Function at 0x5664fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x567006
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax + 0x468], 0xffffffff
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x46c], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x16c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
mov dword [ebp - 0x38], eax
xor edi, edi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
mov edx, dword [0x50f88c]
call fcn.00403be8
test al, al
je 0x56659f
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x470]
test byte [ebp - 0x12], 0x40
je 0x5665cc
cmp byte [ebp - 0x11], 0
jne 0x5665cc
mov eax, dword [ebp - 4]
call fcn.0055f7b0
test al, al
je 0x566fd0
mov eax, dword [ebp - 4]
mov si, 0xffe9
call fcn.00403c58
jmp 0x566fd0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004a9c40
test al, al
je 0x5666d7
mov eax, dword [ebp - 4]
test byte [eax + 0x2cf], 1
jne 0x5665fd
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xf4]
test al, al
je 0x56665b
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x190]
lea eax, [ebp - 0x3d]
push eax
mov eax, dword [ebp - 4]
add eax, 0x468
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc8]
cmp byte [ebp - 0x3d], 3
jne 0x56665b
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x468]
mov eax, dword [ebp - 4]
call fcn.004ad9c8
mov edx, dword [ebp - 4]
mov dword [edx + 0x46c], eax
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp + 0xc]
sub edx, 8
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0056f430
mov eax, dword [ebp - 4]
mov edx, dword [0x51f6fc]
call fcn.00403be8
test al, al
je 0x5666ae
push 2
push 1
lea eax, [ebp - 0xe8]
mov edx, dword [ebp - 0x1c]
mov cl, 0xfc
call fcn.00405a1c
lea eax, [ebp - 0xe8]
push eax
mov eax, dword [ebp - 4]
add eax, 0x540
push eax
call fcn.00405b2c
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.004ad02c
jmp 0x566f9a
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0056f430
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x22c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
jne 0x566707
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x228]
cmp edx, dword [ebp - 0x1c]
je 0x566716
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x480]
cmp edx, dword [ebp - 0x1c]
jle 0x56671a
xor edx, edx
jmp 0x56671c
mov dl, 1
mov byte [ebp - 0x25], dl
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x258]
mov dword [ebp - 0x2c], edx
test eax, eax
jge 0x56674b
mov eax, dword [ebp - 4]
call fcn.0055f7b0
test al, al
je 0x566fd0
push ebp
call fcn.005662e4
pop ecx
jmp 0x566fd0
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x566760
mov eax, dword [ebp - 4]
test byte [eax + 0x249], 2
je 0x5667d2
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2d1]
cmp eax, dword [ebp - 0x18]
jle 0x5667d2
mov eax, dword [ebp - 4]
call fcn.0055f7b0
test al, al
je 0x566fd0
push ebp
call fcn.0056634c
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x238]
cmp eax, dword [ebp - 0x1c]
jg 0x5667b7
test byte [ebp - 0x12], 8
je 0x5667ab
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0056586c
push ebp
call fcn.005662e4
pop ecx
jmp 0x566fd0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.004ad02c
jmp 0x566f93
mov eax, dword [ebp - 4]
test byte [eax + 0x249], 2
jne 0x566809
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2d1]
cmp eax, dword [ebp - 0x18]
jle 0x566809
mov eax, dword [ebp - 4]
call fcn.0055f7b0
test al, al
je 0x566fd0
push ebp
call fcn.0056634c
pop ecx
jmp 0x566f93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
cmp byte [eax + 0x15], 0
je 0x566c34
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x228]
cmp ebx, dword [ebp - 0x1c]
jne 0x566884
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
cmp eax, dword [ebp - 0x18]
jne 0x566884
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov edx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x11c]
test al, al
jne 0x566884
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x1b0]
test al, al
jne 0x566884
cmp byte [ebp - 0x11], 1
je 0x566884
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xec]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x2d1]
mov eax, dword [ebp - 0x18]
cmp edx, eax
jg 0x5668a0
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x22c]
jne 0x5668a4
xor ebx, ebx
jmp 0x5668a6
mov bl, 1
test bl, bl
je 0x5668b4
mov eax, dword [ebp - 4]
mov byte [eax + 0x48a], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
cmp eax, dword [ebp - 0x18]
jne 0x5668d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 0x1c]
jne 0x5668d4
xor eax, eax
jmp 0x5668d6
mov al, 1
