Function at 0x599250
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x3c
push 0
push 0
dec ecx
jne 0x599259
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x599c0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
xor eax, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x11], 0
mov dword [esi + 0x330], 1
mov dword [esi + 0x334], 1
lea eax, [ebp - 0x70]
xor ecx, ecx
mov edx, 0x44
call fcn.004038a8
mov dword [ebp - 0x70], 0x44
cmp byte [ebp + 0xc], 0
je 0x5992cb
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], 0
jmp 0x5992dd
mov dword [ebp - 0x44], 1
mov eax, edi
call fcn.00596c30
mov word [ebp - 0x40], ax
mov eax, dword [0x5f67f0]
mov eax, dword [eax]
mov bl, byte [eax + 0x396]
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 4]
call fcn.004458f8
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x20]
call fcn.005991e4
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.005991e4
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 0x20]
call fcn.00599058
mov eax, dword [ebp - 0x194]
lea edx, [ebp - 0x190]
call fcn.0040b450
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x28]
call fcn.00409fa0
mov eax, dword [ebp - 0x20]
call fcn.005990fc
test al, al
je 0x599396
push 0x599c28
push dword [ebp - 0x20]
push 0x599c34
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004053f8
mov eax, dword [0x5f6bb4]
cmp byte [eax], 0
je 0x599380
lea eax, [ebp - 0x20]
mov edx, 0x599c40
call fcn.004050e4
jmp 0x59938d
lea eax, [ebp - 0x20]
mov edx, 0x599c50
call fcn.004050e4
mov byte [ebp - 0x11], 1
jmp 0x59952a
mov edx, 0x599c64
mov eax, dword [ebp - 0x28]
call fcn.0047cfdc
test al, al
je 0x5993e2
lea edx, [ebp - 0x198]
mov eax, dword [ebp - 0x20]
call fcn.005990a4
push dword [ebp - 0x198]
push 0x599c34
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004053f8
lea eax, [ebp - 0x20]
mov edx, 0x599c74
call fcn.004050e4
jmp 0x59952a
mov edx, 0x599c88
mov eax, dword [ebp - 0x28]
call fcn.0047cfdc
test al, al
je 0x599452
push 0x599c28
lea edx, [ebp - 0x19c]
mov eax, dword [ebp - 0x20]
call fcn.005990a4
push dword [ebp - 0x19c]
push 0x599c34
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004053f8
mov eax, dword [0x5f6bb4]
cmp byte [eax], 0
je 0x59943a
lea eax, [ebp - 0x20]
mov edx, 0x599c40
call fcn.004050e4
jmp 0x599447
lea eax, [ebp - 0x20]
mov edx, 0x599c50
call fcn.004050e4
mov word [ebp - 0x40], 0
jmp 0x59952a
lea eax, [ebp - 0x1a0]
mov ecx, 0x599c98
mov edx, dword [ebp - 0x28]
call fcn.00405384
mov eax, dword [ebp - 0x1a0]
mov edx, 0x599ca4
call fcn.00405680
test eax, eax
jne 0x59952a
lea eax, [ebp - 0x185]
push eax
push 0x599cd0
lea edx, [ebp - 0x1a4]
mov eax, dword [ebp - 4]
call fcn.00599058
mov eax, dword [ebp - 0x1a4]
call fcn.00405538
push eax
call sub.shell32.dll_FindExecutableA
cmp eax, 0x20
jbe 0x59952a
lea eax, [ebp - 0x1a8]
mov ecx, 0x599c98
mov edx, dword [ebp - 0x28]
call fcn.00405384
mov eax, dword [ebp - 0x1a8]
mov edx, 0x599cdc
call fcn.00405680
test eax, eax
jle 0x5994f3
push 0x599cf0
push dword [ebp - 4]
push 0x599c34
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004053f8
jmp 0x59951c
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 4]
call fcn.005990a4
push dword [ebp - 0x1ac]
push 0x599c34
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004053f8
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x185]
call fcn.0040b978
test bl, bl
je 0x59953b
lea eax, [ebp - 0x24]
call fcn.005dc280
jmp 0x5995cb
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x20]
call fcn.00599058
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x24]
call fcn.0040b2fc
lea edx, [ebp - 0x1b8]
mov eax, dword [ebp - 0x20]
call fcn.00599058
mov eax, dword [ebp - 0x1b8]
lea edx, [ebp - 0x1b4]
call fcn.0040b418
mov edx, dword [ebp - 0x1b4]
lea eax, [ebp - 0x20]
call fcn.004050e4
cmp dword [ebp - 0x24], 0
jbe 0x5995cb
cmp dword [ebp - 0x20], 0
jne 0x5995cb
lea eax, [ebp - 0x20]
mov edx, 0x599d00
call fcn.004050e4
lea eax, [esi + 0x308]
