Function at 0x4524b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
mov eax, dword [0x5ee6d8]
test ah, 4
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], esi
je 0x4524eb
mov edx, dword [esi]
push 0xb
push 0
xor ecx, ecx
call fcn.004803b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 4]
test eax, eax
mov edx, 1
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 5
je 0x452567
cmp byte [eax], 0x2d
jne 0x452567
push 0x6e
push eax
call fcn.005912e0
add esp, 8
test eax, eax
je 0x452527
mov dword [esp + 0x18], 7
mov eax, dword [esi + 4]
push 0x68
push eax
call fcn.005912e0
add esp, 8
test eax, eax
je 0x452541
mov dword [esp + 0x18], 0
mov ecx, dword [esi + 4]
push 0x70
push ecx
call fcn.005912e0
add esp, 8
test eax, eax
je 0x45255b
mov dword [esp + 0x24], 1
mov dword [esp + 0x10], 2
mov edx, dword [esp + 0x10]
mov eax, dword [esi + edx*4]
test eax, eax
lea ebx, [esi + edx*4]
jne 0x452585
mov edx, dword [esi]
push eax
push eax
xor ecx, ecx
call fcn.004803b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [eax], 0x22
jne 0x4525b7
push 0
push 0x104
push edi
mov ecx, esi
call fcn.00504590
test eax, eax
jge 0x4526b7
mov edx, dword [esi]
push 3
push 0
xor ecx, ecx
call fcn.004803b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [edi], 0
cmp dword [ebx], 0
je 0x4526bc
mov dword [esp + 0x1c], ebx
cmp byte [edi], 0
je 0x452617
mov al, byte [edi + 1]
test al, al
je 0x452617
mov edx, dword [ebx]
push 0x3a
push edx
call fcn.005912e0
add esp, 8
test eax, eax
jne 0x4526bc
mov esi, dword [ebp + 8]
push esi
push 0x5a73e0
push edi
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x1f
ja 0x4526bf
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x452602
mov ax, word [0x5a5348]
mov word [edi], ax
mov edi, dword [esp + 0x14]
mov eax, dword [ebx]
mov edx, eax
jmp 0x452620
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452620
sub eax, edx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x452630
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ecx, dword [ebx]
mov edx, esi
nop
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x452650
mov edx, 0x5a73d8
mov ecx, esi
call fcn.00420250
test eax, eax
jne 0x4526af
mov edx, 0x5a73d0
mov ecx, esi
call fcn.00420250
test eax, eax
jne 0x4526af
mov edx, 0x5a73c8
mov ecx, esi
call fcn.00420250
test eax, eax
mov edi, dword [esp + 0x14]
jne 0x4526b3
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add ebx, 4
inc edx
test eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ebx
jne 0x4525c7
jmp 0x4526bc
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov esi, dword [ebp + 8]
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
mov edx, esi
mov byte [esi], 0
call fcn.005039a0
cmp byte [edi], 0
jne 0x4526ee
cmp byte [esi], 0
je 0x4526ee
mov edx, edi
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4526e2
mov byte [esi], cl
xor eax, eax
mov ecx, 0xf9
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
test eax, eax
mov edi, dword [esp + 0x14]
je 0x452741
push 0x5c5d18
push 0x5c5c18
push 0x5c5b18
push 0x5c5b14
push edi
call fcn.00591920
push 0x5c5b18
push 0x5c5b14
lea edx, [esp + 0x44]
push 0x5a49b4
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
mov al, byte [esp + 0x28]
test al, al
jne 0x45275f
xor eax, eax
jmp 0x452750
mov cl, byte [eax + 0x5ee048]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x452750
mov eax, dword [esp + 0x18]
mov edx, dword [0x5f92ec]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
push edi
push 0
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x452798
mov eax, dword [esp + 0x20]
mov edx, dword [eax]
push 4
push edi
xor ecx, ecx
call fcn.004803b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4