Function at 0x5154c0
Capabilities:
Accept command line arguments
Access peb ldr_data
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create process suspended
Delete file
Get process heap flags
Read .ini file
Set current directory

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0xacc]
push ebx
mov edi, edx
sub esp, 0xb1c
mov dword [ebp - 0xad0], 0x44
rep stosd dword es:[edi], eax
mov eax, 0x22
mov edi, 1
mov dword [ebp - 0xaa4], 1
mov word [ebp - 0x83d], ax
mov eax, 0x3aa
mov word [ebp - 0xaa0], di
lea edi, [ebp - 0x855]
mov dword [ebp - 0x855], 0x5c3a7422
mov dword [ebp - 0x851], 0x41746f4e
mov dword [ebp - 0x84d], 0x5c726944
mov dword [ebp - 0x849], 0x41746f4e
mov dword [ebp - 0x845], 0x656c6946
mov dword [ebp - 0x841], 0x6578652e
mov dword [ebp - 0xae0], 0xa0a0a0a
mov dword [ebp - 0xadc], 0xa0a0a0a
mov dword [ebp - 0xad8], 0xa0a0a0a
mov dword [ebp - 0xad4], 0xa0a0a0a
call fcn.0050dc60
mov ebx, dword [sym.imp.kernel32.dll_CreateProcessA]
mov dword [esp], edi
lea eax, [ebp - 0xae0]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [ebp - 0xae8], ebx
call ebx
sub esp, 0x28
test eax, eax
sete al
mov dword [esp + 4], str.CreateProcess_unexpectedly_succeeded_n
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3ac
call fcn.0050dc60
mov eax, dword [ebp - 0xad0]
mov dword [esp + 4], str.unexpected_cb__ld_n
cmp eax, 0x44
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3ad
call fcn.0050dc60
mov dword [esp + 4], str.lpDesktop_is_not_NULL_n
xor eax, eax
mov edx, dword [ebp - 0xac8]
test edx, edx
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3ae
call fcn.0050dc60
mov dword [esp + 4], str.lpTitle_is_not_NULL_n
xor eax, eax
mov ecx, dword [ebp - 0xac4]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3af
call fcn.0050dc60
mov eax, dword [ebp - 0xaa4]
mov dword [esp + 4], str.unexpected_dwFlags__04lx_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3b0
call fcn.0050dc60
movzx edx, word [ebp - 0xaa0]
xor eax, eax
mov dword [esp + 4], str.unexpected_wShowWindow__d_n
cmp dx, 1
mov dword [esp + 8], edx
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3b1
call fcn.0050dc60
mov eax, dword [ebp - 0xae0]
mov dword [esp + 4], str.unexpected_hProcess__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3b2
call fcn.0050dc60
mov eax, dword [ebp - 0xadc]
mov dword [esp + 4], str.unexpected_hThread__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3b3
call fcn.0050dc60
mov eax, dword [ebp - 0xad8]
mov dword [esp + 4], str.unexpected_dwProcessId__04lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3b4
call fcn.0050dc60
mov eax, dword [ebp - 0xad4]
mov dword [esp + 4], str.unexpected_dwThreadId__04lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x84fdc0
call fcn.0050d8f0
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s___C:Program_Filesmy_nice_app.exe_
mov dword [esp], edi
call fcn.0050d7a0
mov eax, 0x3b9
call fcn.0050dc60
lea eax, [ebp - 0xae0]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
call ebx
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
mov eax, 0x3bb
call fcn.0050dc60
mov eax, dword [ebp - 0xad0]
mov dword [esp + 4], str.unexpected_cb__ld_n
cmp eax, 0x44
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3bc
call fcn.0050dc60
mov dword [esp + 4], str.lpDesktop_is_not_NULL_n
xor eax, eax
mov esi, dword [ebp - 0xac8]
test esi, esi
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3bd
call fcn.0050dc60
mov dword [esp + 4], str.lpTitle_is_not_NULL_n
xor eax, eax
mov edx, dword [ebp - 0xac4]
