Function at 0x50054c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x501055
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax + 0x450], 0xffffffff
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x454], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x15c]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x214]
xor esi, esi
mov byte [ebp - 0x1d], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
mov edx, dword [0x4b8c48]
call fcn.00403140
test al, al
je 0x5005ee
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x458]
test byte [ebp - 0x12], 0x40
je 0x50061b
cmp byte [ebp - 0x11], 0
jne 0x50061b
mov eax, dword [ebp - 4]
call fcn.004f98a0
test al, al
je 0x50101f
mov eax, dword [ebp - 4]
mov bx, 0xffeb
call fcn.004031a4
jmp 0x50101f
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004911d4
test al, al
je 0x500724
mov eax, dword [ebp - 4]
test byte [eax + 0x2b7], 1
jne 0x50064c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xe4]
test al, al
je 0x5006aa
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x180]
lea eax, [ebp - 0x39]
push eax
mov eax, dword [ebp - 4]
add eax, 0x450
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc0]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xb8]
cmp byte [ebp - 0x39], 3
jne 0x5006aa
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x450]
mov eax, dword [ebp - 4]
call fcn.00494ec8
mov edx, dword [ebp - 4]
mov dword [edx + 0x454], eax
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp + 0xc]
sub edx, 8
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0050920c
mov eax, dword [ebp - 4]
mov edx, dword [0x4c7d18]
call fcn.00403140
test al, al
je 0x5006fb
push 2
push 1
lea eax, [ebp - 0xe0]
mov edx, dword [ebp - 0x1c]
call fcn.004051b4
lea eax, [ebp - 0xe0]
push eax
mov eax, dword [ebp - 4]
add eax, 0x528
push eax
call fcn.00405c90
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c4]
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.00494548
jmp 0x500fe9
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0050920c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x214]
mov eax, dword [ebp - 0x18]
cmp edx, eax
jne 0x500754
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x210]
cmp edx, dword [ebp - 0x1c]
je 0x500763
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x468]
cmp edx, dword [ebp - 0x1c]
jle 0x500767
xor edx, edx
jmp 0x500769
mov dl, 1
mov byte [ebp - 0x25], dl
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x240]
mov dword [ebp - 0x2c], edx
test eax, eax
jge 0x500798
mov eax, dword [ebp - 4]
call fcn.004f98a0
test al, al
je 0x50101f
push ebp
call fcn.00500334
pop ecx
jmp 0x50101f
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
jne 0x5007ad
mov eax, dword [ebp - 4]
test byte [eax + 0x231], 2
je 0x50081f
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2b9]
cmp eax, dword [ebp - 0x18]
jle 0x50081f
mov eax, dword [ebp - 4]
call fcn.004f98a0
test al, al
je 0x50101f
push ebp
call fcn.0050039c
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
cmp eax, dword [ebp - 0x1c]
jg 0x500804
test byte [ebp - 0x12], 8
je 0x5007f8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ff8b8
push ebp
call fcn.00500334
pop ecx
jmp 0x50101f
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.00494548
jmp 0x500fe2
mov eax, dword [ebp - 4]
test byte [eax + 0x231], 2
jne 0x500856
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2b9]
cmp eax, dword [ebp - 0x18]
jle 0x500856
mov eax, dword [ebp - 4]
call fcn.004f98a0
test al, al
je 0x50101f
push ebp
call fcn.0050039c
pop ecx
jmp 0x500fe2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c4]
cmp byte [eax + 0x15], 0
je 0x500c81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 0x1c]
jne 0x5008d2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x214]
cmp eax, dword [ebp - 0x18]
jne 0x5008d2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x214]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x210]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x10c]
test al, al
jne 0x5008d2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x214]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x210]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x1a0]
test al, al
jne 0x5008d2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xdc]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x2b9]
mov eax, dword [ebp - 0x18]
cmp edx, eax
jg 0x5008ee
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
jne 0x5008f2
xor eax, eax
jmp 0x5008f4
mov al, 1
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x500907
mov eax, dword [ebp - 4]
mov byte [eax + 0x472], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x214]
cmp eax, dword [ebp - 0x18]
jne 0x500927
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 0x1c]