mov edx, dword [ebp - 0x20]
call fcn.004050a0
push dword [ebp - 0x24]
push 0x599c34
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004053f8
lea eax, [ebp - 0x24]
call fcn.0040504c
test bl, bl
jne 0x5996df
cmp dword [ebp - 0x24], 0
jne 0x59967b
lea edx, [ebp - 0x18]
mov eax, dword [0x5f67f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x354]
call fcn.0040b2fc
lea eax, [ebp - 0x185]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00405538
push eax
mov eax, dword [ebp - 0x20]
call fcn.00405538
push eax
call sub.shell32.dll_FindExecutableA
cmp eax, 0x20
jbe 0x599639
lea edx, [ebp - 0x1bc]
lea eax, [ebp - 0x185]
call fcn.0040b978
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x24]
call fcn.0040b2fc
jmp 0x5996df
lea ecx, [ebp - 0x1c0]
mov eax, dword [0x5f67f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x480]
mov edx, dword [ebp - 0x20]
call fcn.0044599c
mov eax, dword [ebp - 0x1c0]
call fcn.00445ce0
test al, al
je 0x5996df
lea eax, [ebp - 0x24]
mov edx, dword [0x5f67f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x480]
call fcn.004050e4
jmp 0x5996df
lea edx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x24]
call fcn.0040b384
cmp dword [ebp - 0x1c4], 0
jne 0x5996df
lea edx, [ebp - 0x18]
mov eax, dword [0x5f67f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x354]
call fcn.0040b384
mov edx, dword [ebp - 0x24]
mov eax, 0x599d18
call fcn.00405680
dec eax
je 0x5996d1
push dword [ebp - 0x18]
push 0x599d18
push dword [ebp - 0x24]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004053f8
jmp 0x5996df
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
call fcn.00405384
cmp byte [ebp - 9], 0
je 0x599bb4
cmp dword [ebp - 0x20], 0
jbe 0x599bb4
xor edx, edx
push ebp
push 0x599bad
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x5f6d74]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0046e9a0
lea ecx, [ebp - 0x1c8]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0044599c
mov edx, dword [ebp - 0x1c8]
lea eax, [esi + 0x30c]
call fcn.004050a0
cmp byte [ebp - 0x11], 0
jne 0x59978f
mov edx, edi
mov eax, 0x599d24
call fcn.0047d714
test al, al
je 0x59978f
lea edx, [esi + 0x324]
mov eax, dword [ebp - 0x20]
call fcn.00596e74
test al, al
je 0x59978f
mov byte [ebp - 0x12], 1
mov eax, dword [esi + 0x324]
push eax
push 0
push 0x400
call sub.KERNEL32.DLL_OpenProcess
mov dword [esi + 0x320], eax
cmp dword [esi + 0x320], 0
jne 0x599793
mov byte [ebp - 9], 0
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x2c], eax
jmp 0x599793
mov byte [ebp - 0x12], 0
cmp byte [ebp - 0x12], 0
jne 0x5998d8
test bl, bl
je 0x599806
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp - 0x24]
call fcn.00405538
push eax
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x1d0]
mov eax, dword [ebp - 0x20]
call fcn.005990a4
push dword [ebp - 0x1d0]
push 0x599c34
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1cc]
mov edx, 3
call fcn.004053f8
mov eax, dword [ebp - 0x1cc]
call fcn.00405538
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
jmp 0x599876
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x1dc]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0044599c
mov eax, dword [ebp - 0x1dc]
lea edx, [ebp - 0x1d8]
call fcn.005990a4
push dword [ebp - 0x1d8]
push 0x599c34
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1d4]
mov edx, 3
call fcn.004053f8
mov eax, dword [ebp - 0x1d4]
call fcn.00405538
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x5998d0
mov eax, dword [ebp - 0x80]
mov dword [esi + 0x320], eax
mov eax, dword [ebp - 0x78]
mov dword [esi + 0x324], eax
mov eax, dword [ebp - 0x7c]
mov dword [esi + 0x31c], eax
cmp byte [ebp + 0xc], 0
jne 0x5998b6
cmp dword [esi + 0x314], 0
ja 0x5998b6
mov edx, edi
mov eax, 0x599d34
call fcn.0047d714
test al, al
je 0x5998d8
push 0xffffffffffffffff
mov eax, dword [esi + 0x320]
push eax
call sub.user32.dll_WaitForInputIdle
push 0x1f4
call sub.KERNEL32.DLL_Sleep
jmp 0x5998d8
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x2c], eax
