Function at 0x5fbe00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5fc919
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax + 0x480], 0xffffffff
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x484], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x174]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
mov dword [ebp - 0x38], eax
xor edi, edi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
mov edx, dword [0x57067c]
call fcn.00404134
test al, al
je 0x5fbea3
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x488]
test byte [ebp - 0x12], 0x40
je 0x5fbedf
cmp byte [ebp - 0x11], 0
jne 0x5fbedf
mov eax, dword [ebp - 4]
call fcn.005f3b58
test al, al
je 0x5fc8e3
push ebp
call fcn.005fbd50
pop ecx
test al, al
jne 0x5fc8e3
mov eax, dword [ebp - 4]
mov si, 0xffe9
call fcn.004041a4
jmp 0x5fc8e3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00521958
test al, al
je 0x5fbfea
mov eax, dword [ebp - 4]
test byte [eax + 0x2df], 1
jne 0x5fbf10
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xf8]
test al, al
je 0x5fbf6e
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x198]
lea eax, [ebp - 0x3d]
push eax
mov eax, dword [ebp - 4]
add eax, 0x480
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xcc]
cmp byte [ebp - 0x3d], 3
jne 0x5fbf6e
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x480]
mov eax, dword [ebp - 4]
call fcn.0052571c
mov edx, dword [ebp - 4]
mov dword [edx + 0x484], eax
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp + 0xc]
sub edx, 8
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.006057e4
mov eax, dword [ebp - 4]
mov edx, dword [0x580f98]
call fcn.00404134
test al, al
je 0x5fbfc1
push 2
push 1
lea eax, [ebp - 0xe8]
mov edx, dword [ebp - 0x1c]
mov cl, 0xfc
call fcn.0041706c
lea eax, [ebp - 0xe8]
push eax
mov eax, dword [ebp - 4]
add eax, 0x570
push eax
call fcn.00419b18
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2ec]
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.00524d80
jmp 0x5fc8ad
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.006057e4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x22c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
jne 0x5fc01a
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x228]
cmp edx, dword [ebp - 0x1c]
je 0x5fc029
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x4ac]
cmp edx, dword [ebp - 0x1c]
jle 0x5fc02d
xor edx, edx
jmp 0x5fc02f
mov dl, 1
mov byte [ebp - 0x25], dl
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x258]
mov dword [ebp - 0x2c], edx
test eax, eax
jge 0x5fc05e
mov eax, dword [ebp - 4]
call fcn.005f3b58
test al, al
je 0x5fc8e3
push ebp
call fcn.005fbb1c
pop ecx
jmp 0x5fc8e3
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x5fc073
mov eax, dword [ebp - 4]
test byte [eax + 0x249], 2
je 0x5fc0e5
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2e1]
cmp eax, dword [ebp - 0x18]
jle 0x5fc0e5
mov eax, dword [ebp - 4]
call fcn.005f3b58
test al, al
je 0x5fc8e3
push ebp
call fcn.005fbb84
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x238]
cmp eax, dword [ebp - 0x1c]
jg 0x5fc0ca
test byte [ebp - 0x12], 8
je 0x5fc0be
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005faf48
push ebp
call fcn.005fbb1c
pop ecx
jmp 0x5fc8e3
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.00524d80
jmp 0x5fc8a6
mov eax, dword [ebp - 4]
test byte [eax + 0x249], 2
jne 0x5fc11c
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2e1]
cmp eax, dword [ebp - 0x18]
jle 0x5fc11c
mov eax, dword [ebp - 4]
call fcn.005f3b58
test al, al
je 0x5fc8e3
push ebp
call fcn.005fbb84
pop ecx
jmp 0x5fc8a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2ec]
cmp byte [eax + 0x15], 0
je 0x5fc547
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x228]
cmp ebx, dword [ebp - 0x1c]
jne 0x5fc197
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
cmp eax, dword [ebp - 0x18]
jne 0x5fc197
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov edx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x120]
test al, al
jne 0x5fc197
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x1b8]
test al, al
jne 0x5fc197
cmp byte [ebp - 0x11], 1
je 0x5fc197
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xf0]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x2e1]
mov eax, dword [ebp - 0x18]
cmp edx, eax
jg 0x5fc1b3
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x22c]
jne 0x5fc1b7
xor ebx, ebx
jmp 0x5fc1b9
mov bl, 1
test bl, bl
je 0x5fc1c7
mov eax, dword [ebp - 4]
mov byte [eax + 0x4b6], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
cmp eax, dword [ebp - 0x18]
jne 0x5fc1e7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 0x1c]