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x3f2], 1
cmp byte [ebp - 0x1d], 0
je 0x566910
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4b0], 0
je 0x566910
mov eax, dword [ebp - 4]
call fcn.0044dad8
mov edx, eax
add edx, 0xa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
call fcn.0044d81c
mov eax, dword [ebp - 4]
call fcn.0055f7b0
test al, al
je 0x566fd0
mov eax, dword [ebp - 4]
test byte [eax + 0x2cd], 1
jne 0x56697a
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x238]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
jg 0x566956
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x480]
push edx
mov edx, eax
pop eax
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.005637c4
jmp 0x56697a
mov edx, dword [ebp - 4]
test byte [edx + 0x2ce], 0x40
je 0x56697a
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x480]
push edx
mov edx, eax
pop eax
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.005637c4
mov eax, dword [ebp - 4]
mov byte [eax + 0x48a], 0
test bl, bl
je 0x5669a1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
call fcn.00489004
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x38]
call fcn.0048e6a4
mov eax, dword [ebp - 4]
mov byte [eax + 0x3f2], 0
cmp byte [ebp - 0x1d], 0
je 0x5669bc
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x150]
mov esi, dword [ebp - 0x1c]
test esi, esi
jl 0x566b35
cmp byte [ebp - 0x11], 0
jne 0x566b35
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x478]
mov edx, esi
call fcn.00419bc8
mov eax, dword [eax + 8]
mov edx, 0x567020
call fcn.00404ca4
jne 0x566b35
mov byte [ebp - 0x45], 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x480]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.0055e574
test eax, eax
je 0x566b35
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x480]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.0055e574
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
call fcn.00489004
pop edx
call fcn.0048d16c
lea edx, [ebp - 0xec]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0xec]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x194]
lea eax, [ebp - 0x45]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x480]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.0055e574
mov ecx, eax
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xf8]
cmp byte [ebp - 0x45], 0
je 0x566b35
lea edx, [ebp - 0xf0]
mov eax, dword [ebp - 0x4c]
call fcn.0040937c
mov edx, dword [ebp - 0xf0]
mov eax, 0x567034
call fcn.0040e474
test eax, eax
jg 0x566af5
mov edx, dword [ebp - 0x4c]
mov eax, 0x567044
call fcn.0040e474
mov esi, eax
mov edx, dword [ebp - 0x4c]
mov eax, 0x567050
call fcn.0040e474
cmp esi, 1
jle 0x566af5
cmp esi, eax
jge 0x566af5
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov edx, 0x56705c
call fcn.00404bac
mov eax, dword [0x622238]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0046cfd4
push 1
push 0
push 0
mov eax, dword [ebp - 0x4c]
call fcn.00404d58
push eax
push 0x567064
mov eax, dword [ebp - 4]
call fcn.00454948
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x622238]
mov eax, dword [eax]
xor edx, edx
call fcn.0046cfd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
test byte [eax + 0x2cd], 0x40
je 0x566bba
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00568cc4
test al, al
jne 0x566bba
test byte [ebp - 0x12], 4
jne 0x566b68
test byte [ebp - 0x12], 1
je 0x566b92
mov eax, dword [ebp - 4]
mov si, 0xff96
call fcn.00403c58
test al, al
je 0x566b85
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1b8]
jmp 0x566bba
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1b4]
jmp 0x566bba
mov eax, dword [ebp - 4]
test byte [eax + 0x3f1], 1
je 0x566bba
test byte [ebp - 0x12], 8
je 0x566bba
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x140]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1b4]
mov eax, dword [ebp - 4]
test byte [eax + 0x2cd], 0x40
je 0x566c34
test byte [ebp - 0x12], 1
jne 0x566bde
test byte [ebp - 0x12], 4
jne 0x566bde
mov eax, dword [ebp - 4]
test byte [eax + 0x3f1], 1
je 0x566c34
mov eax, dword [ebp - 4]
test byte [eax + 0x3f1], 2
je 0x566c34
mov eax, dword [ebp - 4]
mov byte [eax + 0x48b], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
call fcn.00489004
call fcn.0048f1e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48c]
cmp eax, dword [ebp - 0x24]
jne 0x566c34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
call fcn.00489004
mov edx, dword [eax]
call dword [edx + 0x21c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x48c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
call fcn.004ab890
mov eax, dword [ebp - 4]
