Function at 0x5ae1a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
mov eax, dword [ebp + 8]
call fcn.004047e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0041f734
mov edi, eax
cmp dword [edi + 0x65], 0
jne 0x5ae1e4
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.005ad660
cmp byte [edi + 0x1f], 0
je 0x5ae214
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x3ff00000
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x3ff00000
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
jmp 0x5ae26e
lea eax, [edi + 0x30]
lea edx, [edi + 0x20]
mov ecx, dword [edx]
mov ebx, ecx
add ebx, dword [edx + 8]
mov esi, dword [eax + 0x28]
sub esi, ebx
mov dword [ebp - 0x34], esi
fild dword [ebp - 0x34]
fild dword [eax + 8]
fdivp st(1)
fstp qword [ebp - 0x18]
wait
mov ebx, dword [edx + 4]
add ebx, dword [edx + 0xc]
mov esi, dword [eax + 0x2c]
sub esi, ebx
mov dword [ebp - 0x34], esi
fild dword [ebp - 0x34]
fild dword [eax + 0xc]
fdivp st(1)
fstp qword [ebp - 0x20]
wait
mov ebx, dword [eax + 0x18]
add ebx, ecx
mov dword [ebp - 0x34], ebx
fild dword [ebp - 0x34]
fstp qword [ebp - 0x28]
wait
mov eax, dword [eax + 0x1c]
add eax, dword [edx + 4]
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
fstp qword [ebp - 0x30]
wait
mov eax, dword [edi + 0x65]
mov eax, dword [eax + 0xfc]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5ae407
mov eax, dword [edi + 0x65]
mov eax, dword [eax + 0xfc]
mov edx, esi
call fcn.0041f734
mov ebx, eax
push dword [ebp - 8]
push dword [ebp - 0xc]
mov eax, dword [ebx + 0x98]
add eax, dword [ebx + 0xa0]
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
fmul qword [ebp - 0x20]
fadd qword [ebp - 0x30]
call fcn.00402c14
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebx + 0x94]
add eax, dword [ebx + 0x9c]
mov dword [ebp - 0x48], eax
fild dword [ebp - 0x48]
fmul qword [ebp - 0x18]
fadd qword [ebp - 0x28]
call fcn.00402c14
push eax
fild dword [ebx + 0x98]
fmul qword [ebp - 0x20]
fadd qword [ebp - 0x30]
call fcn.00402c14
push eax
fild dword [ebx + 0x94]
fmul qword [ebp - 0x18]
fadd qword [ebp - 0x28]
call fcn.00402c14
pop edx
pop ecx
call fcn.0041e058
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x5ae3fd
cmp byte [ebp + 0x10], 0
je 0x5ae3aa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp word [eax + 0xc2], 0
je 0x5ae345
mov edi, eax
mov edx, ebx
mov eax, dword [edi + 0xc4]
call dword [edi + 0xc0]
mov byte [ebp - 0xd], 1
mov edx, dword [ebx + 0x54]
mov eax, 0x5ae41c
call fcn.00404df4
dec eax
jne 0x5ae407
mov edx, dword [ebx + 0xd0]
mov eax, 0x5ae428
call fcn.00404df4
test eax, eax
jle 0x5ae37d
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0xd0]
call fcn.00404834
jmp 0x5ae3a4
mov eax, dword [ebp + 8]
call fcn.004047e0
push 1
push 0
push 0
mov eax, dword [ebx + 0xd0]
call fcn.00404cb0
push eax
push 0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov byte [ebp - 0xd], 1
jmp 0x5ae407
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp word [eax + 0xca], 0
je 0x5ae3d1
mov edi, eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov eax, dword [edi + 0xcc]
call dword [edi + 0xc8]
mov byte [ebp - 0xd], 1
mov edx, dword [ebx + 0x54]
mov eax, 0x5ae41c
call fcn.00404df4
dec eax
jne 0x5ae407
mov eax, dword [ebp + 0xc]
mov word [eax], 0xffeb
mov eax, dword [ebp + 8]
mov edx, dword [ebx + 0xd0]
call fcn.00404834
mov byte [ebp - 0xd], 1
jmp 0x5ae407
dec esi
cmp esi, 0xffffffff
jne 0x5ae284
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc