Function at 0x59c0c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x3c
push 0
push 0
dec ecx
jne 0x59c0cd
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x59ca7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
xor eax, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x11], 0
mov dword [esi + 0x330], 1
mov dword [esi + 0x334], 1
lea eax, [ebp - 0x70]
xor ecx, ecx
mov edx, 0x44
call fcn.004038a8
mov dword [ebp - 0x70], 0x44
cmp byte [ebp + 0xc], 0
je 0x59c13f
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], 0
jmp 0x59c151
mov dword [ebp - 0x44], 1
mov eax, edi
call fcn.00599aa4
mov word [ebp - 0x40], ax
mov eax, dword [0x5fddc0]
mov eax, dword [eax]
mov bl, byte [eax + 0x396]
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 4]
call fcn.00445d2c
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x20]
call fcn.0059c058
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0059c058
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 0x20]
call fcn.0059becc
mov eax, dword [ebp - 0x194]
lea edx, [ebp - 0x190]
call fcn.0040b4b0
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x28]
call fcn.0040a000
mov eax, dword [ebp - 0x20]
call fcn.0059bf70
test al, al
je 0x59c20a
push 0x59ca9c
push dword [ebp - 0x20]
push 0x59caa8
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004053f8
mov eax, dword [0x5fe184]
cmp byte [eax], 0
je 0x59c1f4
lea eax, [ebp - 0x20]
mov edx, 0x59cab4
call fcn.004050e4
jmp 0x59c201
lea eax, [ebp - 0x20]
mov edx, 0x59cac4
call fcn.004050e4
mov byte [ebp - 0x11], 1
jmp 0x59c39e
mov edx, 0x59cad8
mov eax, dword [ebp - 0x28]
call fcn.0047d410
test al, al
je 0x59c256
lea edx, [ebp - 0x198]
mov eax, dword [ebp - 0x20]
call fcn.0059bf18
push dword [ebp - 0x198]
push 0x59caa8
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004053f8
lea eax, [ebp - 0x20]
mov edx, 0x59cae8
call fcn.004050e4
jmp 0x59c39e
mov edx, 0x59cafc
mov eax, dword [ebp - 0x28]
call fcn.0047d410
test al, al
je 0x59c2c6
push 0x59ca9c
lea edx, [ebp - 0x19c]
mov eax, dword [ebp - 0x20]
call fcn.0059bf18
push dword [ebp - 0x19c]
push 0x59caa8
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004053f8
mov eax, dword [0x5fe184]
cmp byte [eax], 0
je 0x59c2ae
lea eax, [ebp - 0x20]
mov edx, 0x59cab4
call fcn.004050e4
jmp 0x59c2bb
lea eax, [ebp - 0x20]
mov edx, 0x59cac4
call fcn.004050e4
mov word [ebp - 0x40], 0
jmp 0x59c39e
lea eax, [ebp - 0x1a0]
mov ecx, 0x59cb0c
mov edx, dword [ebp - 0x28]
call fcn.00405384
mov eax, dword [ebp - 0x1a0]
mov edx, 0x59cb18
call fcn.00405680
test eax, eax
jne 0x59c39e
lea eax, [ebp - 0x185]
push eax
push 0x59cb44
lea edx, [ebp - 0x1a4]
mov eax, dword [ebp - 4]
call fcn.0059becc
mov eax, dword [ebp - 0x1a4]
call fcn.00405538
push eax
call sub.shell32.dll_FindExecutableA
cmp eax, 0x20
jbe 0x59c39e
lea eax, [ebp - 0x1a8]
mov ecx, 0x59cb0c
mov edx, dword [ebp - 0x28]
call fcn.00405384
mov eax, dword [ebp - 0x1a8]
mov edx, 0x59cb50
call fcn.00405680
test eax, eax
jle 0x59c367
push 0x59cb64
push dword [ebp - 4]
push 0x59caa8
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004053f8
jmp 0x59c390
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 4]
call fcn.0059bf18
push dword [ebp - 0x1ac]
push 0x59caa8
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004053f8
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x185]
call fcn.0040b9d8
test bl, bl
je 0x59c3af
lea eax, [ebp - 0x24]
call fcn.005e31c0
jmp 0x59c43f
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x20]
call fcn.0059becc
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x24]
call fcn.0040b35c
lea edx, [ebp - 0x1b8]
mov eax, dword [ebp - 0x20]
call fcn.0059becc
mov eax, dword [ebp - 0x1b8]
lea edx, [ebp - 0x1b4]
call fcn.0040b478
mov edx, dword [ebp - 0x1b4]
lea eax, [ebp - 0x20]
call fcn.004050e4
cmp dword [ebp - 0x24], 0
jbe 0x59c43f
cmp dword [ebp - 0x20], 0
jne 0x59c43f
lea eax, [ebp - 0x20]
mov edx, 0x59cb74
call fcn.004050e4
lea eax, [esi + 0x308]
