Function at 0x5117d0
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x314]
lea esi, [ebp - 0x318]
push ebx
mov edi, edx
lea ebx, [ebp - 0x22d]
mov edx, 1
sub esp, 0x348
mov byte [0x84fdc0], 0
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x290]
mov word [ebp - 0x2e8], dx
mov dword [ebp - 0x318], 0x44
mov dword [ebp - 0x2ec], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5eee65
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 0x10
mov dword [esp], ebx
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s_
call fcn.0050d7a0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5e3
lea eax, [ebp - 0x328]
mov dword [esp + 0x20], esi
mov dword [esp + 4], ebx
xor ebx, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov dword [esp + 4], 0x5ef99c
mov dword [esp], eax
call fcn.0050e8b0
mov esi, dword [sym.imp.kernel32.dll_WaitForDebugEvent]
mov dword [ebp - 0x32c], 0
jmp 0x51196b
cmp dword [ebp - 0x290], 1
je 0x51191c
add ebx, 1
call fcn.0057d110
mov dword [eax], 0x5eee7f
cmp dword [ebp - 0x290], 6
mov dword [eax + 4], 0x5f1
mov eax, 1
jne 0x51194e
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x280], eax
setne al
movzx eax, al
mov dword [esp + 4], str.got_LOAD_DLL_for_main_module_n
mov dword [esp], eax
call fcn.0050e8b0
cmp dword [ebp - 0x290], 5
je 0x511a10
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5e8
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call esi
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], str.reading_debug_event_n
call fcn.0050e8b0
mov dword [esp + 8], 0x10002
mov eax, dword [ebp - 0x288]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ContinueDebugEvent]
sub esp, 0xc
test ebx, ebx
jne 0x511910
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5ec
mov eax, dword [ebp - 0x290]
mov dword [esp + 4], str.first_event:__ld_n
cmp eax, 3
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x32c], eax
jmp 0x511910
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5f5
mov dword [esp], ebx
mov dword [esp + 4], str.I_have_seen_a_debug_event_n
call fcn.0050e8b0
lea eax, [ebp - 0x328]
call fcn.0050e290
lea eax, [ebp - 0x2d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x318]
mov ecx, 0x5efae5
mov edx, str.StartupInfoA
sub esp, 0x10
mov dword [esp], eax
mov eax, 0x5fb
call fcn.005104e0
mov ecx, str.lpDesktop
mov edx, str.StartupInfoA
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x2cc]
mov dword [esp], eax
mov eax, 0x5fc
call fcn.00510420
mov edx, str.lpTitle
mov eax, str.StartupInfoA
call fcn.0050dfd0
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x5fe
mov eax, dword [0x8f0770]
test eax, eax
jne 0x511c40
mov eax, 1
test ebx, ebx
jne 0x511c50
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.expected__s_or_null__got__s_n
call fcn.0050e8b0
mov eax, dword [ebp - 0x308]
mov ecx, 0x5efb29
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x600
call fcn.005104e0
mov eax, dword [ebp - 0x304]
mov ecx, 0x5efb2d
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x601
call fcn.005104e0
mov eax, dword [ebp - 0x300]
mov ecx, str.dwXSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x602
call fcn.005104e0
mov eax, dword [ebp - 0x2fc]
mov ecx, str.dwYSize
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x603
call fcn.005104e0
mov eax, dword [ebp - 0x2f8]
mov ecx, str.dwXCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x604
call fcn.005104e0
mov eax, dword [ebp - 0x2f4]
mov ecx, str.dwYCountChars
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x605
call fcn.005104e0
mov eax, dword [ebp - 0x2f0]
mov ecx, str.dwFillAttribute
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x606
call fcn.005104e0
mov eax, dword [ebp - 0x2ec]
mov ecx, str.dwFlags
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0x607
call fcn.005104e0
mov ecx, str.wShowWindow
mov edx, str.StartupInfoA
movzx eax, word [ebp - 0x2e8]
mov dword [esp], eax
mov eax, 0x608
call fcn.005104e0
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
test ebx, ebx
je 0x511af6
lea esi, [esi]
mov dword [esp + 4], 0x84fee0
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
sete al
movzx eax, al
jmp 0x511af6