Function at 0x5cf050
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4727
mov eax, dword fs:[0]
push eax
sub esp, 0x504
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4b8], ecx
mov dword [ebp - 0x4b4], 0
call fcn.00448800
mov ecx, eax
call fcn.0051c8e0
test eax, eax
jne 0x5cf0b3
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x4b8]
call fcn.005bb890
jmp 0x5cfa17
cmp dword [ebp + 8], 0
jne 0x5cf0be
jmp 0x5cfa17
push 0xfde9
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x1b0]
call fcn.004550e0
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x4c0]
call fcn.00493020
push eax
lea ecx, [ebp - 0x48]
call fcn.00401c00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1b0]
call fcn.0040e6c0
lea ecx, [ebp - 0xdc]
call fcn.005480b0
mov byte [ebp - 4], 3
push 0
lea ecx, [ebp - 0x5c]
call fcn.00544f40
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48]
call fcn.00401360
push eax
lea ecx, [ebp - 0x1d0]
call fcn.00401c00
mov byte [ebp - 4], 5
push 1
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x1d0]
push edx
lea ecx, [ebp - 0xdc]
call fcn.005493a0
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x1b1], al
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1d0]
call fcn.00401d60
movzx ecx, byte [ebp - 0x1b1]
test ecx, ecx
je 0x5cf23d
cmp dword [0x67e1c8], 0
je 0x5cf20e
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d4], 0xa7
lea edx, [ebp - 0x1d8]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x604a90
push 0x604a88
push 0x604a50
push 0x604a48
lea ecx, [ebp - 0x1d4]
push ecx
push 0x604a44
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00545090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdc]
call fcn.0044a910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401d60
jmp 0x5cfa17
lea ecx, [ebp - 0x5c]
call fcn.00543e60
movzx edx, al
test edx, edx
jne 0x5cf25f
lea ecx, [ebp - 0x5c]
call fcn.00543eb0
movzx eax, al
test eax, eax
jne 0x5cf308
cmp dword [0x67e1c8], 0
je 0x5cf2d9
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0xad
lea ecx, [ebp - 0x1e0]
push ecx
push 0x604af8
push 0x604af0
push 0x604ab8
push 0x604ab0
lea edx, [ebp - 0x1dc]
push edx
push 0x604aac
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00545090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdc]
call fcn.0044a910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401d60
jmp 0x5cfa17
push 0x604b14
lea ecx, [ebp - 0x5c]
call fcn.005462d0
mov ecx, eax
call fcn.00543e80
movzx eax, al
test eax, eax
je 0x5cf371
lea ecx, [ebp - 0x200]
push ecx
push 0x604b18
lea ecx, [ebp - 0x5c]
call fcn.005462d0
mov ecx, eax
call fcn.00544ab0
mov dword [ebp - 0x4c4], eax
mov edx, dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x4b4]
or eax, 1
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4c8]
mov dword [ebp - 0x4cc], ecx
jmp 0x5cf3b5
push 0x6028bb
lea ecx, [ebp - 0x21c]
call fcn.00401c00
mov dword [ebp - 0x4d0], eax
mov edx, dword [ebp - 0x4d0]
mov dword [ebp - 0x4d4], edx
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x4b4]
or eax, 2
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0x4cc], ecx
mov edx, dword [ebp - 0x4cc]
mov dword [ebp - 0x1e4], edx
mov eax, dword [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004015d0
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x4b4]
and ecx, 2
je 0x5cf3f4
and dword [ebp - 0x4b4], 0xfffffffd
lea ecx, [ebp - 0x21c]
call fcn.00401d60
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x4b4]
and edx, 1
je 0x5cf415
and dword [ebp - 0x4b4], 0xfffffffe
lea ecx, [ebp - 0x200]
call fcn.00401d60
push 0x604b1c
lea ecx, [ebp - 0x5c]
call fcn.005462d0
mov ecx, eax
call fcn.00543e80
movzx eax, al
test eax, eax
je 0x5cf47e
lea ecx, [ebp - 0x23c]
push ecx
push 0x604b24
lea ecx, [ebp - 0x5c]
call fcn.005462d0
mov ecx, eax
call fcn.00544ab0
mov dword [ebp - 0x4d8], eax
mov edx, dword [ebp - 0x4d8]
mov dword [ebp - 0x4dc], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x4b4]
or eax, 4
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x4e0], ecx
jmp 0x5cf4c2
push 0x6028c3
lea ecx, [ebp - 0x258]
call fcn.00401c00
mov dword [ebp - 0x4e4], eax
mov edx, dword [ebp - 0x4e4]
mov dword [ebp - 0x4e8], edx
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x4b4]
or eax, 8
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4e8]
mov dword [ebp - 0x4e0], ecx
mov edx, dword [ebp - 0x4e0]
mov dword [ebp - 0x220], edx
mov eax, dword [ebp - 0x220]
push eax
lea ecx, [ebp - 0x114]
call fcn.004015d0
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x4b4]
and ecx, 8
je 0x5cf504
and dword [ebp - 0x4b4], 0xfffffff7
lea ecx, [ebp - 0x258]
call fcn.00401d60
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x4b4]
and edx, 4
je 0x5cf525
and dword [ebp - 0x4b4], 0xfffffffb
lea ecx, [ebp - 0x23c]
call fcn.00401d60
push 0x604b2c
lea ecx, [ebp - 0x5c]
call fcn.005462d0
mov ecx, eax
call fcn.00543e80
movzx eax, al
test eax, eax
je 0x5cf58e
lea ecx, [ebp - 0x278]
push ecx
push 0x604b34
lea ecx, [ebp - 0x5c]
call fcn.005462d0
mov ecx, eax
call fcn.00544ab0