test edx, edx
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3be
call fcn.0050dc60
mov eax, dword [ebp - 0xaa4]
mov dword [esp + 4], str.unexpected_dwFlags__04lx_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x3bf
call fcn.0050dc60
movzx edx, word [ebp - 0xaa0]
xor eax, eax
mov dword [esp + 4], str.unexpected_wShowWindow__d_n
cmp dx, 1
mov dword [esp + 8], edx
sete al
mov dword [esp], eax
call fcn.0050e8b0
lea eax, [ebp - 0xae0]
call fcn.0050e290
mov esi, dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0xaec], esi
call esi
mov ecx, str.argcA
mov edx, str.Arguments
mov eax, 0x3c3
sub esp, 0x10
mov dword [esp], 5
call fcn.005104e0
mov ecx, str.argvA4
mov edx, str.Arguments
mov dword [esp + 4], 1
mov dword [esp], str.C:Program_Filesmy_nice_app.exe
mov eax, 0x3c4
call fcn.00510420
mov ecx, str.argvA5
mov edx, str.Arguments
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, 0x3c5
call fcn.00510420
mov dword [esp], edi
mov ecx, str.CommandLineA
mov edx, str.Arguments
mov dword [esp + 4], 1
mov eax, 0x3c6
call fcn.00510420
mov eax, dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov dword [ebp - 0xaf4], eax
call eax
mov eax, 0x84fdc0
sub esp, 4
call fcn.0050d8f0
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0x84fee0
mov dword [esp + 4], str.__s__process_dump___s___a_b__c__d
mov dword [esp], edi
call fcn.0050d7a0
mov eax, 0x3cd
call fcn.0050dc60
lea edx, [ebp - 0xae0]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
lea edx, [ebp - 0xad0]
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
call ebx
sub esp, 0x28
mov dword [esp], eax
mov dword [esp + 4], 0x5ef99c
call fcn.0050e8b0
lea edx, [ebp - 0xae0]
mov eax, edx
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
mov ecx, str.argcA
mov edx, str.Arguments
mov eax, 0x3d1
sub esp, 0x10
mov dword [esp], 7
call fcn.005104e0
mov ecx, str.argvA4
mov edx, str.Arguments
mov dword [esp + 4], 1
mov dword [esp], str.a_b_
mov eax, 0x3d2
call fcn.00510420
mov ecx, str.argvA5
mov edx, str.Arguments
mov dword [esp + 4], 1
mov dword [esp], 0x5f09d3
mov eax, 0x3d3
call fcn.00510420
mov ecx, str.argvA6
mov edx, str.Arguments
mov dword [esp + 4], 1
mov dword [esp], 0x5f09dd
mov eax, 0x3d4
call fcn.00510420
mov ecx, str.argvA7
mov edx, str.Arguments
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, 0x3d5
call fcn.00510420
mov dword [esp], edi
mov ecx, str.CommandLineA
mov edx, str.Arguments
mov dword [esp + 4], 1
mov eax, 0x3d6
call fcn.00510420
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov eax, dword [ebp - 0xaf4]
call eax
lea eax, [ebp - 0xae4]
sub esp, 4
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xa89]
mov dword [esp + 8], eax
mov eax, dword [sym.imp.kernel32.dll_GetFullPathNameA]
mov dword [esp + 4], 0x104
mov dword [esp], 0x84fee0
mov dword [ebp - 0xaf0], eax
call eax
mov eax, dword [ebp - 0xae4]
sub esp, 0x10
test eax, eax
je 0x516e50
mov byte [eax - 1], 0
lea eax, [ebp - 0xa89]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov ebx, dword fs:[0x18]
mov dword [ebp - 0xafc], eax
call eax
mov eax, 0x84fdc0
sub esp, 4
call fcn.0050d8f0
mov dword [esp + 0xc], 0x84fdc0
mov eax, dword [0x84fec4]
mov dword [esp + 4], str..__s_process_dump___s______
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.0050d7a0
lea eax, [ebp - 0xae0]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov esi, eax
mov eax, 0x3e7
call fcn.0050dc60
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
lea esi, [ebp - 0xae0]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.CreateProcess___s__failed_:__ld_n
