Function at 0x5ba720
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3217
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x404], ecx
cmp dword [ebp + 8], 0
jne 0x5ba75c
jmp 0x5baef0
push 0xfde9
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.004550e0
mov dword [ebp - 0x408], eax
mov ecx, dword [ebp - 0x408]
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40c]
call fcn.00493020
push eax
lea ecx, [ebp - 0x4c]
call fcn.00401c00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1ac]
call fcn.0040e6c0
lea ecx, [ebp - 0x104]
call fcn.005480b0
mov byte [ebp - 4], 3
push 0
lea ecx, [ebp - 0x5c]
call fcn.00544f40
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4c]
call fcn.00401360
push eax
lea ecx, [ebp - 0x1cc]
call fcn.00401c00
mov byte [ebp - 4], 5
push 1
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0x104]
call fcn.005493a0
movzx ecx, al
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [ebp - 0x1ad], cl
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1cc]
call fcn.00401d60
movzx edx, byte [ebp - 0x1ad]
test edx, edx
je 0x5ba8db
cmp dword [0x67e1c8], 0
je 0x5ba8ac
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1d0], 0x30a
lea eax, [ebp - 0x1d4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x6370e4
push 0x6370dc
push 0x637098
push 0x63708c
lea edx, [ebp - 0x1d0]
push edx
push 0x637088
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00545090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x104]
call fcn.0044a910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00401d60
jmp 0x5baef0
lea ecx, [ebp - 0x5c]
call fcn.00543e60
movzx eax, al
test eax, eax
jne 0x5ba8fd
lea ecx, [ebp - 0x5c]
call fcn.00543eb0
movzx ecx, al
test ecx, ecx
jne 0x5ba9a6
cmp dword [0x67e1c8], 0
je 0x5ba977
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1d8], 0x310
lea edx, [ebp - 0x1dc]
push edx
push 0x63715c
push 0x637154
push 0x637110
push 0x637104
lea eax, [ebp - 0x1d8]
push eax
push 0x637100
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00545090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x104]
call fcn.0044a910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00401d60
jmp 0x5baef0
lea ecx, [ebp - 0x2c]
push ecx
push 0x637178
lea ecx, [ebp - 0x5c]
call fcn.005462d0
mov ecx, eax
call fcn.00544ab0
mov byte [ebp - 4], 6
lea edx, [ebp - 0x128]
push edx
push 0x63717c
lea ecx, [ebp - 0x5c]
call fcn.005462d0
mov ecx, eax
call fcn.00544ab0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x80]
push eax
push 0x637184
lea ecx, [ebp - 0x5c]
call fcn.005462d0
mov ecx, eax
call fcn.00544ab0
mov byte [ebp - 4], 8
push 0xfde9
lea ecx, [ebp - 0x128]
call fcn.00401360
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0040e420
mov dword [ebp - 0x410], eax
mov ecx, dword [ebp - 0x410]
mov dword [ebp - 0x414], ecx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x414]
call fcn.00493020
push eax
lea ecx, [ebp - 0x60]
call fcn.004092b0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2e0]
call fcn.0040e6c0
lea edx, [ebp - 0x60]
push edx
mov ecx, dword [ebp - 0x404]
add ecx, 0x3c4
mov eax, dword [ebp - 0x404]
mov edx, dword [eax + 0x3c4]
mov eax, dword [edx + 0x10]
call eax
push 0xfde9
lea ecx, [ebp - 0x80]
call fcn.00401360
push eax
lea ecx, [ebp - 0x3e4]
call fcn.0040e420
mov dword [ebp - 0x418], eax
mov ecx, dword [ebp - 0x418]
mov dword [ebp - 0x41c], ecx
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x41c]
call fcn.00493020
push eax
lea ecx, [ebp - 0x88]
call fcn.004092b0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x3e4]
call fcn.0040e6c0
lea ecx, [ebp - 0x88]
call fcn.0040ee60
movzx edx, al
test edx, edx
je 0x5babc9
cmp dword [0x67e1c8], 0
je 0x5bab58
mov dword [ebp - 0x3ec], 0
mov dword [ebp - 0x3e8], 0x31e
lea eax, [ebp - 0x3ec]
push eax
push str.commandline_is_empty
push 0x6371dc
push 0x637198
push 0x637190
lea ecx, [ebp - 0x3e8]
push ecx
push 0x63718c
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x88]
call fcn.00403270
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x60]
call fcn.00403270
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x80]
call fcn.00401d60
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x128]
call fcn.00401d60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00401d60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00545090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x104]
call fcn.0044a910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00401d60
jmp 0x5baef0
push 0
lea edx, [ebp - 0x84]
push edx
call fcn.0057a250
add esp, 8
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x84]
call fcn.0040ee60
movzx eax, al
test eax, eax
je 0x5bacee
cmp dword [0x67e1c8], 0
je 0x5bac6e
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 0x3f0], 0x325
lea ecx, [ebp - 0x3f4]
push ecx
push str.modulepath_is_empty
push 0x637264
push 0x637220
push 0x637214
lea edx, [ebp - 0x3f0]
push edx
push 0x637210
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x84]
call fcn.00403270
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x88]
call fcn.00403270
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x60]
call fcn.00403270
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x80]
call fcn.00401d60
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x128]
call fcn.00401d60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00401d60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00545090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x104]
call fcn.0044a910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00401d60
jmp 0x5baef0
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.005c2220
add esp, 8
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.005c2430
add esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x84]
call fcn.00454f00
push 1
push 0
lea ecx, [ebp - 0x64]
call fcn.00493020
push eax
lea ecx, [ebp - 0x84]
call fcn.00493020
push eax
push 0x637294
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cdq
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], edx
cmp dword [0x67e1c8], 0
je 0x5bae55
mov dword [ebp - 0x400], 0
cmp dword [ebp - 0x108], 0
jl 0x5bad92
jg 0x5bad89
cmp dword [ebp - 0x10c], 0x20
jbe 0x5bad92
mov byte [ebp - 0x41d], 1
jmp 0x5bad99
mov byte [ebp - 0x41d], 0
mov dl, byte [ebp - 0x41d]
mov byte [ebp - 0x3f9], dl
mov dword [ebp - 0x3f8], 0x32f
lea eax, [ebp - 0x400]
push eax
lea ecx, [ebp - 0x3f9]
push ecx
push 0x63731c
lea ecx, [ebp - 0x64]
call fcn.00493020
push eax
push 0x637318
lea ecx, [ebp - 0x84]
call fcn.00493020
push eax
push 0x6372fc
push 0x6372f4
push str.KCommonPopBase::OnJsEventExecCmd
push 0x6372a4
lea edx, [ebp - 0x3f8]
push edx
push 0x6372a0
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004540b0
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x64]
call fcn.00403270
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x30]
call fcn.00403270
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x84]
call fcn.00403270
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x88]
call fcn.00403270
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x60]
call fcn.00403270
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x80]
call fcn.00401d60
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x128]
call fcn.00401d60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00401d60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00545090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x104]
call fcn.0044a910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00401d60
xor eax, eax
jne 0x5ba751
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret 8