor eax, eax
mov dword [ebp - 0x308], eax
xor eax, eax
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 4]
call fcn.00407750
mov dword [ebp - 0x300], eax
mov eax, 0x526064
mov dword [ebp - 0x2fc], eax
xor eax, eax
mov dword [ebp - 0x2f8], eax
xor eax, eax
mov dword [ebp - 0x2f4], eax
xor eax, eax
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 0x310]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x525eee
lea eax, [ebp - 0x358]
mov edx, 0x12
call fcn.004076bc
lea eax, [ebp - 4]
call fcn.004076b4
ret