Function at 0xb50f16
Capabilities:
Create process on windows

Disassembly:
push 0x134
mov eax, 0xbcb781
call fcn.00bc132b
mov edi, ecx
mov esi, dword [ebp + 8]
cmp esi, dword [edi + 0x160]
je 0xb5102e
push ecx
push 0xb29c08
lea ecx, [ebp - 0xcc]
call fcn.00b80bc1
push esi
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0xb13b98
call fcn.00b50db5
xor ebx, ebx
lea eax, [esi - 0x1f4]
mov dword [ebp - 4], ebx
mov dword [edi + 0x160], esi
cmp eax, 0x4d
ja case.0xb50f7e.517
movzx eax, byte [eax + 0xb510a2]
jmp dword [eax*4 + 0xb51042]
cmp byte [edi + 0xf6], bl
jne 0xb50fc7
call fcn.00b51381
test al, al
je 0xb50fc7
push ebx
push 2
push ebx
push ebx
push ebx
call dword [sym.imp.dwmapi.dll_Ordinal_113]
push ebx
push ebx
mov ecx, edi
call fcn.00b510f0
push dword [0xd0a20c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetForegroundWindow]
cmp byte [edi + 0xf5], bl
jne 0xb51036
cmp byte [edi + 0xf4], bl
jne 0xb51036
or dword [edi + 0x160], 0xffffffff
lea ecx, [ebp - 0xcc]
push ebx
call fcn.00b80b25
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0xb13b98
call fcn.00b80a8a
lea ecx, [ebp - 0x14]
call fcn.00b84d89
lea ecx, [ebp - 0x20]
call fcn.00b845a1
lea ecx, [ebp - 0x88]
call fcn.00b8458c
cmp dword [ebp - 0xb0], 1
je 0xbf6e5a
cmp dword [ebp - 0xbc], 0
mov dword [ebp - 0xb0], 3
jne 0xbf6e81
call fcn.00bc12da
ret 8
push ecx
push 1
mov ecx, edi
call fcn.00c36ef9
jmp 0xb50fc7
call fcn.00b51381
test al, al
je 0xb50fc7
mov eax, dword [edi + 0x1e0]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xf8]
jmp 0xbf6ae8
mov eax, dword [edi + 0x1e0]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x100]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb50fc7
mov eax, dword [edi + 0x1e0]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xfc]
jmp 0xbf6ae8
call fcn.00b51381
test al, al
je 0xb50fc7
mov ecx, edi
call fcn.00c38066
jmp 0xb50fc7
cmp byte [edi + 0xf6], bl
jne 0xb50fc7
call fcn.00b51381
test al, al
je 0xb50fc7
push ebx
push 2
push ebx
push ebx
push ebx
call dword [sym.imp.dwmapi.dll_Ordinal_113]
push ebx
push ebx
mov ecx, edi
call fcn.00c37f84
jmp 0xb50fc7
push ebx
push ebx
push ebx
push 0x1f7
jmp 0xbf6b66
push ebx
push ebx
push ebx
push 0xa086
lea eax, [edi + 0x1c]
push eax
call fcn.00b8f560
jmp 0xb50fc7
cmp byte [edi + 0xf6], bl
jne 0xb50fc7
call fcn.00b51381
test al, al
je 0xb50fc7
push ebx
push 2
push ebx
push ebx
push ebx
call dword [sym.imp.dwmapi.dll_Ordinal_113]
mov eax, dword [0xd0aff8]
mov ecx, edi
neg eax
sbb eax, eax
add eax, 3
push eax
call fcn.00b5af3e
jmp 0xb50fc7
call fcn.00b51381
test al, al
je 0xb50fc7
jmp 0xbf6ada
call fcn.00b51381
test al, al
je 0xb50fc7
mov ecx, dword [edi + 4]
mov edx, 0xb47228
call fcn.00c72071
test eax, eax
jne 0xb50fc7
push ecx
mov ecx, dword [edi + 4]
call fcn.00c37a48
jmp 0xb50fc7
push 0x1f
jmp 0xbf6bfa
push 0x21
mov ecx, edi
call fcn.00c374d2
jmp 0xb50fc7
mov eax, dword [ebp + 4]
mov dword [ebp - 0xec], eax
mov eax, 0x15c5
push ecx
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xe8], 0xb2b1d4
mov dword [ebp - 0xe4], ebx
mov word [ebp - 0xe0], ax
call fcn.00b91352
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xdc], 0xb177e4
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xd8], eax
mov dword [ebp - fcn.00b7a690], 0xb12edc
call fcn.00bb7f51
lea eax, [ebp - 0xec]
mov dword [ebp - 0xf0], 0x7bf71f
mov dword [ebp - 0xf4], eax
lea edx, [ebp - 0x104]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdc]
call fcn.00b7a5f3
mov ecx, dword [ebp - 0x100]
test ecx, ecx
je 0xb50fc7
mov eax, dword [ebp - 0xf8]
mov dword [ecx + 0xc], eax
jmp 0xb50fc7
push ecx
lea edx, [ebp - 0xcd]
mov byte [ebp - 0xcd], bl
call fcn.00bbf443
test eax, eax
js 0xb50fc7
cmp byte [ebp - 0xcd], bl
je 0xb50fc7
jmp 0xbf6bf8
call fcn.00b51381
test al, al
je 0xb50fc7
push 0x80
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0xb50fc7
jmp 0xbf6b5e
call fcn.00b51381
test al, al
je 0xb50fc7
mov eax, dword [edi + 0x1e0]
push esi
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x104]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb50fc7
push ecx
call fcn.00c34f06
jmp 0xb50fc7
call fcn.00b51381
test al, al
je 0xb50fc7
xor eax, eax
xor ecx, ecx
mov edx, 0xd08e20
inc eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0xb50fc7
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetForegroundWindow]
push eax
push 1
mov ecx, edi
call fcn.00c38521
jmp 0xb50fc7
mov ecx, edi
call fcn.00c37dda
jmp 0xb50fc7
push 9
jmp 0xbf6d7a
push 0xa
mov ecx, edi
call fcn.00c37217
jmp 0xb50fc7
call fcn.00b51381
test al, al
je 0xb50fc7
push 0x38
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x140], 0x3c
push ebx
push eax
call fcn.00bc259b
mov eax, dword [edi + 4]
add esp, 0xc
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x13c], 0x100000
mov dword [ebp - 0x124], 1
push eax
mov dword [ebp - 0x130], 0xb2f858
mov dword [ebp - 0x134], 0xb2f6b8
mov dword [ebp - 0x12c], 0xb2f87c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0xb50fc7
push ecx
call fcn.00c347c6
jmp 0xb50fc7
push ecx
call fcn.00bbd6dd
mov ecx, edi
call fcn.00c36d64
jmp 0xb50fc7
call fcn.00b51381
test al, al
je 0xb50fc7
push ecx
call fcn.00bbd5e8
mov ecx, edi
call fcn.00c36ce0
jmp 0xb50fc7
mov eax, dword [edi + 0x1e0]
push dword [ebp + 0xc]
push esi
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x108]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb50fc7
push 0xc21420
mov dword [ebp - 0xb0], 2
call fcn.00b63419
lea edx, [ebp - 0xa8]
mov ecx, dword [eax + 4]
call fcn.00c22b6a
jmp 0xb51017
lea ecx, [ebp - 0xc8]
call fcn.00b54a44
jmp 0xb5102e