cmp byte [ebp - 9], 0
je 0x599b91
cmp byte [ebp - 0x12], 0
je 0x59991d
cmp byte [ebp + 0xc], 0
jne 0x59991d
lea edx, [ebp - 0x10]
mov eax, dword [esi + 0x324]
call fcn.00598ffc
test al, al
je 0x599b56
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x328], eax
movzx edx, word [ebp - 0x40]
mov eax, esi
call fcn.005991f8
jmp 0x599b56
cmp byte [ebp + 0xc], 0
jne 0x59993a
cmp dword [esi + 0x314], 0
jbe 0x599b56
cmp byte [ebp - 0x11], 0
jne 0x599b56
lea edx, [ebp - 0x10]
mov eax, dword [esi + 0x324]
call fcn.00598ffc
test al, al
je 0x599b26
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x328], eax
cmp byte [ebp + 0xc], 0
je 0x599b56
mov eax, dword [esi + 0x2f8]
call fcn.00457540
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SetParent
push 0xfffffffffffffff0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0xc00000
je 0x59998f
sub eax, 0xc00000
test eax, 0x80000
je 0x59999b
sub eax, 0x80000
test eax, 0x40000
je 0x5999a7
sub eax, 0x40000
test eax, 0x400000
je 0x5999b3
sub eax, 0x400000
test eax, 0x40000
je 0x5999bf
sub eax, 0x40000
test eax, 0x800000
jne 0x5999cb
add eax, 0x800000
push eax
push 0xfffffffffffffff0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SetWindowLongA
mov edx, edi
mov eax, 0x599d4c
call fcn.0047d714
test al, al
je 0x599a03
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetMenu
test eax, eax
je 0x599a03
push 0xf
call sub.user32.dll_GetSystemMetrics
mov dword [esi + 0x32c], eax
jmp 0x599a0b
xor eax, eax
mov dword [esi + 0x32c], eax
push 0x40
mov eax, dword [esi + 0x2f8]
call fcn.0045062c
mov edx, dword [esi + 0x334]
add edx, edx
add eax, edx
add eax, dword [esi + 0x32c]
push eax
mov eax, dword [esi + 0x2f8]
call fcn.004505e8
mov edx, dword [esi + 0x330]
add edx, edx
add eax, edx
push eax
xor eax, eax
sub eax, dword [esi + 0x334]
sub eax, dword [esi + 0x32c]
push eax
xor eax, eax
sub eax, dword [esi + 0x330]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SetWindowPos
mov edx, edi
mov eax, 0x599d60
call fcn.0047d714
test al, al
je 0x599b56
mov ecx, esi
mov dl, 1
mov eax, dword [0x4412b4]
call fcn.004429c8
mov ebx, eax
mov dword [esi + 0x338], ebx
mov eax, ebx
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [esi + 0x338]
xor edx, edx
call fcn.00442dfc
mov eax, dword [esi + 0x338]
xor edx, edx
call fcn.00442e18
push 9
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [esi + 0x338]
call fcn.004503c4
push 0xa
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [esi + 0x338]
call fcn.004503a0
mov eax, dword [esi + 0x2f8]
call fcn.004505e8
mov edx, eax
mov eax, dword [esi + 0x338]
sub edx, dword [eax + 0x48]
mov eax, dword [esi + 0x338]
call fcn.00450354
mov eax, dword [esi + 0x2f8]
call fcn.0045062c
mov edx, eax
mov eax, dword [esi + 0x338]
sub edx, dword [eax + 0x4c]
mov eax, dword [esi + 0x338]
call fcn.00450378
mov eax, dword [esi + 0x338]
call fcn.00451124
jmp 0x599b56
cmp byte [ebp + 0xc], 0
je 0x599b56
cmp byte [ebp + 8], 0
je 0x599b52
mov ebx, dword [0x5f68a4]
mov ebx, dword [ebx]
lea edx, [ebp - 0x1e0]
mov eax, 0x14b
call ebx
mov eax, dword [ebp - 0x1e0]
call fcn.005deac0
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x599b91
mov edx, edi
mov eax, 0x599d74
call fcn.0047d714
test al, al
jne 0x599b91
cmp dword [esi + 0x314], 0
ja 0x599b84
cmp dword [esi + 0x318], 0
ja 0x599b84
cmp byte [ebp + 0xc], 0
je 0x599b91
mov eax, dword [esi + 0x2fc]
mov dl, 1
call fcn.0044297c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599bb4
mov eax, dword [0x5f6d74]
mov eax, dword [eax]
xor edx, edx
call fcn.0046e9a0
ret
cmp byte [ebp - 9], 0
jne 0x599bdf
cmp dword [ebp - 0x2c], 0
je 0x599bdf
cmp byte [ebp + 8], 0
je 0x599bdf
lea edx, [ebp - 0x1e4]
mov eax, dword [ebp - 0x2c]
call fcn.0040e770
mov eax, dword [ebp - 0x1e4]
call fcn.005deac0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599c11
lea eax, [ebp - 0x1e4]
mov edx, 0x17
call fcn.00405070
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.00405070
ret