Function at 0x51a640
Capabilities:
Create process on windows
Create process suspended
Delete file
Get common file path
Read .ini file
Resume thread

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x398]
lea esi, [ebp - 0x3c8]
push ebx
mov edi, edx
lea ebx, [ebp - 0x22f]
sub esp, 0x3f8
mov byte [0x84fdc0], 0
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.kernel32.dll_GetTempPathA]
mov ecx, 1
mov dword [ebp - 0x39c], 0x44
mov word [ebp - 0x36c], cx
mov dword [ebp - 0x370], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x104
mov dword [ebp - 0x3cc], eax
call eax
mov ecx, dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5eee65
mov dword [ebp - 0x3d0], ecx
call ecx
sub esp, 0x10
mov dword [esp], ebx
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
call fcn.0050d7a0
call fcn.0057d110
lea edx, [ebp - 0x39c]
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4b2
mov dword [esp + 0x20], edx
mov edx, dword [sym.imp.kernel32.dll_CreateProcessA]
mov dword [esp + 0x24], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [ebp - 0x3dc], edx
call edx
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], str.CreateProcess_failed_n
call fcn.0050e8b0
mov eax, esi
call fcn.0050e290
mov edi, dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x3d4], edi
call edi
mov ecx, str.cntUsage
mov edx, str.Toolhelp
mov eax, 0x4b6
sub esp, 0x10
mov dword [esp], 0
mov edi, dword fs:[0x18]
call fcn.005104e0
mov ecx, str.th32DefaultHeapID
mov edx, str.Toolhelp
mov dword [esp], 0
mov eax, 0x4b7
call fcn.005104e0
mov ecx, str.th32ModuleID
mov edx, str.Toolhelp
mov dword [esp], 0
mov eax, 0x4b8
call fcn.005104e0
mov eax, dword [edi + 0x20]
mov ecx, str.th32ParentProcessID
mov edx, str.Toolhelp
mov dword [esp], eax
mov eax, 0x4b9
call fcn.005104e0
mov edx, str.Toolhelp
mov ecx, str.dwFlags
mov dword [esp], 0
mov eax, 0x4bb
call fcn.005104e0
mov eax, dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov dword [ebp - 0x3d8], eax
call eax
lea eax, [ebp - 0x358]
mov byte [0x84fdc0], 0
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], 0x104
mov eax, dword [ebp - 0x3cc]
call eax
lea eax, [ebp - 0x358]
sub esp, 8
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5eee65
mov dword [esp], eax
mov ecx, dword [ebp - 0x3d0]
call ecx
sub esp, 0x10
mov dword [esp], ebx
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_nested___s_
call fcn.0050d7a0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4c2
lea eax, [ebp - 0x39c]
mov dword [esp + 0x24], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x3dc]
call edx
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], str.CreateProcess_failed_n
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4c3
mov eax, dword [ebp - 0x3c8]
mov dword [esp], eax
call fcn.0057d980
mov eax, dword [ebp - 0x3c0]
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov dword [esp + 8], eax
mov eax, dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [ebp - 0x3d0], eax
call eax
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4c6
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.OpenProcess_failed__lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], ebx
mov dword [ebp - 0x3cc], esi
call esi
mov eax, dword [ebp - 0x3c8]
sub esp, 4
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x3c4]
sub esp, 4
mov dword [esp], eax
call esi
xor esi, esi
sub esp, 4
jmp 0x51aa32
mov dword [esp + 8], eax
add esi, 1
mov dword [esp + 4], str.OpenProcess_failed__lu_n
mov dword [esp], 1
call fcn.0050e8b0
mov dword [esp], ebx
mov eax, dword [ebp - 0x3cc]
call eax
sub esp, 4
mov dword [esp], 0x64
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
cmp esi, 0x14
je 0x51afd8
mov eax, dword [ebp - 0x3c0]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0x1f0fff
mov eax, dword [ebp - 0x3d0]
call eax
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4d0
mov eax, dword [edi + 0x34]
test ebx, ebx
jne 0x51a9f0
cmp eax, 0x57
je 0x51afa0
mov dword [esp + 8], eax
mov dword [esp + 4], str.OpenProcess_failed__lu_n
mov dword [esp], 0
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4d6
mov eax, 1
mov dword [esp], eax
lea edi, [ebp - 0x358]
mov dword [esp + 4], str.process_object_not_released_n
call fcn.0050e8b0
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x3d4]
call eax
sub esp, 0x10
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5f164b
mov dword [esp], str.Nested
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
sub esp, 0x10
mov esi, eax
mov dword [esp], 0x84fdc0
mov eax, dword [ebp - 0x3d8]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], 2
call dword [0x850138]
