Function at 0x5061bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x5061c4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x506c69
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
call fcn.00452390
mov edx, dword [ebp - 0x10]
mov eax, 0x5113d0
call fcn.00404ae4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
call fcn.00477118
mov edx, dword [ebp - 0x14]
mov eax, 0x5113d4
call fcn.00404ae4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
mov eax, dword [eax + 0x68]
mov edx, 0x506c80
call fcn.004271c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
mov eax, dword [eax + 0x68]
mov edx, 9
call fcn.00427238
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
cmp dword [0x5113d0], 0
je 0x506bed
cmp dword [0x5113d4], 0
je 0x506bed
lea eax, [ebp - 0x18]
mov ecx, 0x506c90
mov edx, dword [0x50c850]
call fcn.00404d9c
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x436c94]
call fcn.00436d44
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, dword [eax]
call dword [edx + 0xc8]
cmp al, 1
jne 0x5062e4
lea ecx, [ebp - 0x1c]
mov edx, 0x506ca8
mov eax, dword [0x5113d0]
call fcn.004c07d4
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, 0x506cb8
mov edx, 0x506cc8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
jmp 0x5062f7
push 0
mov ecx, 0x506cb8
mov edx, 0x506cc8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0xc8]
cmp al, 1
jne 0x50635c
lea ecx, [ebp - 0x20]
mov edx, 0x506ca8
mov eax, dword [0x5113d0]
call fcn.004c07d4
mov eax, dword [ebp - 0x20]
push eax
mov ecx, 0x506cb8
mov edx, 0x506cc8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
lea ecx, [ebp - 0x24]
mov edx, 0x506ca8
mov eax, dword [0x5113d4]
call fcn.004c07d4
mov eax, dword [ebp - 0x24]
push eax
mov ecx, 0x506cd8
mov edx, 0x506cc8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
jmp 0x50636f
push 0
mov ecx, 0x506cd8
mov edx, 0x506cc8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, dword [eax]
call dword [edx + 0xc8]
push eax
mov ecx, 0x506ce8
mov edx, 0x506cc8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0xc8]
push eax
mov ecx, 0x506cfc
mov edx, 0x506cc8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xc8]
push eax
mov ecx, 0x506d0c
mov edx, 0x506cc8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x14]
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 4]
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b5824]
call fcn.004b5d0c
mov edx, dword [ebp - 4]
mov dword [edx + 0x36c], eax
mov eax, 0x50c860
mov edx, 0x506d20
call fcn.00404ae4
push dword [0x50c864]
push dword [0x50c860]
push 0x506d38
push dword [0x5113d0]
push 0x506d4c
push dword [0x5113d4]
lea eax, [ebp - 8]
mov edx, 6
call fcn.00404e10
xor edx, edx
push ebp
push 0x506b90
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0xc]
mov eax, dword [0x5102b0]
mov eax, dword [eax + 0x36c]
mov edx, dword [ebp - 8]
call fcn.004b5e8c
mov edx, dword [ebp - 0xc]
mov eax, 0x506d60
call fcn.00405094
test eax, eax
jle 0x506b11
mov dl, 1
mov eax, dword [0x418990]
call fcn.00403c10
mov edx, 0x506d6c
mov eax, dword [ebp - 0xc]
call fcn.0050139c
mov ebx, eax
lea ecx, [ebp - 0x28]
mov edx, 1
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
add eax, 0x450
call fcn.00404ae4
lea ecx, [ebp - 0x2c]
mov edx, 2
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
add eax, 0x45c
call fcn.00404ae4
lea ecx, [ebp - 0x30]
mov edx, 3
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
add eax, 0x454
call fcn.00404ae4
lea ecx, [ebp - 0x34]
mov edx, 4
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x34]
call fcn.004095fc
mov edx, dword [ebp - 4]
mov dword [edx + 0x458], eax
lea ecx, [ebp - 0x38]
mov edx, 5
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 4]
add eax, 0x460
call fcn.00404ae4
lea ecx, [ebp - 0x3c]
mov edx, 6
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x3c]
call fcn.004095fc
mov edx, dword [ebp - 4]
mov dword [edx + 0x464], eax
lea ecx, [ebp - 0x40]
mov edx, 7
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x40]
call fcn.004095fc
mov edx, dword [ebp - 4]
mov dword [edx + 0x468], eax
lea ecx, [ebp - 0x44]
mov edx, 8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
add eax, 0x46c
call fcn.00404ae4
lea ecx, [ebp - 0x48]
mov edx, 9
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x48]
call fcn.004095fc
mov edx, dword [ebp - 4]
mov dword [edx + 0x470], eax
lea ecx, [ebp - 0x4c]
mov edx, 0xa
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 4]
add eax, 0x474
call fcn.00404ae4
lea ecx, [ebp - 0x50]
mov edx, 0xb
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x50]
mov eax, 0x5113d8
call fcn.00404ae4
lea ecx, [ebp - 0x54]
mov edx, 0xc
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x54]
mov eax, 0x5113dc
call fcn.00404ae4
lea ecx, [ebp - 0x58]
mov edx, 0xd
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x58]
mov eax, 0x5113e0
call fcn.00404ae4
lea ecx, [ebp - 0x5c]
mov edx, 0xe
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x5c]
call fcn.004095fc
mov dword [0x50c870], eax
lea ecx, [ebp - 0x60]
mov edx, 0xf
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x60]
mov eax, 0x5113e4
call fcn.00404ae4
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
mov edx, 0x506d78
call fcn.00409184
test eax, eax
je 0x5066ae
push 1
lea eax, [ebp - 0x64]
mov ecx, 0x506d84
mov edx, dword [0x50c850]
call fcn.00404d9c
mov eax, dword [ebp - 0x64]
call fcn.00404f50
push eax
call sub.kernel32.dll_WinExec
mov eax, 2
call fcn.005045b8
mov eax, dword [0x50cdc4]
mov eax, dword [eax]