jne 0x5fc1e7
xor eax, eax
jmp 0x5fc1e9
mov al, 1
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x403], 1
cmp byte [ebp - 0x1d], 0
je 0x5fc223
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4e0], 0
je 0x5fc223
mov eax, dword [ebp - 4]
call fcn.00482fc8
mov edx, eax
add edx, 0xa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
call fcn.00482d0c
mov eax, dword [ebp - 4]
call fcn.005f3b58
test al, al
je 0x5fc8e3
mov eax, dword [ebp - 4]
test byte [eax + 0x2dd], 1
jne 0x5fc28d
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x238]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
jg 0x5fc269
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x4ac]
push edx
mov edx, eax
pop eax
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.005f8c20
jmp 0x5fc28d
mov edx, dword [ebp - 4]
test byte [edx + 0x2de], 0x40
je 0x5fc28d
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x4ac]
push edx
mov edx, eax
pop eax
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.005f8c20
mov eax, dword [ebp - 4]
mov byte [eax + 0x4b6], 0
test bl, bl
je 0x5fc2b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2ec]
call fcn.004de1a4
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x38]
call fcn.004e38a4
mov eax, dword [ebp - 4]
mov byte [eax + 0x403], 0
cmp byte [ebp - 0x1d], 0
je 0x5fc2cf
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x158]
mov esi, dword [ebp - 0x1c]
test esi, esi
jl 0x5fc448
cmp byte [ebp - 0x11], 0
jne 0x5fc448
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4a4]
mov edx, esi
call fcn.00420918
mov eax, dword [eax + 8]
mov edx, 0x5fc934
call fcn.004052c8
jne 0x5fc448
mov byte [ebp - 0x45], 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x4ac]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.005f2788
test eax, eax
je 0x5fc448
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x4ac]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.005f2788
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2ec]
call fcn.004de1a4
pop edx
call fcn.004e2308
lea edx, [ebp - 0xec]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0xec]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x19c]
lea eax, [ebp - 0x45]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x4ac]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.005f2788
mov ecx, eax
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xfc]
cmp byte [ebp - 0x45], 0
je 0x5fc448
lea edx, [ebp - 0xf0]
mov eax, dword [ebp - 0x4c]
call fcn.00409e34
mov edx, dword [ebp - 0xf0]
mov eax, 0x5fc948
call fcn.0040fc64
test eax, eax
jg 0x5fc408
mov edx, dword [ebp - 0x4c]
mov eax, 0x5fc958
call fcn.0040fc64
mov esi, eax
mov edx, dword [ebp - 0x4c]
mov eax, 0x5fc964
call fcn.0040fc64
cmp esi, 1
jle 0x5fc408
cmp esi, eax
jge 0x5fc408
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov edx, 0x5fc970
call fcn.004051c8
mov eax, dword [0x7b616c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004a3214
push 1
push 0
push 0
mov eax, dword [ebp - 0x4c]
call fcn.0040537c
push eax
push 0x5fc978
mov eax, dword [ebp - 4]
call fcn.0048a000
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x7b616c]
mov eax, dword [eax]
xor edx, edx
call fcn.004a3214
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
test byte [eax + 0x2dd], 0x40
je 0x5fc4cd
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.005fe5ec
test al, al
jne 0x5fc4cd
test byte [ebp - 0x12], 4
jne 0x5fc47b
test byte [ebp - 0x12], 1
je 0x5fc4a5
mov eax, dword [ebp - 4]
mov si, 0xff96
call fcn.004041a4
test al, al
je 0x5fc498
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1c0]
jmp 0x5fc4cd
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1bc]
jmp 0x5fc4cd
mov eax, dword [ebp - 4]
test byte [eax + 0x402], 1
je 0x5fc4cd
test byte [ebp - 0x12], 8
je 0x5fc4cd
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x148]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1bc]
mov eax, dword [ebp - 4]
test byte [eax + 0x2dd], 0x40
je 0x5fc547
test byte [ebp - 0x12], 1
jne 0x5fc4f1
test byte [ebp - 0x12], 4
jne 0x5fc4f1
mov eax, dword [ebp - 4]
test byte [eax + 0x402], 1
je 0x5fc547
mov eax, dword [ebp - 4]
test byte [eax + 0x402], 2
je 0x5fc547
mov eax, dword [ebp - 4]
mov byte [eax + 0x4b7], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2ec]
call fcn.004de1a4
call fcn.004e43dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b8]
cmp eax, dword [ebp - 0x24]
jne 0x5fc547
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2ec]
call fcn.004de1a4
mov edx, dword [eax]
call dword [edx + 0x21c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x4b8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