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4de
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.CreateToolhelp32Snapshot_failed__lu_n
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp], eax
call fcn.0050e8b0
xor eax, eax
mov ecx, 0x4a
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x358]
mov dword [ebp - 0x358], 0x128
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [0x850134]
sub esp, 8
test eax, eax
jne 0x51af5e
mov dword [esp], ebx
mov eax, dword [ebp - 0x3cc]
lea ebx, [ebp - 0x334]
call eax
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4e7
xor eax, eax
mov dword [esp + 4], str.failed_to_find_nested_child_process_n
cmp dword [ebp - 0x350], esi
sete al
mov dword [esp], eax
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4e8
mov edx, dword [ebp - 0x3c0]
mov eax, dword [ebp - 0x340]
mov dword [esp + 4], str.nested_child_process_has_parent__lu_instead_of__lu_n
mov dword [esp + 0xc], edx
cmp edx, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
call fcn.0057d110
mov esi, dword [0x84fec4]
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4e9
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__stricmp]
mov dword [esp + 0xc], esi
test eax, eax
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.nested_executable_is__s_instead_of__s_n
movzx eax, al
mov dword [esp], eax
mov edi, dword fs:[0x18]
call fcn.0050e8b0
mov eax, dword [ebp - 0x350]
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3d0]
call eax
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4ec
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.OpenProcess_failed__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 4], 0
mov dword [esp], 4
call dword [0x850138]
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4ef
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateToolhelp32Snapshot_failed__lu_n
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp], eax
call fcn.0050e8b0
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x3b4], edx
add eax, 4
cmp eax, 0x18
jb 0x51ad22
mov dword [ebp - 0x3b8], 0x1c
lea edi, [ebp - 0x3b8]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [0x85012c]
sub esp, 8
test eax, eax
jne 0x51af88
mov dword [esp], ebx
mov edi, dword [ebp - 0x3cc]
call edi
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4f8
mov dword [esp + 4], str.failed_to_find_suspended_thread_n
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x3ac], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword [ebp - 0x3b0]
mov dword [esp + 4], 0
mov dword [esp], 0x1f03ff
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenThread]
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4fb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.OpenThread_failed__lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ResumeThread]
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4fd
xor eax, eax
cmp edi, 1
sete al
mov dword [esp + 8], edi
mov dword [esp + 4], 0x5f1714
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp], ebx
mov edi, dword [ebp - 0x3cc]
call edi
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x500
mov dword [esp], esi
call fcn.0057d980
mov dword [esp], esi
call edi
sub esp, 4
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x3d4]
call eax
mov ecx, str.cntUsage
mov edx, str.Toolhelp
mov eax, 0x504
sub esp, 0x10
mov dword [esp], 0
call fcn.005104e0
mov ecx, str.th32DefaultHeapID
mov edx, str.Toolhelp
mov dword [esp], 0
mov eax, 0x505
call fcn.005104e0
mov ecx, str.th32ModuleID
mov edx, str.Toolhelp
mov dword [esp], 0
mov eax, 0x506
call fcn.005104e0
mov eax, dword [ebp - 0x3c0]
mov ecx, str.th32ParentProcessID
mov edx, str.Toolhelp
mov dword [esp], eax
mov eax, 0x507
call fcn.005104e0
mov ecx, str.dwFlags
mov edx, str.Toolhelp
mov dword [esp], 0
mov eax, 0x509
call fcn.005104e0
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov eax, dword [ebp - 0x3d8]
call eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x358]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [0x850130]
sub esp, 8
test eax, eax
je 0x51abb2
cmp dword [ebp - 0x350], esi
jne 0x51af40
jmp 0x51abb2
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [0x850128]
sub esp, 8
test eax, eax
je 0x51ad59
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x3ac], eax
jne 0x51af70
jmp 0x51ad59
mov dword [esp + 8], 0x57
mov dword [esp + 4], str.OpenProcess_failed__lu_n
mov dword [esp], 1
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x4d6
jmp 0x51aaaf
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov edx, dword [0x8f0770]
mov dword [eax + 4], 0x4d6
xor eax, eax
test edx, edx
sete al
jmp 0x51aab4