Function at 0x5218b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1b
push 0
push 0
dec ecx
jne 0x5218b8
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x522165
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea edx, [ebp - 0x20]
mov eax, 0x522180
call fcn.004de0b4
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00402b04
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00465bcc
lea eax, [ebp - 0x24]
mov edx, 0x522190
call fcn.00404a60
mov eax, dword [ebp - 0x24]
call fcn.004658fc
test al, al
je 0x522083
mov eax, ebx
sub al, 1
jb 0x521935
je 0x5219ff
dec al
je 0x521aa0
jmp 0x521b65
lea eax, [ebp - 0x10]
mov edx, 0x5221a8
call fcn.00404820
mov ecx, 0x5221b4
mov edx, 0x5221bc
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov ecx, 0x5221cc
mov edx, 0x5221e0
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
xor ecx, ecx
mov edx, 0x5221f4
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.0051baf8
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.004050e8
mov ecx, dword [ebp - 0x2c]
mov edx, 0x522214
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
lea edx, [ebp - 0x38]
mov al, 3
call fcn.0051baf8
lea eax, [ebp - 0x38]
mov edx, 0x52222c
call fcn.00404a60
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.004050e8
mov ecx, dword [ebp - 0x34]
mov edx, 0x52224c
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov ecx, 0x522268
mov edx, 0x522378
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov ecx, 0x52239c
mov edx, 0x5224b4
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov eax, 0x5224e8
call fcn.00514dcc
jmp 0x521b65
lea eax, [ebp - 0x10]
mov edx, 0x5224fc
call fcn.00404820
mov ecx, 0x5221b4
mov edx, 0x5221bc
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov ecx, 0x522504
mov edx, 0x5221e0
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
xor ecx, ecx
mov edx, 0x5221f4
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
lea edx, [ebp - 0x40]
mov al, 1
call fcn.0051baf8
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
call fcn.004050e8
mov ecx, dword [ebp - 0x3c]
mov edx, 0x522214
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
xor ecx, ecx
mov edx, 0x52224c
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
xor ecx, ecx
mov edx, 0x522378
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
xor ecx, ecx
mov edx, 0x5224b4
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov eax, 0x522518
call fcn.00514dcc
jmp 0x521b65
lea eax, [ebp - 0x10]
mov edx, 0x52252c
call fcn.00404820
mov ecx, 0x5221b4
mov edx, 0x5221bc
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov ecx, 0x522538
mov edx, 0x5221e0
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
xor ecx, ecx
mov edx, 0x5221f4
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
lea edx, [ebp - 0x48]
mov al, 2
call fcn.0051baf8
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
call fcn.004050e8
mov ecx, dword [ebp - 0x44]
mov edx, 0x522214
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
lea edx, [ebp - 0x50]
mov al, 3
call fcn.0051baf8
lea eax, [ebp - 0x50]
mov edx, 0x52254c
call fcn.00404a60
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
call fcn.004050e8
mov ecx, dword [ebp - 0x4c]
mov edx, 0x52224c
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov ecx, 0x52256c
mov edx, 0x522378
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov ecx, 0x5225d4
mov edx, 0x5224b4
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