mov edx, dword [ebp - 0x20]
call fcn.004050a0
push dword [ebp - 0x24]
push 0x59caa8
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004053f8
lea eax, [ebp - 0x24]
call fcn.0040504c
test bl, bl
jne 0x59c553
cmp dword [ebp - 0x24], 0
jne 0x59c4ef
lea edx, [ebp - 0x18]
mov eax, dword [0x5fddc0]
mov eax, dword [eax]
mov eax, dword [eax + 0x354]
call fcn.0040b35c
lea eax, [ebp - 0x185]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00405538
push eax
mov eax, dword [ebp - 0x20]
call fcn.00405538
push eax
call sub.shell32.dll_FindExecutableA
cmp eax, 0x20
jbe 0x59c4ad
lea edx, [ebp - 0x1bc]
lea eax, [ebp - 0x185]
call fcn.0040b9d8
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x24]
call fcn.0040b35c
jmp 0x59c553
lea ecx, [ebp - 0x1c0]
mov eax, dword [0x5fddc0]
mov eax, dword [eax]
mov eax, dword [eax + 0x480]
mov edx, dword [ebp - 0x20]
call fcn.00445dd0
mov eax, dword [ebp - 0x1c0]
call fcn.00446114
test al, al
je 0x59c553
lea eax, [ebp - 0x24]
mov edx, dword [0x5fddc0]
mov edx, dword [edx]
mov edx, dword [edx + 0x480]
call fcn.004050e4
jmp 0x59c553
lea edx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x24]
call fcn.0040b3e4
cmp dword [ebp - 0x1c4], 0
jne 0x59c553
lea edx, [ebp - 0x18]
mov eax, dword [0x5fddc0]
mov eax, dword [eax]
mov eax, dword [eax + 0x354]
call fcn.0040b3e4
mov edx, dword [ebp - 0x24]
mov eax, 0x59cb8c
call fcn.00405680
dec eax
je 0x59c545
push dword [ebp - 0x18]
push 0x59cb8c
push dword [ebp - 0x24]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004053f8
jmp 0x59c553
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
call fcn.00405384
cmp byte [ebp - 9], 0
je 0x59ca28
cmp dword [ebp - 0x20], 0
jbe 0x59ca28
xor edx, edx
push ebp
push 0x59ca21
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x5fe344]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0046edd4
lea ecx, [ebp - 0x1c8]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.00445dd0
mov edx, dword [ebp - 0x1c8]
lea eax, [esi + 0x30c]
call fcn.004050a0
cmp byte [ebp - 0x11], 0
jne 0x59c603
mov edx, edi
mov eax, 0x59cb98
call fcn.0047db48
test al, al
je 0x59c603
lea edx, [esi + 0x324]
mov eax, dword [ebp - 0x20]
call fcn.00599ce8
test al, al
je 0x59c603
mov byte [ebp - 0x12], 1
mov eax, dword [esi + 0x324]
push eax
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov dword [esi + 0x320], eax
cmp dword [esi + 0x320], 0
jne 0x59c607
mov byte [ebp - 9], 0
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x2c], eax
jmp 0x59c607
mov byte [ebp - 0x12], 0
cmp byte [ebp - 0x12], 0
jne 0x59c74c
test bl, bl
je 0x59c67a
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp - 0x24]
call fcn.00405538
push eax
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x1d0]
mov eax, dword [ebp - 0x20]
call fcn.0059bf18
push dword [ebp - 0x1d0]
push 0x59caa8
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1cc]
mov edx, 3
call fcn.004053f8
mov eax, dword [ebp - 0x1cc]
call fcn.00405538
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
jmp 0x59c6ea
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x1dc]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.00445dd0
mov eax, dword [ebp - 0x1dc]
lea edx, [ebp - 0x1d8]
call fcn.0059bf18
push dword [ebp - 0x1d8]
push 0x59caa8
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1d4]
mov edx, 3
call fcn.004053f8
mov eax, dword [ebp - 0x1d4]
call fcn.00405538
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x59c744
mov eax, dword [ebp - 0x80]
mov dword [esi + 0x320], eax
mov eax, dword [ebp - 0x78]
mov dword [esi + 0x324], eax
mov eax, dword [ebp - 0x7c]
mov dword [esi + 0x31c], eax
cmp byte [ebp + 0xc], 0
jne 0x59c72a
cmp dword [esi + 0x314], 0
ja 0x59c72a
mov edx, edi
mov eax, 0x59cba8
call fcn.0047db48
test al, al
je 0x59c74c
push 0xffffffffffffffff
mov eax, dword [esi + 0x320]
push eax
call sub.user32.dll_WaitForInputIdle
push 0x1f4
call sub.kernel32.dll_Sleep_1
jmp 0x59c74c
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x2c], eax