jne 0x500927
xor ebx, ebx
jmp 0x500929
mov bl, 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x3da], 1
test bl, bl
je 0x50095e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x498], 0
je 0x50095e
mov eax, dword [ebp - 4]
call fcn.00433c60
mov edx, eax
add edx, 0xa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
call fcn.00433a1c
mov eax, dword [ebp - 4]
call fcn.004f98a0
test al, al
je 0x50101f
mov eax, dword [ebp - 4]
test byte [eax + 0x2b5], 1
jne 0x5009c8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x220]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
jg 0x5009a4
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x468]
push edx
mov edx, eax
pop eax
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.004fd80c
jmp 0x5009c8
mov edx, dword [ebp - 4]
test byte [edx + 0x2b6], 0x40
je 0x5009c8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x468]
push edx
mov edx, eax
pop eax
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.004fd80c
mov eax, dword [ebp - 4]
mov byte [eax + 0x472], 0
cmp byte [ebp - 0x1d], 0
je 0x5009f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c4]
call fcn.0046cb98
mov edx, dword [ebp - 0x18]
sub edx, edi
call fcn.00471a24
mov eax, dword [ebp - 4]
mov byte [eax + 0x3da], 0
test bl, bl
je 0x500a09
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x140]
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jl 0x500b82
cmp byte [ebp - 0x11], 0
jne 0x500b82
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
mov edx, ebx
call fcn.0041227c
mov eax, dword [eax + 8]
mov edx, 0x501070
call fcn.00404020
jne 0x500b82
mov byte [ebp - 0x41], 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x468]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.004f8668
test eax, eax
je 0x500b82
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x468]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.004f8668
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c4]
call fcn.0046cb98
pop edx
call fcn.00470648
lea edx, [ebp - 0xe4]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov edx, dword [ebp - 0xe4]
lea ecx, [ebp - 0x4c]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x184]
lea eax, [ebp - 0x41]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x468]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.004f8668
mov ecx, eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xe8]
cmp byte [ebp - 0x41], 0
je 0x500b82
lea edx, [ebp - 0xe8]
mov eax, dword [ebp - 0x48]
call fcn.004094c8
mov edx, dword [ebp - 0xe8]
mov eax, 0x501084
call fcn.0040d800
test eax, eax
jg 0x500b42
mov edx, dword [ebp - 0x48]
mov eax, 0x501094
call fcn.0040d800
mov ebx, eax
mov edx, dword [ebp - 0x48]
mov eax, 0x5010a0
call fcn.0040d800
cmp ebx, 1
jle 0x500b42
cmp ebx, eax
jge 0x500b42
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov edx, 0x5010ac
call fcn.00403f5c
mov eax, dword [0x531558]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00451640
push 1
push 0
push 0
mov eax, dword [ebp - 0x48]
call fcn.004040d4
push eax
push 0x5010b4
mov eax, dword [ebp - 4]
call fcn.0043a4d0
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x531558]
mov eax, dword [eax]
xor edx, edx
call fcn.00451640
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
test byte [eax + 0x2b5], 0x40
je 0x500c07
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00502cd8
test al, al
jne 0x500c07
test byte [ebp - 0x12], 4
jne 0x500bb5
test byte [ebp - 0x12], 1
je 0x500bdf
mov eax, dword [ebp - 4]
mov bx, 0xff9a
call fcn.004031a4
test al, al
je 0x500bd2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1a8]
jmp 0x500c07
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1a4]
jmp 0x500c07
mov eax, dword [ebp - 4]
test byte [eax + 0x3d9], 1
je 0x500c07
test byte [ebp - 0x12], 8
je 0x500c07
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x130]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1a4]
mov eax, dword [ebp - 4]
test byte [eax + 0x2b5], 0x40
je 0x500c81
test byte [ebp - 0x12], 1
jne 0x500c2b
test byte [ebp - 0x12], 4
jne 0x500c2b
mov eax, dword [ebp - 4]
test byte [eax + 0x3d9], 1
je 0x500c81
mov eax, dword [ebp - 4]
test byte [eax + 0x3d9], 2
je 0x500c81
mov eax, dword [ebp - 4]
mov byte [eax + 0x473], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c4]
call fcn.0046cb98
call fcn.004724f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
cmp eax, dword [ebp - 0x24]
jne 0x500c81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c4]
call fcn.0046cb98
mov edx, dword [eax]
call dword [edx + 0x218]
mov edx, dword [ebp - 4]
mov dword [edx + 0x474], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x214]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x210]
mov eax, dword [ebp - 4]
call fcn.00492da8
