Function at 0x511390
Capabilities:
Create process on windows
Create process suspended
Delete file
Get common file path
Resume thread

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov edx, 1
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x22d]
push ebx
lea ebx, [ebp - 0x2b4]
mov edi, ebx
lea ebx, [ebp - 0x2c8]
sub esp, 0x2e8
mov byte [0x84fdc0], 0
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x2cc]
mov word [ebp - 0x288], dx
mov dword [ebp - 0x2b8], 0x44
mov dword [ebp - 0x28c], 1
mov dword [esp + 4], esi
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
sub esp, 8
mov dword [esp], esi
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5eee65
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
call fcn.0050d7a0
call fcn.0057d110
lea edx, [ebp - 0x2b8]
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5b3
mov dword [esp + 0x20], edx
mov dword [esp + 4], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
call fcn.0057d110
mov esi, dword [sym.imp.kernel32.dll_GetExitCodeThread]
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5b5
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x2c4]
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
je 0x5114ef
xor eax, eax
cmp dword [ebp - 0x2cc], 0x103
sete al
mov dword [esp], eax
mov dword [esp + 4], str.thread_still_running_n
call fcn.0050e8b0
mov dword [esp], 0x64
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5b7
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x2c4]
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
je 0x511546
xor eax, eax
cmp dword [ebp - 0x2cc], 0x103
sete al
mov dword [esp], eax
mov dword [esp + 4], str.thread_still_running_n
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5b8
mov eax, dword [ebp - 0x2c4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResumeThread]
sub esp, 4
cmp eax, 1
sete al
mov dword [esp + 4], str.Resuming_thread_n
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, ebx
call fcn.0050e290
lea eax, [ebp - 0x274]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x2b8]
mov ecx, 0x5efae5
mov edx, str.StartupInfoA
sub esp, 0x10
mov dword [esp], eax
mov eax, 0x5bf
call fcn.005104e0
mov ecx, str.lpDesktop
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
mov eax, 0x5c0
call fcn.00510420
mov edx, str.lpTitle
mov eax, str.StartupInfoA
call fcn.0050dfd0
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5c2
mov eax, dword [0x8f0770]
test eax, eax
jne 0x5117a0
mov eax, 1
test ebx, ebx
jne 0x5117b0
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.expected__s_or_null__got__s_n
call fcn.0050e8b0
mov eax, dword [ebp - 0x2a8]
mov ecx, 0x5efb29
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x5c4
call fcn.005104e0
mov eax, dword [ebp - 0x2a4]
mov ecx, 0x5efb2d
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x5c5
call fcn.005104e0
mov eax, dword [ebp - 0x2a0]
mov ecx, str.dwXSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x5c6
call fcn.005104e0
mov eax, dword [ebp - 0x29c]
mov ecx, str.dwYSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x5c7
call fcn.005104e0
mov eax, dword [ebp - 0x298]
mov ecx, str.dwXCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x5c8
call fcn.005104e0
mov eax, dword [ebp - 0x294]
mov ecx, str.dwYCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x5c9
call fcn.005104e0
mov eax, dword [ebp - 0x290]
mov ecx, str.dwFillAttribute
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x5ca
call fcn.005104e0
mov eax, dword [ebp - 0x28c]
mov ecx, str.dwFlags
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x5cb
call fcn.005104e0
mov ecx, str.wShowWindow
mov edx, str.StartupInfoA
movzx eax, word [ebp - 0x288]
mov dword [esp], eax
mov eax, 0x5cc
call fcn.005104e0
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
test ebx, ebx
je 0x511653
lea esi, [esi]
mov dword [esp + 4], 0x84fee0
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
sete al
movzx eax, al
jmp 0x511653