Function at 0x525ce8
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x6b
push 0
push 0
dec ecx
jne 0x525cf0
push ebx
push esi
mov ebx, eax
lea esi, [ebp - 0x2d4]
xor eax, eax
push ebp
push 0x526057
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x318]
xor eax, eax
call fcn.004048bc
mov eax, dword [ebp - 0x318]
lea edx, [ebp - 0x314]
call fcn.0041398c
mov edx, dword [ebp - 0x314]
lea eax, [ebp - 4]
mov ecx, 0x526070
call fcn.00407b68
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00404c6c
mov eax, esi
call fcn.00404a04
call fcn.00404650
mov edx, 0x52609c
mov eax, esi
call fcn.00408044
call fcn.004050c8
call fcn.00404650
mov edx, 0x5260bc
mov eax, esi
call fcn.00408044
call fcn.004050c8
call fcn.00404650
push 0x5260d4
lea edx, [ebp - 0x320]
xor eax, eax
call fcn.004048bc
push dword [ebp - 0x320]
push 0x5260ec
lea eax, [ebp - 0x31c]
mov edx, 3
call fcn.00407c4c
mov edx, dword [ebp - 0x31c]
mov eax, esi
call fcn.00408044
call fcn.004050c8
call fcn.00404650
push 0x5260fc
lea edx, [ebp - 0x328]
xor eax, eax
call fcn.004048bc
push dword [ebp - 0x328]
push 0x5260ec
push 0x526120
lea eax, [ebp - 0x324]
mov edx, 4
call fcn.00407c4c
mov edx, dword [ebp - 0x324]
mov eax, esi
call fcn.00408044
call fcn.004050c8
call fcn.00404650
mov edx, 0x526144
mov eax, esi
call fcn.00408044
call fcn.004050c8
call fcn.00404650
push 0x526160
push dword [ebx + 0x3dc]
lea edx, [ebp - 0x334]
mov eax, dword [0x534dd8]
mov eax, dword [eax]
call fcn.004a53cc
mov eax, dword [ebp - 0x334]
lea edx, [ebp - 0x330]
call fcn.004139c8
push dword [ebp - 0x330]
push 0x52617c
push dword [ebx + 0x3d8]
lea edx, [ebp - 0x33c]
mov eax, dword [0x534dd8]
mov eax, dword [eax]
call fcn.004a53cc
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x338]
call fcn.004139c8
push dword [ebp - 0x338]
push 0x5260ec
lea eax, [ebp - 0x32c]
mov edx, 7
call fcn.00407c4c
mov edx, dword [ebp - 0x32c]
mov eax, esi
call fcn.00408044
call fcn.004050c8
call fcn.00404650
push 0x526190
push dword [ebx + 0x3d8]
lea edx, [ebp - 0x348]
mov eax, dword [0x534dd8]
mov eax, dword [eax]
call fcn.004a53cc
mov eax, dword [ebp - 0x348]
lea edx, [ebp - 0x344]
call fcn.004139c8
push dword [ebp - 0x344]
push 0x5260ec
push 0x5261bc
lea eax, [ebp - 0x340]
mov edx, 5
call fcn.00407c4c
mov edx, dword [ebp - 0x340]
mov eax, esi
call fcn.00408044
call fcn.004050c8
call fcn.00404650
push 0x5260d4
push dword [ebx + 0x3dc]
lea edx, [ebp - 0x354]
mov eax, dword [0x534dd8]
mov eax, dword [eax]
call fcn.004a53cc
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
call fcn.004139c8
push dword [ebp - 0x350]
push 0x5260ec
lea eax, [ebp - 0x34c]
mov edx, 4
call fcn.00407c4c
mov edx, dword [ebp - 0x34c]
mov eax, esi
call fcn.00408044
call fcn.004050c8
call fcn.00404650
push 0x5260d4
push dword [ebp - 4]
push 0x5260ec
lea eax, [ebp - 0x358]
mov edx, 3
call fcn.00407c4c
mov edx, dword [ebp - 0x358]
mov eax, esi
call fcn.00408044
call fcn.004050c8
call fcn.00404650
mov eax, esi
call fcn.00404d30
call fcn.00404650
lea eax, [ebp - 0x310]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404e14
mov dword [ebp - 0x310], 0x3c
mov dword [ebp - 0x30c], 0x40
xor eax, eax
mov dword [ebp - 0x308], eax
xor eax, eax
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 4]
call fcn.00407728
mov dword [ebp - 0x300], eax
mov eax, 0x5261d4
mov dword [ebp - 0x2fc], eax
xor eax, eax
mov dword [ebp - 0x2f8], eax
xor eax, eax
mov dword [ebp - 0x2f4], eax
xor eax, eax
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 0x310]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52605e
lea eax, [ebp - 0x358]
mov edx, 0x12
call fcn.00407694
lea eax, [ebp - 4]
call fcn.0040768c
ret