call fcn.00472114
jmp 0x506b86
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x458]
test eax, eax
je 0x5066c9
cmp eax, 1
je 0x5066c9
cmp eax, 2
jne 0x506ae0
cmp eax, 2
jne 0x506706
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
mov edx, 0x506d98
call fcn.004523c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x506b86
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov edx, 0x506dd0
call fcn.00409184
test eax, eax
jne 0x506755
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
mov edx, 0x506ddc
call fcn.004523c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x506b86
mov eax, dword [ebp - 4]
cmp dword [eax + 0x458], 1
jne 0x50684c
mov byte [0x50c854], 1
lea ecx, [ebp - 0x68]
mov edx, 0x506ca8
mov eax, 0x506e44
call fcn.004c0988
mov edx, dword [ebp - 0x68]
mov eax, 0x50c858
call fcn.00404ae4
mov eax, 0x50c85c
mov edx, 0x506e70
call fcn.00404ae4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0x506e80
call fcn.004523c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x41c]
mov dl, 1
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x420]
mov dl, 1
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x424]
mov dl, 1
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
mov dl, 1
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x408]
xor edx, edx
call fcn.004522b0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x454]
lea eax, [ebp - 0x6c]
mov ecx, 0x506e94
call fcn.00404d9c
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
call fcn.004523c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x506976
mov byte [0x50c854], 0
lea ecx, [ebp - 0x70]
mov edx, 0x506ca8
mov eax, 0x506e44
call fcn.004c0988
mov edx, dword [ebp - 0x70]
mov eax, 0x50c858
call fcn.00404ae4
mov eax, 0x50c85c
mov edx, 0x506ea0
call fcn.00404ae4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0x506eb4
call fcn.004523c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x41c]
xor edx, edx
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x420]
xor edx, edx
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x424]
xor edx, edx
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
xor edx, edx
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x408]
mov dl, 1
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0x4b
call fcn.00451b00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0xc
call fcn.00451b24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, 0x91
call fcn.00451b00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, 0xa
call fcn.00451b24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
cmp dword [0x50c870], 2
je 0x506991
cmp byte [0x50c854], 0
jne 0x50699b
cmp dword [0x50c870], 1
jne 0x50699b
mov eax, dword [0x5113e4]
call fcn.00501650
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
xor edx, edx
call fcn.004523c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
xor edx, edx
call fcn.004522b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x398]
mov dl, 1
call fcn.004522b0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x450]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
call fcn.004523c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, dword [0x5113d0]
call fcn.004523c0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x45c]
lea eax, [ebp - 0x74]
mov ecx, 0x506ec8
call fcn.00404d9c
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x420]
call fcn.004523c0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x468], 1
jne 0x506a3b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x506a5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x464], 2
je 0x506a7f
cmp byte [0x50c854], 0
jne 0x506a8f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x464], 1
jne 0x506a8f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov dl, 1
call fcn.00435624
mov eax, dword [ebp - 4]
cmp dword [eax + 0x470], 2
je 0x506ab0
cmp byte [0x50c854], 0
jne 0x506ac8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x470], 1
jne 0x506ac8
mov ecx, dword [0x50cb54]
mov eax, dword [0x50cdc4]
mov eax, dword [eax]
mov edx, dword [0x500208]
call fcn.00471fa8
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5005d4]
call fcn.004236c4
call fcn.0050465c
jmp 0x506b86
push 0
mov eax, dword [0x50c858]
call fcn.00404f50
push eax
push 0x506ecc
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, 2
call fcn.005045b8
mov eax, dword [0x50cdc4]
mov eax, dword [eax]
call fcn.00472114
jmp 0x506b86
mov edx, dword [ebp - 0xc]
mov eax, 0x506ef4
call fcn.00405094
test eax, eax
jle 0x506b53
push 0
mov eax, dword [0x50c858]
call fcn.00404f50
push eax
push 0x506efc
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, 2
call fcn.005045b8
mov eax, dword [0x50cdc4]
mov eax, dword [eax]
call fcn.00472114
jmp 0x506b86
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
mov edx, 0x506f1c
call fcn.004523c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x506bcd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x36c]
mov edx, dword [eax]
call dword [edx + 0x58]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x36c]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
jmp 0x506c31
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
mov edx, 0x506fec
call fcn.004523c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0xc4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506c70
lea eax, [ebp - 0x74]
mov edx, 0x18
call fcn.00404ab4
lea eax, [ebp - 0x14]
call fcn.00404a90
lea eax, [ebp - 0x10]
call fcn.00404a90
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404ab4
ret