mov eax, 0x522670
call fcn.00514dcc
mov edx, 0x522684
mov eax, dword [0x536528]
call fcn.00464ef0
test al, al
je 0x521b99
lea edx, [ebp - 0x54]
mov eax, dword [0x536530]
inc eax
call fcn.004653f4
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3fc]
call fcn.00515d3c
jmp 0x521bb7
lea edx, [ebp - 0x58]
mov eax, 1
call fcn.004653f4
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3fc]
call fcn.00515d3c
mov eax, 0x3e8
call fcn.005151d0
call fcn.004fe44c
mov dword [ebp - 0x1c], eax
mov eax, 0x52269c
call fcn.0051b014
lea eax, [ebp - 0x5c]
mov ecx, dword [0x53653c]
mov edx, 0x5226bc
call fcn.00404aa4
mov eax, dword [ebp - 0x5c]
call fcn.0051b014
lea eax, [ebp - 0xc]
mov edx, dword [0x53653c]
call fcn.00404820
lea eax, [ebp - 0x60]
mov edx, dword [ebp - 0xc]
call fcn.004050e8
mov ecx, dword [ebp - 0x60]
mov edx, 0x5221f4
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0x50]
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
mov edx, 0x5226c8
call fcn.00405174
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
call fcn.00404a20
mov eax, dword [ebp - 0x64]
call fcn.0051b014
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
call fcn.00404a20
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x14]
call fcn.00521898
lea eax, [ebp - 0x78]
mov ecx, dword [ebp - 0x14]
mov edx, 0x5226d8
call fcn.00404aa4
mov eax, dword [ebp - 0x78]
call fcn.0051b014
push 5
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404c58
push eax
lea edx, [ebp - 0x80]
xor eax, eax
call fcn.00402b04
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.00465bcc
lea eax, [ebp - 0x7c]
mov edx, 0x522190
call fcn.00404a60
mov eax, dword [ebp - 0x7c]
call fcn.00404c58
push eax
push 0x5226e4
push 0
call sub.shell32.dll_ShellExecuteA
mov edx, 0x522684
mov eax, dword [0x536528]
call fcn.00464ef0
test al, al
je 0x521d04
lea edx, [ebp - 0x84]
mov eax, dword [0x536530]
add eax, 2
call fcn.004653f4
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3fc]
call fcn.00515d3c
jmp 0x521d28
lea edx, [ebp - 0x88]
mov eax, 2
call fcn.004653f4
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3fc]
call fcn.00515d3c
mov eax, 0x64
call fcn.005151d0
mov eax, 0x522190
call fcn.00514f3c
test eax, eax
jne 0x521d28
mov edx, 0x522684
mov eax, dword [0x536528]
call fcn.00464ef0
test al, al
je 0x521d7c
lea edx, [ebp - 0x8c]
mov eax, dword [0x536530]
add eax, 3
call fcn.004653f4
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3fc]
call fcn.00515d3c
jmp 0x521da0
lea edx, [ebp - 0x90]
mov eax, 3
call fcn.004653f4
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3fc]
call fcn.00515d3c
mov eax, 0x5226f4
call fcn.0051b014
call fcn.004fe44c
mov esi, eax
lea eax, [ebp - 0x94]
push eax
sub esi, dword [ebp - 0x1c]
mov dword [ebp - 0xa4], esi
xor eax, eax
mov dword [ebp - 0xa0], eax
fild qword [ebp - 0xa4]
fdiv dword [0x522704]
fstp xword [ebp - 0xb0]
wait
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x9c], eax
mov byte [ebp - 0x98], 3
lea edx, [ebp - 0x9c]
xor ecx, ecx
mov eax, 0x522710
call fcn.00466494
mov eax, dword [ebp - 0x94]
call fcn.0051b014
mov edi, 1
mov eax, 0x3e8
call fcn.005151d0
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov eax, dword [0x536458]
call fcn.00520518
cmp dword [ebp - 0x18], 0
je 0x521feb
mov dword [ebp - 8], 1
lea edx, [ebp - 0xb8]
mov eax, edi
call fcn.004653f4
mov ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0xb4]
mov edx, 0x522724
