Function at 0x5359dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff4
xor edx, edx
push ebp
push 0x535ca8
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x5565f8], 5
jne 0x535a05
mov al, 1
test al, al
jne 0x535c58
mov eax, dword [ebx]
cmp word [eax + 0x2e0], 0x18f
jge 0x535c58
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00457740
mov dword [0x556460], eax
mov dword [0x556464], edx
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00535880
pop ecx
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0xf7
cmp dword [eax + 0x5561d0], 0
jne 0x535a5f
cmp dword [eax + 0x5561cc], 0
ja 0x535a80
jmp 0x535a61
jg 0x535a80
cmp dword [0x55645c], 0
jne 0x535aa7
cmp dword [0x556458], 0
jne 0x535aa7
mov eax, dword [ebx]
cmp word [eax + 0x2e0], 0xe2
jne 0x535aa7
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0xf7
push dword [eax + 0x5561d0]
push dword [eax + 0x5561cc]
mov eax, dword [ebx]
mov dl, byte [eax + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, 2
call fcn.00514988
mov eax, dword [ebx]
cmp dword [eax + 0x40c], 0
jne 0x535ac2
cmp dword [eax + 0x408], 0
jne 0x535ac2
mov eax, dword [ebp + 8]
mov byte [eax - 0xd], 0
mov eax, dword [ebx]
cmp byte [eax + 0x370], 0
je 0x535adf
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0xf7
cmp byte [eax + 0x5561c7], 0
je 0x535b03
mov eax, dword [0x556458]
mov edx, dword [0x55645c]
cmp edx, dword [0x556464]
jne 0x535c58
cmp eax, dword [0x556460]
jne 0x535c58
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0xf7
push dword [eax + 0x5561d0]
push dword [eax + 0x5561cc]
mov eax, dword [ebp + 8]
mov al, byte [eax - 0xd]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00457600
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
mov edx, dword [eax + 0x334]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00526170
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [0x556598]
mov edx, dword [ebp - 4]
call fcn.0052285c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [0x556598]
mov edx, dword [ebp - 4]
call fcn.005227c0
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
jne 0x535c58
mov edx, 0x535cbc
mov eax, dword [0x5561a4]
call fcn.0045a75c
test al, al
je 0x535c58
mov ecx, 0x535cc8
mov edx, 0x535cbc
mov eax, dword [0x5561a4]
call fcn.0045a780
test al, al
je 0x535c58
push 5
push 0
mov ecx, 0x535cd4
mov edx, 0x535cbc
mov eax, dword [0x5561a4]
call fcn.00459c1c
push eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00409420
mov eax, dword [ebp - 8]
call fcn.00403fe8
push eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x5536c4]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x535ce4
mov edx, 0x535cbc
mov eax, dword [0x5561a4]
call fcn.00459aec
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xc]
mov edx, 0x535cf4
call fcn.0045333c
mov eax, dword [ebp - 0xc]
call fcn.00403fe8
push eax
mov eax, dword [0x5536c4]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x535cc8
mov edx, 0x535cbc
mov eax, dword [0x5561a4]
call fcn.00459aec
mov eax, dword [ebp - 0x10]
call fcn.00403fe8
push eax
push 0x535cf8
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0xf7
mov dword [eax + 0x5561cc], 0
mov dword [eax + 0x5561d0], 0
cmp byte [0x556404], 0
jne 0x535c8d
mov edx, dword [ebx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0053a858
test al, al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535caf
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403bcc
ret