Function at 0x52f030
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x6f4fe2
mov eax, dword fs:[0]
push eax
sub esp, 0x204
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x214]
mov dword fs:[0], eax
mov esi, dword [esp + 0x224]
xor ebx, ebx
test byte [esp + 0x22c], 1
mov eax, dword [esp + 0x228]
mov dword [esp + 0x14], ebx
mov edi, dword [sym.imp.MSVCR120.dll_free]
je 0x52f5a3
push str._shellopen
push eax
lea eax, [esp + 0xc8]
push eax
call fcn.005c7cb0
add esp, 0xc
push ebx
push eax
push ebx
lea ecx, [esp + 0x140]
mov dword [esp + 0x228], ebx
call fcn.005f8b00
push dword [esp + 0xd8]
mov byte [esp + 0x220], 2
call edi
add esp, 4
cmp dword [esp + 0xd4], 8
jb 0x52f0eb
push dword [esp + 0xc0]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [esp + 0xd4], 7
lea ecx, [esp + 0x134]
mov dword [esp + 0xd0], 0
mov word [esp + 0xc0], ax
call fcn.005faf30
test al, al
jne 0x52f168
push str.http_shellopen
lea ecx, [esp + 0x64]
call fcn.00418140
lea eax, [esp + 0x60]
mov byte [esp + 0x21c], 3
push eax
push 0
lea ecx, [esp + 0x13c]
call fcn.005fe160
push dword [esp + 0x78]
mov byte [esp + 0x220], 2
call edi
add esp, 4
cmp dword [esp + 0x74], 8
jb 0x52f168
push dword [esp + 0x60]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x134]
call fcn.005faf30
test al, al
je 0x52f58c
push str.DDEExec
lea ecx, [esp + 0x64]
call fcn.00418140
lea eax, [esp + 0x60]
mov byte [esp + 0x21c], 4
push eax
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x108]
call fcn.005f8960
push dword [esp + 0x78]
mov byte [esp + 0x220], 6
call edi
add esp, 4
cmp dword [esp + 0x74], 8
jb 0x52f1cf
push dword [esp + 0x60]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [esp + 0x74], 7
lea ecx, [esp + 0x100]
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
call fcn.005faf30
test al, al
je 0x52f578
xor eax, eax
mov dword [esp + 0x94], 7
mov dword [esp + 0x90], 0
mov word [esp + 0x80], ax
mov dword [esp + 0x98], eax
push str.topic
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x220], 7
call fcn.00418140
lea eax, [esp + 0x19c]
mov byte [esp + 0x21c], 8
push eax
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x170]
call fcn.005f8960
lea ecx, [esp + 0x19c]
mov byte [esp + 0x21c], 0xa
call fcn.00418210
lea ecx, [esp + 0x168]
call fcn.005faf30
test al, al
je 0x52f2bc
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x16c]
call fcn.005fc450
push dword [0x82e120]
mov ebx, 1
mov byte [esp + 0x220], 0xb
mov ecx, eax
mov dword [esp + 0x18], ebx
call fcn.005cab40
mov byte [esp + 0x13], bl
test eax, eax
je 0x52f2c1
mov byte [esp + 0x13], 0
mov dword [esp + 0x21c], 0xa
test bl, 1
je 0x52f2dd
lea ecx, [esp + 0xe0]
call fcn.00418210
cmp byte [esp + 0x13], 0
je 0x52f558
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x104]
call fcn.005fc450
lea ecx, [esp + 0x80]
mov byte [esp + 0x21c], 0xc
cmp ecx, eax
je 0x52f319
push 0xffffffffffffffff
push 0
push eax
call fcn.00419170
lea ecx, [esp + 0xe0]
mov byte [esp + 0x21c], 0xa
call fcn.00418210
cmp dword [esp + 0x90], 0
setne al
test al, al
je 0x52f558
push 0x741d48