call fcn.005235a8
mov eax, dword [ebp - 4]
test byte [eax + 0x464], 4
jne 0x5fc5ab
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
call fcn.00601984
test al, al
je 0x5fc5ab
mov eax, dword [ebp - 0x54]
mov edx, dword [0x57067c]
call fcn.00404134
test al, al
je 0x5fc5ab
mov eax, dword [ebp - 4]
call fcn.00604d6c
jmp 0x5fc608
push 0
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
call fcn.0048a000
push eax
call sub.user32.dll_GetUpdateRect
push 0
mov eax, dword [ebp - 4]
call fcn.0048a000
push eax
call sub.user32.dll_ValidateRect
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
call fcn.005235a8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x88]
push 0
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
call fcn.0048a000
push eax
call sub.user32.dll_InvalidateRect
cmp byte [ebp - 0x25], 0
je 0x5fc8a6
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4e0], 0
je 0x5fc8a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
call fcn.00403ef0
mov edx, 0x5fc988
call fcn.005dce24
test al, al
jne 0x5fc8a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
cmp eax, dword [ebp - 0x2c]
jne 0x5fc8a6
test byte [ebp - 0x12], 4
jne 0x5fc8a6
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x4e0]
mov edx, dword [ebp + 8]
sub edx, dword [esi + 0x44]
mov eax, dword [ebp + 0xc]
sub eax, dword [esi + 0x40]
lea ecx, [ebp - 0x34]
call fcn.0041f120
push 1
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
xor ecx, ecx
call fcn.00487830
mov esi, eax
test esi, esi
je 0x5fc712
mov eax, esi
mov edx, dword [0x47f328]
call fcn.00404134
test al, al
je 0x5fc712
lea ecx, [ebp - 0xf8]
lea edx, [ebp - 0x34]
mov eax, esi
call fcn.00483108
mov dx, word [ebp - 0x30]
sub dx, word [esi + 0x44]
mov di, word [ebp - 0x34]
mov eax, edi
sub ax, word [esi + 0x40]
call fcn.004089d8
push eax
push 0
push 0x201
mov ebx, esi
mov eax, ebx
call fcn.0048a000
push eax
call sub.user32.dll_SendMessageA
mov dx, word [ebp - 0x30]
sub dx, word [esi + 0x44]
mov eax, edi
sub ax, word [esi + 0x40]
call fcn.004089d8
push eax
push 0
push 0x202
mov eax, ebx
call fcn.0048a000
push eax
call sub.user32.dll_SendMessageA
jmp 0x5fc8a6
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00601984
test al, al
je 0x5fc859
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
cmp eax, dword [ebp - 0x44]
jne 0x5fc859
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
mov edx, dword [0x57067c]
call fcn.00404134
test al, al
je 0x5fc859
test bl, bl
je 0x5fc859
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
mov ecx, dword [eax]
call dword [ecx + 0x114]
push 3
push 4
lea eax, [ebp - 0xd8]
push eax
call sub.user32.dll_InflateRect
xor eax, eax
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
push dword [eax + 0x40]
mov eax, dword [ebp + 0xc]
pop edx
sub eax, edx
lea ecx, [ebp - 0x34]
mov edx, 7
call fcn.0041f120
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea eax, [ebp - 0xd8]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x5fc8a6
test bl, bl
je 0x5fc7f6
mov eax, dword [ebp - 0x38]
add eax, edi
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x22c]
jle 0x5fc7f6
test edi, edi
jle 0x5fc7f6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x2c8], edx
jmp 0x5fc809
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
mov dword [eax + 0x2c8], 0xffffffff
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00604f18
xor eax, eax
push ebp
push 0x5fc852
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
mov dl, 1
call fcn.00574798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fc8a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e0]
mov dword [eax + 0x2c8], 0xffffffff
ret
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x4e0]
mov eax, ebx
mov edx, dword [0x4716c0]
call fcn.00404134
test al, al
jne 0x5fc8a6
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x4e0]
mov dx, word [ebp + 8]
sub dx, word [esi + 0x44]
mov ax, word [ebp + 0xc]
sub ax, word [esi + 0x40]
call fcn.004089d8
push eax
push 0
push 0x201
mov eax, ebx
call fcn.0048a000
push eax
call sub.user32.dll_SendMessageA
push ebp
call fcn.005fbb1c
pop ecx
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x4e0]
test ebx, ebx
je 0x5fc8e3
mov eax, ebx
call fcn.00403ef0
mov edx, 0x5fc99c
call fcn.005dce24
test al, al
je 0x5fc8e3
call sub.user32.dll_GetMessageTime
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4e0]
mov dword [edx + 0x42c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fc920
lea eax, [ebp - 0xf0]
mov edx, 2
call fcn.00404ee0
lea eax, [ebp - 0xe8]
call fcn.00412b74
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00404ee0
ret