call fcn.00404aa4
mov eax, dword [ebp - 0xb4]
call fcn.0051b014
call fcn.004fe44c
mov esi, eax
lea eax, [ebp - 0xbc]
push eax
mov eax, esi
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa4], eax
xor eax, eax
mov dword [ebp - 0xa0], eax
fild qword [ebp - 0xa4]
fdiv dword [0x522704]
fstp xword [ebp - 0xb0]
wait
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x9c], eax
mov byte [ebp - 0x98], 3
lea edx, [ebp - 0x9c]
xor ecx, ecx
mov eax, 0x522740
call fcn.00466494
mov eax, dword [ebp - 0xbc]
call fcn.0051b014
sub bl, 1
jb 0x521ee0
dec bl
je 0x521f67
jmp 0x522023
lea eax, [ebp - 0xc0]
push eax
sub esi, dword [ebp - 0x1c]
mov dword [ebp - 0xa4], esi
xor eax, eax
mov dword [ebp - 0xa0], eax
fild qword [ebp - 0xa4]
fdiv dword [0x522704]
call fcn.00402b8c
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], edx
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x9c], eax
mov byte [ebp - 0x98], 0x10
lea edx, [ebp - 0x9c]
xor ecx, ecx
mov eax, 0x522754
call fcn.00466494
mov edx, dword [ebp - 0xc0]
mov eax, dword [0x536458]
mov eax, dword [eax + 0x3f0]
call fcn.0049c8f8
mov eax, dword [0x536458]
mov eax, dword [eax + 0x3f0]
mov dl, 1
call fcn.0049c7e8
jmp 0x522023
lea eax, [ebp - 0xcc]
push eax
sub esi, dword [ebp - 0x1c]
mov dword [ebp - 0xa4], esi
xor eax, eax
mov dword [ebp - 0xa0], eax
fild qword [ebp - 0xa4]
fdiv dword [0x522704]
call fcn.00402b8c
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], edx
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x9c], eax
mov byte [ebp - 0x98], 0x10
lea edx, [ebp - 0x9c]
xor ecx, ecx
mov eax, 0x522754
call fcn.00466494
mov edx, dword [ebp - 0xcc]
mov eax, dword [0x536458]
mov eax, dword [eax + 0x3f8]
call fcn.0049c8f8
mov eax, dword [0x536458]
mov eax, dword [eax + 0x3f8]
mov dl, 1
call fcn.0049c7e8
jmp 0x522023
lea edx, [ebp - 0xd4]
mov eax, edi
call fcn.004653f4
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
mov edx, 0x522768
call fcn.00404aa4
mov eax, dword [ebp - 0xd0]
call fcn.0051b014
inc edi
cmp edi, 0x10
jne 0x521e11
mov edx, 0x522684
mov eax, dword [0x536528]
call fcn.00464ef0
test al, al
je 0x52205f
lea edx, [ebp - 0xd8]
mov eax, dword [0x536530]
add eax, 4
call fcn.004653f4
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3fc]
call fcn.00515d3c
jmp 0x522083
lea edx, [ebp - 0xdc]
mov eax, 4
call fcn.004653f4
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3fc]
call fcn.00515d3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52216f
lea eax, [ebp - 0xdc]
mov edx, 5
call fcn.004047ac
lea eax, [ebp - 0xc0]
mov edx, 4
call fcn.004047ac
lea eax, [ebp - 0x94]
mov edx, 8
call fcn.004047ac
lea eax, [ebp - 0x74]
call fcn.00404f44
lea eax, [ebp - 0x70]
call fcn.00404788
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00404f5c
lea eax, [ebp - 0x64]
call fcn.00404788
lea eax, [ebp - 0x60]
call fcn.00404f44
lea eax, [ebp - 0x5c]
mov edx, 4
call fcn.004047ac
lea eax, [ebp - 0x4c]
call fcn.00404f44
lea eax, [ebp - 0x48]
call fcn.00404788
lea eax, [ebp - 0x44]
call fcn.00404f44
lea eax, [ebp - 0x40]
call fcn.00404788
lea eax, [ebp - 0x3c]
call fcn.00404f44
lea eax, [ebp - 0x38]
call fcn.00404788
lea eax, [ebp - 0x34]
call fcn.00404f44
lea eax, [ebp - 0x30]
call fcn.00404788
lea eax, [ebp - 0x2c]
call fcn.00404f44
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004047ac
lea eax, [ebp - 0x20]
call fcn.00406870
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004047ac
ret