lea ecx, [esp + 0xa4]
call fcn.00418140
push 0x749130
lea ecx, [esp + 0x64]
mov byte [esp + 0x220], 0xd
call fcn.00418140
push 0
lea eax, [esp + 0xa4]
mov byte [esp + 0x220], 0xe
push eax
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x8c]
call fcn.005c99e0
lea ecx, [esp + 0x60]
call fcn.00418210
lea ecx, [esp + 0xa0]
mov byte [esp + 0x21c], 0xa
call fcn.00418210
push 0x749138
lea ecx, [esp + 0xa4]
call fcn.00418140
push 0
push esi
lea eax, [esp + 0xa8]
mov byte [esp + 0x224], 0xf
push eax
lea ecx, [esp + 0x8c]
call fcn.005c99e0
cmp eax, 1
mov byte [esp + 0x21c], 0xa
lea ecx, [esp + 0xa0]
sete bl
call fcn.00418210
test bl, bl
je 0x52f558
lea ecx, [esp + 0x13]
call fcn.004201c0
push str.application
lea ecx, [esp + 0x1c0]
mov byte [esp + 0x220], 0x10
call fcn.00418140
lea eax, [esp + 0x1bc]
mov byte [esp + 0x21c], 0x11
push eax
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x1e4]
call fcn.005f8960
lea ecx, [esp + 0xa0]
mov byte [esp + 0x21c], 0x12
push ecx
mov ecx, eax
call fcn.0052f010
lea eax, [esp + 0xa0]
mov byte [esp + 0x21c], 0x13
push eax
lea ecx, [esp + 0x64]
call fcn.00418000
lea ecx, [esp + 0xa0]
call fcn.00418210
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x21c], 0x16
call fcn.005f8c00
lea ecx, [esp + 0x1bc]
mov byte [esp + 0x21c], 0x17
call fcn.00418210
push dword [0x82e120]
lea ecx, [esp + 0xe4]
call fcn.00418140
lea eax, [esp + 0x80]
mov byte [esp + 0x21c], 0x18
push eax
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00613be0
add esp, 0xc
lea ecx, [esp + 0xe0]
mov bl, al
call fcn.00418210
lea ecx, [esp + 0x60]
call fcn.00418210
lea ecx, [esp + 0x13]
mov byte [esp + 0x21c], 0xa
call fcn.00420200
test bl, bl
je 0x52f558
lea ecx, [esp + 0x168]
mov byte [esp + 0x21c], 7
call fcn.005f8c00
lea ecx, [esp + 0x80]
call fcn.00418210
lea ecx, [esp + 0x100]
mov byte [esp + 0x21c], 2
call fcn.005f8c00
lea ecx, [esp + 0x134]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005f8c00
mov al, 1
jmp 0x52f647
lea ecx, [esp + 0x168]
mov byte [esp + 0x21c], 7
call fcn.005f8c00
lea ecx, [esp + 0x80]
call fcn.00418210
lea ecx, [esp + 0x100]
mov byte [esp + 0x21c], 2
call fcn.005f8c00
lea ecx, [esp + 0x134]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005f8c00
push 0x3c
lea eax, [esp + 0x28]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 0x24], 0x3c
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.0041f670
mov ecx, dword [eax]
cmp dword [ecx + 0x14], 8
jb 0x52f5d2
mov ecx, dword [ecx]
cmp byte [esp + 0x20], 0
mov eax, dword [eax + 4]
lea eax, [ecx + eax*2]
mov dword [esp + 0x34], eax
je 0x52f61f
mov esi, dword [esp + 0x18]
test esi, esi
je 0x52f61f
push dword [esi + 0x18]
call edi
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x52f603
push dword [esi]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push esi
mov word [esi], ax
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea eax, [esp + 0x24]
mov dword [esp + 0x30], str.open
push eax
mov dword [esp + 0x44], 1
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.006d1ba7
add esp, 0x210
ret