mov dword [ebp - 0x4ec], eax
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x4f0], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x4b4]
or eax, 0x10
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4f0]
mov dword [ebp - 0x4f4], ecx
jmp 0x5cf5d2
push 0x6028cb
lea ecx, [ebp - 0x294]
call fcn.00401c00
mov dword [ebp - 0x4f8], eax
mov edx, dword [ebp - 0x4f8]
mov dword [ebp - 0x4fc], edx
mov dword [ebp - 4], 0x11
mov eax, dword [ebp - 0x4b4]
or eax, 0x20
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0x4f4], ecx
mov edx, dword [ebp - 0x4f4]
mov dword [ebp - 0x25c], edx
mov eax, dword [ebp - 0x25c]
push eax
lea ecx, [ebp - 0xf8]
call fcn.004015d0
mov dword [ebp - 4], 0x13
mov ecx, dword [ebp - 0x4b4]
and ecx, 0x20
je 0x5cf614
and dword [ebp - 0x4b4], 0xffffffdf
lea ecx, [ebp - 0x294]
call fcn.00401d60
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x4b4]
and edx, 0x10
je 0x5cf635
and dword [ebp - 0x4b4], 0xffffffef
lea ecx, [ebp - 0x278]
call fcn.00401d60
push 0xfde9
lea ecx, [ebp - 0x114]
call fcn.00401360
push eax
lea ecx, [ebp - 0x398]
call fcn.0040e420
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x504], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x504]
call fcn.00493020
push eax
lea ecx, [ebp - 0x60]
call fcn.004092b0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x398]
call fcn.0040e6c0
lea ecx, [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x4b8]
add ecx, 0x3c4
mov edx, dword [ebp - 0x4b8]
mov eax, dword [edx + 0x3c4]
mov edx, dword [eax + 0x10]
call edx
push 0xfde9
lea ecx, [ebp - 0xf8]
call fcn.00401360
push eax
lea ecx, [ebp - 0x49c]
call fcn.0040e420
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x50c], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x50c]
call fcn.00493020
push eax
lea ecx, [ebp - 0x64]
call fcn.004092b0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x49c]
call fcn.0040e6c0
lea ecx, [ebp - 0x64]
call fcn.0040ee60
movzx ecx, al
test ecx, ecx
je 0x5cf7fe
cmp dword [0x67e1c8], 0
je 0x5cf78d
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a0], 0xbb
lea edx, [ebp - 0x4a4]
push edx
push 0x604b88
push 0x604b80
push 0x604b48
push 0x604b40
lea eax, [ebp - 0x4a0]
push eax
push 0x604b3c
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x64]
call fcn.00403270
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x60]
call fcn.00403270
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf8]
call fcn.00401d60
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x114]
call fcn.00401d60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00401d60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00545090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdc]
call fcn.0044a910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401d60
jmp 0x5cfa17
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x4b8]
call fcn.005cee70
test eax, eax
jne 0x5cf9a3
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.00579de0
add esp, 8
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x11c]
call fcn.00403290
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x64]
push eax
push 0x604ba4
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00403240
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.00493020
push eax
lea ecx, [ebp - 0x120]
call fcn.00493020
push eax
call fcn.005767c0
add esp, 8
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x5cf985
push 1
push 0
push 0
lea ecx, [ebp - 0x64]
call fcn.00493020
push eax
push 0x604bb8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cdq
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], edx
cmp dword [0x67e1c8], 0
je 0x5cf985
mov dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x128], 0
jl 0x5cf8e1
jg 0x5cf8d8
cmp dword [ebp - 0x12c], 0x20
jbe 0x5cf8e1
mov byte [ebp - 0x50d], 1
jmp 0x5cf8e8
mov byte [ebp - 0x50d], 0
mov dl, byte [ebp - 0x50d]
mov byte [ebp - 0x4a9], dl
mov dword [ebp - 0x4a8], 0xc9
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x4a9]
push ecx
push 0x604c2c
lea ecx, [ebp - 0x64]
call fcn.00493020
push eax
push 0x604c10
push 0x604c08
push str.KPushPop::OnJsEventOpenUrl
push 0x604bc8
lea edx, [ebp - 0x4a8]
push edx
push 0x604bc4
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004540b0
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x11c]
call fcn.00403270
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x120]
call fcn.00403270
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x64]
call fcn.00403270
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x60]
call fcn.00403270
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf8]
call fcn.00401d60
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x114]
call fcn.00401d60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00401d60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00545090
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdc]
call fcn.0044a910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401d60
xor eax, eax
jne 0x5cf0b3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret 8