Function at 0x560c2c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff4
xor edx, edx
push ebp
push 0x560ef5
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x5866dc], 5
jne 0x560c55
mov al, 1
test al, al
jne 0x560ea6
mov eax, dword [ebx]
cmp word [eax + 0x306], 0x18f
jge 0x560ea6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00457c44
mov dword [0x586564], eax
mov dword [0x586568], edx
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00560ad0
pop ecx
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0x7b
cmp dword [eax*2 + 0x5862d0], 0
jne 0x560cae
cmp dword [eax*2 + 0x5862cc], 0
ja 0x560ccf
jmp 0x560cb0
jg 0x560ccf
cmp dword [0x586560], 0
jne 0x560cf5
cmp dword [0x58655c], 0
jne 0x560cf5
mov eax, dword [ebx]
cmp word [eax + 0x306], 0xe2
jne 0x560cf5
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0x7b
push dword [eax*2 + 0x5862d0]
push dword [eax*2 + 0x5862cc]
mov eax, dword [ebx]
mov dl, byte [eax + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, 2
call fcn.0053ece4
mov eax, dword [ebx]
cmp dword [eax + 0x43c], 0
jne 0x560d10
cmp dword [eax + 0x438], 0
jne 0x560d10
mov eax, dword [ebp + 8]
mov byte [eax - 0xd], 0
mov eax, dword [ebx]
cmp byte [eax + 0x394], 0
je 0x560d2b
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0x7b
cmp byte [eax*2 + 0x5862c7], 0
je 0x560d4f
mov eax, dword [0x58655c]
mov edx, dword [0x586560]
cmp edx, dword [0x586568]
jne 0x560ea6
cmp eax, dword [0x586564]
jne 0x560ea6
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0x7b
push dword [eax*2 + 0x5862d0]
push dword [eax*2 + 0x5862cc]
mov eax, dword [ebp + 8]
mov al, byte [eax - 0xd]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00457b04
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.004aa418
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
pop ecx
call fcn.00550524
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [0x586684]
mov edx, dword [ebp - 4]
call fcn.0054c904
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [0x586684]
mov edx, dword [ebp - 4]
call fcn.0054c868
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
jne 0x560ea6
mov edx, 0x560f0c
mov eax, dword [0x58627c]
call fcn.0045da34
test al, al
je 0x560ea6
mov ecx, 0x560f18
mov edx, 0x560f0c
mov eax, dword [0x58627c]
call fcn.0045da58
test al, al
je 0x560ea6
push 5
push 0
mov ecx, 0x560f24
mov edx, 0x560f0c
mov eax, dword [0x58627c]
call fcn.0045cef4
push eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00409508
mov eax, dword [ebp - 8]
call fcn.0040404c
push eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x581dd8]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x560f34
mov edx, 0x560f0c
mov eax, dword [0x58627c]
call fcn.0045cdc4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xc]
mov edx, 0x560f44
call fcn.004537d4
mov eax, dword [ebp - 0xc]
call fcn.0040404c
push eax
mov eax, dword [0x581dd8]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x560f18
mov edx, 0x560f0c
mov eax, dword [0x58627c]
call fcn.0045cdc4
mov eax, dword [ebp - 0x10]
call fcn.0040404c
push eax
push 0x560f48
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebx]
imul eax, dword [eax + 0xc], 0x7b
mov dword [eax*2 + 0x5862cc], 0
mov dword [eax*2 + 0x5862d0], 0
cmp byte [0x586504], 0
jne 0x560eda
mov edx, dword [ebx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00565c68
test al, al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560efc
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403c30
ret