cmp byte [ebp - 9], 0
je 0x59ca05
cmp byte [ebp - 0x12], 0
je 0x59c791
cmp byte [ebp + 0xc], 0
jne 0x59c791
lea edx, [ebp - 0x10]
mov eax, dword [esi + 0x324]
call fcn.0059be70
test al, al
je 0x59c9ca
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x328], eax
movzx edx, word [ebp - 0x40]
mov eax, esi
call fcn.0059c06c
jmp 0x59c9ca
cmp byte [ebp + 0xc], 0
jne 0x59c7ae
cmp dword [esi + 0x314], 0
jbe 0x59c9ca
cmp byte [ebp - 0x11], 0
jne 0x59c9ca
lea edx, [ebp - 0x10]
mov eax, dword [esi + 0x324]
call fcn.0059be70
test al, al
je 0x59c99a
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x328], eax
cmp byte [ebp + 0xc], 0
je 0x59c9ca
mov eax, dword [esi + 0x2f8]
call fcn.00457974
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SetParent
push 0xfffffffffffffff0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0xc00000
je 0x59c803
sub eax, 0xc00000
test eax, 0x80000
je 0x59c80f
sub eax, 0x80000
test eax, 0x40000
je 0x59c81b
sub eax, 0x40000
test eax, 0x400000
je 0x59c827
sub eax, 0x400000
test eax, 0x40000
je 0x59c833
sub eax, 0x40000
test eax, 0x800000
jne 0x59c83f
add eax, 0x800000
push eax
push 0xfffffffffffffff0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SetWindowLongA
mov edx, edi
mov eax, 0x59cbc0
call fcn.0047db48
test al, al
je 0x59c877
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetMenu
test eax, eax
je 0x59c877
push 0xf
call sub.user32.dll_GetSystemMetrics
mov dword [esi + 0x32c], eax
jmp 0x59c87f
xor eax, eax
mov dword [esi + 0x32c], eax
push 0x40
mov eax, dword [esi + 0x2f8]
call fcn.00450a60
mov edx, dword [esi + 0x334]
add edx, edx
add eax, edx
add eax, dword [esi + 0x32c]
push eax
mov eax, dword [esi + 0x2f8]
call fcn.00450a1c
mov edx, dword [esi + 0x330]
add edx, edx
add eax, edx
push eax
xor eax, eax
sub eax, dword [esi + 0x334]
sub eax, dword [esi + 0x32c]
push eax
xor eax, eax
sub eax, dword [esi + 0x330]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SetWindowPos
mov edx, edi
mov eax, 0x59cbd4
call fcn.0047db48
test al, al
je 0x59c9ca
mov ecx, esi
mov dl, 1
mov eax, dword [0x441340]
call fcn.00442a54
mov ebx, eax
mov dword [esi + 0x338], ebx
mov eax, ebx
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [esi + 0x338]
xor edx, edx
call fcn.00442e88
mov eax, dword [esi + 0x338]
xor edx, edx
call fcn.00442ea4
push 9
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [esi + 0x338]
call fcn.004507f8
push 0xa
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [esi + 0x338]
call fcn.004507d4
mov eax, dword [esi + 0x2f8]
call fcn.00450a1c
mov edx, eax
mov eax, dword [esi + 0x338]
sub edx, dword [eax + 0x48]
mov eax, dword [esi + 0x338]
call fcn.00450788
mov eax, dword [esi + 0x2f8]
call fcn.00450a60
mov edx, eax
mov eax, dword [esi + 0x338]
sub edx, dword [eax + 0x4c]
mov eax, dword [esi + 0x338]
call fcn.004507ac
mov eax, dword [esi + 0x338]
call fcn.00451558
jmp 0x59c9ca
cmp byte [ebp + 0xc], 0
je 0x59c9ca
cmp byte [ebp + 8], 0
je 0x59c9c6
mov ebx, dword [0x5fde74]
mov ebx, dword [ebx]
lea edx, [ebp - 0x1e0]
mov eax, 0x14b
call ebx
mov eax, dword [ebp - 0x1e0]
call fcn.005e5a00
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x59ca05
mov edx, edi
mov eax, 0x59cbe8
call fcn.0047db48
test al, al
jne 0x59ca05
cmp dword [esi + 0x314], 0
ja 0x59c9f8
cmp dword [esi + 0x318], 0
ja 0x59c9f8
cmp byte [ebp + 0xc], 0
je 0x59ca05
mov eax, dword [esi + 0x2fc]
mov dl, 1
call fcn.00442a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ca28
mov eax, dword [0x5fe344]
mov eax, dword [eax]
xor edx, edx
call fcn.0046edd4
ret
cmp byte [ebp - 9], 0
jne 0x59ca53
cmp dword [ebp - 0x2c], 0
je 0x59ca53
cmp byte [ebp + 8], 0
je 0x59ca53
lea edx, [ebp - 0x1e4]
mov eax, dword [ebp - 0x2c]
call fcn.0040e7d0
mov eax, dword [ebp - 0x1e4]
call fcn.005e5a00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ca85
lea eax, [ebp - 0x1e4]
mov edx, 0x17
call fcn.00405070
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.00405070
ret