Function at 0x51b9c0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x304c
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x3048], eax
mov eax, dword [esp + 0x3058]
push ebx
push ebp
mov ebp, dword [esp + 0x306c]
push esi
mov esi, dword [esp + 0x3060]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3068]
push edi
cmp word [esi], 0x22
mov edi, dword [esp + 0x3078]
mov dword [esp + 0x18], eax
jne 0x51ba2b
push 0x800
push esi
lea eax, [esp + 0x60]
push eax
call fcn.004bdae0
lea eax, [esp + 0x58]
push eax
call fcn.004d91b0
lea esi, [esp + 0x58]
cmp byte [esp + 0x3070], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x20], 0x500
jne 0x51ba8d
mov dword [esp + 0x20], 0x540
push esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
call fcn.004a3770
cmp eax, esi
push esi
sete byte [esp + 0x17]
call fcn.004a2790
mov edi, eax
test edi, edi
je 0x51bc88
cmp word [edi], 0x2e
lea ebx, [edi + 2]
jne 0x51bac5
cmp word [ebx], 0
je 0x51bc88
cmp byte [esp + 0x13], 0
jne 0x51baf6
push 0x56dd40
push esi
call fcn.004a18a0
test al, al
jne 0x51baf6
mov eax, dword [esp + 0x14]
or dword [esp + 0x20], 1
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x44], edi
mov dword [esp + 0x30], eax
jmp 0x51bb42
cmp byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
je 0x51bb42
push 0x558920
push esi
call fcn.004a18a0
test al, al
jne 0x51bb42
push esi
push str.._s
lea eax, [esp + 0x1060]
push 0x1000
push eax
call fcn.00404ce0
lea eax, [esp + 0x1068]
add esp, 0x10
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x38], 1
push eax
mov byte [0x5943f5], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp word [edi], 0x2e
mov esi, eax
jne 0x51bb6a
cmp word [ebx], 0
je 0x51bb7a
push edi
call fcn.004a3740
cmp word [eax], 0x20
je 0x51bb7a
xor bl, bl
jmp 0x51bb7c
mov bl, 1
test esi, esi
jne 0x51bbe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
jne 0x51bba7
test bl, bl
jne 0x51bba7
and dword [esp + 0x20], 0xfffffffe
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
jne 0x51bbe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x51bbc6
test ebp, ebp
je 0x51bbbf
mov dword [ebp], 0
mov al, 1
jmp 0x51bc8a
cmp dword [esp + 0x28], 0
je 0x51bbe2
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
mov byte [0x5943f5], 0
test esi, esi
je 0x51bc88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
je 0x51bc88
cmp byte [esp + 0x3070], 0
jne 0x51bc84
mov edx, dword [esp + 0x54]
test edx, edx
je 0x51bc42
mov ecx, dword [0x6049b0]
mov eax, dword [esp + 0x3c]
mov dword [ecx*4 + 0x604970], eax
lea eax, [ecx + 1]
mov dword [ecx*4 + 0x604930], edx
and eax, 0x8000000f
jns 0x51bc3b
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x6049b0], eax
jmp 0x51bc7d
xor esi, esi
mov eax, dword [esi + 0x604970]
cmp eax, dword [esp + 0x3c]
jne 0x51bc75
push 0
push dword [esi + 0x604930]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x51bc71
mov edx, dword [esi + 0x604930]
mov dword [esp + 0x54], edx
jmp 0x51bc75
mov edx, dword [esp + 0x54]
add esi, 4
cmp esi, 0x40
jl 0x51bc44
test ebp, ebp
je 0x51bc84
mov dword [ebp], edx
mov al, 1
jmp 0x51bc8a
xor al, al
mov ecx, dword [esp + 0x3058]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x304c
ret 0x1c