mov eax, dword [ebp - 4]
test byte [eax + 0x434], 4
jne 0x500ce5
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x214]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x210]
mov eax, dword [ebp - 4]
call fcn.00505be4
test al, al
je 0x500ce5
mov eax, dword [ebp - 0x50]
mov edx, dword [0x4b8c48]
call fcn.00403140
test al, al
je 0x500ce5
mov eax, dword [ebp - 4]
call fcn.0050888c
jmp 0x500d42
push 0
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 4]
call fcn.0043a4d0
push eax
call sub.user32.dll_GetUpdateRect
push 0
mov eax, dword [ebp - 4]
call fcn.0043a4d0
push eax
call sub.user32.dll_ValidateRect
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x214]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x210]
mov eax, dword [ebp - 4]
call fcn.00492da8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x80]
push 0
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 4]
call fcn.0043a4d0
push eax
call sub.user32.dll_InvalidateRect
cmp byte [ebp - 0x25], 0
je 0x500fe2
mov eax, dword [ebp - 4]
cmp dword [eax + 0x498], 0
je 0x500fe2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
call fcn.00402f10
mov edx, 0x5010c4
call fcn.0051395c
test al, al
jne 0x500fe2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x240]
cmp eax, dword [ebp - 0x2c]
jne 0x500fe2
test byte [ebp - 0x12], 4
jne 0x500fe2
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x498]
mov edx, dword [ebp + 8]
sub edx, dword [ebx + 0x34]
mov eax, dword [ebp + 0xc]
sub eax, dword [ebx + 0x30]
lea ecx, [ebp - 0x34]
call fcn.004115fc
push 1
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
xor ecx, ecx
call fcn.00437bec
mov ebx, eax
test ebx, ebx
je 0x500e4c
mov eax, ebx
mov edx, dword [0x430688]
call fcn.00403140
test al, al
je 0x500e4c
lea ecx, [ebp - 0xf0]
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.00433da0
mov dx, word [ebp - 0x30]
sub dx, word [ebx + 0x34]
mov di, word [ebp - 0x34]
mov eax, edi
sub ax, word [ebx + 0x30]
call fcn.00408290
push eax
push 0
push 0x201
mov esi, ebx
mov eax, esi
call fcn.0043a4d0
push eax
call sub.user32.dll_SendMessageA
mov dx, word [ebp - 0x30]
sub dx, word [ebx + 0x34]
mov eax, edi
sub ax, word [ebx + 0x30]
call fcn.00408290
push eax
push 0
push 0x202
mov eax, esi
call fcn.0043a4d0
push eax
call sub.user32.dll_SendMessageA
jmp 0x500fe2
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00505be4
test al, al
je 0x500f95
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
cmp eax, dword [ebp - 0x40]
jne 0x500f95
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
mov edx, dword [0x4b8c48]
call fcn.00403140
test al, al
je 0x500f95
cmp byte [ebp - 0x1d], 0
je 0x500f95
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
mov ecx, dword [eax]
call dword [ecx + 0xfc]
push 3
push 4
lea eax, [ebp - 0xd0]
push eax
call sub.user32.dll_InflateRect
xor eax, eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
push dword [eax + 0x30]
mov eax, dword [ebp + 0xc]
pop edx
sub eax, edx
lea ecx, [ebp - 0x34]
mov edx, 7
call fcn.004115fc
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea eax, [ebp - 0xd0]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x500fe2
cmp byte [ebp - 0x1d], 0
je 0x500f32
lea eax, [esi + edi]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x214]
jle 0x500f32
test esi, esi
jle 0x500f32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x2a0], edx
jmp 0x500f45
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
mov dword [eax + 0x2a0], 0xffffffff
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.005089ac
xor eax, eax
push ebp
push 0x500f8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
mov dl, 1
call fcn.004bc71c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500fe2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
mov dword [eax + 0x2a0], 0xffffffff
ret
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x498]
mov eax, ebx
mov edx, dword [0x426368]
call fcn.00403140
test al, al
jne 0x500fe2
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x498]
mov dx, word [ebp + 8]
sub dx, word [esi + 0x34]
mov ax, word [ebp + 0xc]
sub ax, word [esi + 0x30]
call fcn.00408290
push eax
push 0
push 0x201
mov eax, ebx
call fcn.0043a4d0
push eax
call sub.user32.dll_SendMessageA
push ebp
call fcn.00500334
pop ecx
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x498]
test ebx, ebx
je 0x50101f
mov eax, ebx
call fcn.00402f10
mov edx, 0x5010d8
call fcn.0051395c
test al, al
je 0x50101f
call sub.user32.dll_GetMessageTime
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x498]
mov dword [edx + 0x3f4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50105c
lea eax, [ebp - 0xe8]
mov edx, 2
call fcn.00403cb4
lea eax, [ebp - 0xe0]
call fcn.004059d4
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00403cb4
ret