Function at 0x58b208
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor edx, edx
push ebp
push 0x58b4de
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x5c1748], 5
jne 0x58b22a
mov al, 1
test al, al
jne 0x58b4a3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp word [eax + 0x1e4], 0x18f
jge 0x58b4a3
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.0046b324
mov dword [0x5c15d8], eax
mov dword [0x5c15dc], edx
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.0058b0e8
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
imul eax, dword [eax + 0xc], 0x22
cmp dword [eax*8 + 0x5c130b], 0
jne 0x58b28b
cmp dword [eax*8 + 0x5c1307], 0
ja 0x58b2b0
jmp 0x58b28d
jg 0x58b2b0
cmp dword [0x5c15d4], 0
jne 0x58b2de
cmp dword [0x5c15d0], 0
jne 0x58b2de
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp word [eax + 0x1e4], 0xe2
jne 0x58b2de
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
imul eax, dword [eax + 0xc], 0x22
push dword [eax*8 + 0x5c130b]
push dword [eax*8 + 0x5c1307]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, byte [eax + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov cl, 2
call fcn.005657d4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp dword [eax + 0x324], 0
jne 0x58b2fd
cmp dword [eax + 0x320], 0
jne 0x58b2fd
mov eax, dword [ebp + 8]
mov byte [eax - 0xd], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp byte [eax + 0x268], 0
je 0x58b320
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
imul eax, dword [eax + 0xc], 0x22
cmp byte [eax*8 + 0x5c1302], 0
je 0x58b344
mov eax, dword [0x5c15d0]
mov edx, dword [0x5c15d4]
cmp edx, dword [0x5c15dc]
jne 0x58b4a3
cmp eax, dword [0x5c15d8]
jne 0x58b4a3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
imul eax, dword [eax + 0xc], 0x22
push dword [eax*8 + 0x5c130b]
push dword [eax*8 + 0x5c1307]
mov eax, dword [ebp + 8]
mov al, byte [eax - 0xd]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.0046b1e4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.005ae0f4
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
pop ecx
call fcn.00578ff4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [0x5c16ec]
mov edx, dword [ebp - 4]
call fcn.00574690
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [0x5c16ec]
mov edx, dword [ebp - 4]
call fcn.005745f4
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
jne 0x58b4a3
mov edx, 0x58b4f4
mov eax, dword [0x5c12b4]
call fcn.0048aa34
test al, al
je 0x58b4a3
mov ecx, 0x58b500
mov edx, 0x58b4f4
mov eax, dword [0x5c12b4]
call fcn.0048aa58
test al, al
je 0x58b4a3
push 5
push 0
mov ecx, 0x58b50c
mov edx, 0x58b4f4
mov eax, dword [0x5c12b4]
call fcn.00489ef4
push eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.004095a8
mov eax, dword [ebp - 8]
call fcn.004040dc
push eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x5bc024]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x58b51c
mov edx, 0x58b4f4
mov eax, dword [0x5c12b4]
call fcn.00489dc4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xc]
mov edx, 0x58b52c
call fcn.0046724c
mov eax, dword [ebp - 0xc]
call fcn.004040dc
push eax
mov eax, dword [0x5bc024]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x58b500
mov edx, 0x58b4f4
mov eax, dword [0x5c12b4]
call fcn.00489dc4
mov eax, dword [ebp - 0x10]
call fcn.004040dc
push eax
push 0x58b530
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
imul eax, dword [eax + 0xc], 0x22
mov dword [eax*8 + 0x5c1307], 0
mov dword [eax*8 + 0x5c130b], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b4e5
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403cc0
ret