Function at 0x52b158
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
mov esi, 0x557de8
xor eax, eax
push ebp
push 0x52b44e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
cmp dword [eax + 0x382c], 0
je 0x52b42b
xor edx, edx
mov eax, dword [ebx + 0x4b4]
call fcn.004533f4
mov eax, dword [esi]
mov eax, dword [eax + 0x380]
xor edx, edx
call fcn.004533f4
mov eax, dword [ebx + 0x382c]
test eax, eax
je 0x52b1db
push eax
call dword [ebx + 0x580]
pop ecx
mov eax, dword [ebx + 0x382c]
push eax
call dword [ebx + 0x570]
pop ecx
xor eax, eax
mov dword [ebx + 0x382c], eax
xor eax, eax
mov dword [ebx + 0x3818], eax
xor edx, edx
mov eax, dword [ebx + 0x4b8]
call fcn.004784cc
mov eax, dword [esi]
mov eax, dword [eax + 0x3f0]
mov dl, 1
call fcn.004784cc
mov eax, dword [esi]
mov eax, dword [eax + 0x3d4]
xor edx, edx
call fcn.004784cc
mov eax, dword [esi]
mov eax, dword [eax + 0x3f0]
call fcn.0047882c
mov eax, dword [ebx + 0x41c]
mov edx, dword [eax + 0x40]
sub edx, 3
mov eax, dword [esi]
mov eax, dword [eax + 0x420]
call fcn.00477bac
mov eax, dword [esi]
mov eax, dword [eax + 0x424]
xor edx, edx
call fcn.00477c14
push 0
push 0xf4240
mov eax, dword [esi]
mov edx, dword [eax + 0x384c]
mov eax, dword [eax + 0x3848]
call fcn.00406b4c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
push 0xf4240
mov eax, dword [esi]
mov edx, dword [eax + 0x3844]
mov eax, dword [eax + 0x3840]
call fcn.00406b4c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
lea eax, [ebp - 4]
push eax
push 0
push 0xe10
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00406b4c
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0x10
push 0
push 0x3c
push 0
push 0xe10
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00406c2c
call fcn.00406b4c
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0x10
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00406c2c
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0x10
push 0
push 0xe10
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00406b4c
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0x10
push 0
push 0x3c
push 0
push 0xe10
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00406c2c
call fcn.00406b4c
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x70]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x10
push 0
push 0x3c
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00406c2c
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], edx
lea eax, [ebp - 0x78]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x10
lea edx, [ebp - 0x48]
mov ecx, 5
mov eax, 0x52b468
call fcn.0040dda4
mov eax, dword [0x54fac4]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x52b384
mov eax, dword [0x54fac4]
mov eax, dword [eax]
xor edx, edx
call fcn.00490a40
mov eax, dword [0x54fc54]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x52b39f
mov eax, dword [0x54fc54]
mov eax, dword [eax]
xor edx, edx
call fcn.00490a40
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3d8]
call fcn.004785bc
mov dword [ebx + 0x3838], 3
mov byte [ebx + 0x63e], 1
cmp byte [ebx + 0x3864], 0
je 0x52b3d0
xor edx, edx
mov eax, ebx
call fcn.0052ef5c
mov eax, ebx
call fcn.0052f784
lea ecx, [ebp - 0x7c]
lea eax, [ebx + 0x27bc]
mov edx, 0x3ff
call fcn.00408124
cmp dword [ebp - 0x7c], 0
je 0x52b41f
push 1
push 0
push 0
lea ecx, [ebp - 0x80]
mov eax, dword [esi]
add eax, 0x27bc
mov edx, 0x3ff
call fcn.00408124
mov eax, dword [ebp - 0x80]
call fcn.00405bcc
push eax
push 0x52b4a8
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x54febc]
mov eax, dword [eax]
call fcn.004996d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b455
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.00405b38
lea eax, [ebp - 4]
call fcn.00405b30
ret