test byte [eax + 0x44c], 4
jne 0x566c98
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
call fcn.0056bbec
test al, al
je 0x566c98
mov eax, dword [ebp - 0x54]
mov edx, dword [0x50f88c]
call fcn.00403be8
test al, al
je 0x566c98
mov eax, dword [ebp - 4]
call fcn.0056eab0
jmp 0x566cf5
push 0
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
call fcn.00454948
push eax
call sub.user32.dll_GetUpdateRect
push 0
mov eax, dword [ebp - 4]
call fcn.00454948
push eax
call sub.user32.dll_ValidateRect
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x22c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
call fcn.004ab890
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x88]
push 0
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
call fcn.00454948
push eax
call sub.user32.dll_InvalidateRect
cmp byte [ebp - 0x25], 0
je 0x566f93
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4b0], 0
je 0x566f93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
call fcn.004039a4
mov edx, 0x567074
call fcn.005535f8
test al, al
jne 0x566f93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x258]
cmp eax, dword [ebp - 0x2c]
jne 0x566f93
test byte [ebp - 0x12], 4
jne 0x566f93
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x4b0]
mov edx, dword [ebp + 8]
sub edx, dword [esi + 0x44]
mov eax, dword [ebp + 0xc]
sub eax, dword [esi + 0x40]
lea ecx, [ebp - 0x34]
call fcn.0041854c
push 1
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
xor ecx, ecx
call fcn.00452298
mov esi, eax
test esi, esi
je 0x566dff
mov eax, esi
mov edx, dword [0x449ef0]
call fcn.00403be8
test al, al
je 0x566dff
lea ecx, [ebp - 0xf8]
lea edx, [ebp - 0x34]
mov eax, esi
call fcn.0044dc18
mov dx, word [ebp - 0x30]
sub dx, word [esi + 0x44]
mov di, word [ebp - 0x34]
mov eax, edi
sub ax, word [esi + 0x40]
call fcn.00408038
push eax
push 0
push 0x201
mov ebx, esi
mov eax, ebx
call fcn.00454948
push eax
call sub.user32.dll_SendMessageA
mov dx, word [ebp - 0x30]
sub dx, word [esi + 0x44]
mov eax, edi
sub ax, word [esi + 0x40]
call fcn.00408038
push eax
push 0
push 0x202
mov eax, ebx
call fcn.00454948
push eax
call sub.user32.dll_SendMessageA
jmp 0x566f93
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0056bbec
test al, al
je 0x566f46
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
cmp eax, dword [ebp - 0x44]
jne 0x566f46
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
mov edx, dword [0x50f88c]
call fcn.00403be8
test al, al
je 0x566f46
test bl, bl
je 0x566f46
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
mov ecx, dword [eax]
call dword [ecx + 0x110]
push 3
push 4
lea eax, [ebp - 0xd8]
push eax
call sub.user32.dll_InflateRect
xor eax, eax
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
push dword [eax + 0x40]
mov eax, dword [ebp + 0xc]
pop edx
sub eax, edx
lea ecx, [ebp - 0x34]
mov edx, 7
call fcn.0041854c
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea eax, [ebp - 0xd8]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x566f93
test bl, bl
je 0x566ee3
mov eax, dword [ebp - 0x38]
add eax, edi
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x22c]
jle 0x566ee3
test edi, edi
jle 0x566ee3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x2c0], edx
jmp 0x566ef6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
mov dword [eax + 0x2c0], 0xffffffff
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0056ebd0
xor eax, eax
push ebp
push 0x566f3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
mov dl, 1
call fcn.005134dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x566f93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
mov dword [eax + 0x2c0], 0xffffffff
ret
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x4b0]
mov eax, ebx
mov edx, dword [0x431c60]
call fcn.00403be8
test al, al
jne 0x566f93
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x4b0]
mov dx, word [ebp + 8]
sub dx, word [esi + 0x44]
mov ax, word [ebp + 0xc]
sub ax, word [esi + 0x40]
call fcn.00408038
push eax
push 0
push 0x201
mov eax, ebx
call fcn.00454948
push eax
call sub.user32.dll_SendMessageA
push ebp
call fcn.005662e4
pop ecx
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x4b0]
test ebx, ebx
je 0x566fd0
mov eax, ebx
call fcn.004039a4
mov edx, 0x567088
call fcn.005535f8
test al, al
je 0x566fd0
call sub.user32.dll_GetMessageTime
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4b0]
mov dword [edx + 0x40c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56700d
lea eax, [ebp - 0xf0]
mov edx, 2
call fcn.004048cc
lea eax, [ebp - 0xe8]
call fcn.00405b00
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.004048cc
ret