call fcn.0050e8b0
lea edx, [ebp - 0xae0]
mov eax, edx
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0xaec]
call edx
mov eax, dword [0x84fec4]
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 4], str..__s
mov dword [esp], edi
call fcn.0050d7a0
mov ecx, str.argcA
mov edx, str.Arguments
mov dword [esp], 5
mov eax, 0x3ec
call fcn.005104e0
mov dword [esp], edi
mov ecx, str.argvA0
mov edx, str.Arguments
mov dword [esp + 4], 1
mov eax, 0x3ed
call fcn.00510420
mov ecx, str.argvA4
mov edx, str.Arguments
mov dword [esp + 4], 1
mov dword [esp], 0x5f0a41
mov eax, 0x3ee
call fcn.00510420
mov edx, str.Arguments
mov ecx, str.argvA5
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, 0x3ef
call fcn.00510420
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov ecx, dword [ebp - 0xaf4]
call ecx
mov eax, 0x84fdc0
sub esp, 4
call fcn.0050d8f0
mov dword [esp + 0xc], 0x84fdc0
mov eax, dword [0x84fec4]
mov dword [esp + 4], str.._s_process_dump___s_
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.0050d7a0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], esi
lea esi, [ebp - 0xad0]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov esi, eax
mov eax, 0x3f8
call fcn.0050dc60
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
lea esi, [ebp - 0xae0]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.CreateProcess___s__failed_:__ld_n
call fcn.0050e8b0
mov eax, esi
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0xaec]
call edx
mov eax, dword [0x84fec4]
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 4], str.._s
mov dword [esp], edi
call fcn.0050d7a0
mov dword [esp], edi
mov edx, str.Arguments
mov ecx, str.argvA0
mov dword [esp + 4], 1
mov eax, 0x3fd
call fcn.00510420
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov ecx, dword [ebp - 0xaf4]
call ecx
mov eax, 0x84fdc0
sub esp, 4
call fcn.0050d8f0
lea ecx, [ebp - 0xa89]
mov dword [esp + 4], 0x5c
mov esi, dword [sym.imp.msvcrt.dll_strrchr]
mov dword [esp], ecx
call esi
mov edx, eax
test eax, eax
je 0x516d10
mov dword [esp + 0x10], 0x84fdc0
mov eax, dword [0x84fec4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [ebp - 0xb00], edx
mov dword [esp + 4], str..._s__s_process_dump___s_
mov dword [esp], edi
call fcn.0050d7a0
lea ecx, [ebp - 0xae0]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], ecx
lea ecx, [ebp - 0xad0]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov dword [ebp - 0xaf8], eax
mov eax, 0x408
call fcn.0050dc60
mov eax, dword [ebx + 0x34]
mov dword [esp + 8], edi
mov dword [esp + 4], str.CreateProcess___s__failed_:__ld_n
mov dword [esp + 0xc], eax
mov ecx, dword [ebp - 0xaf8]
mov dword [esp], ecx
call fcn.0050e8b0
lea eax, [ebp - 0xae0]
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0xaec]
call edx
mov eax, dword [0x84fec4]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0xb00]
mov dword [esp + 4], str..._s__s
mov dword [esp + 8], edx
mov dword [esp], edi
call fcn.0050d7a0
mov dword [esp], edi
mov ecx, str.argvA0
mov edx, str.Arguments
mov eax, 0x40e
mov dword [esp + 4], 1
call fcn.00510420
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
mov eax, dword [ebp - 0xaf4]
call eax
mov eax, 0x84fdc0
sub esp, 4
call fcn.0050d8f0
lea eax, [ebp - 0xae4]
mov dword [esp + 4], 0x104
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xa89]
mov dword [esp + 8], eax
mov dword [esp], 0x84fee0
mov eax, dword [ebp - 0xaf0]
call eax
mov eax, dword [ebp - 0xae4]
sub esp, 0x10
test eax, eax
je 0x516e33
mov byte [eax - 1], 0
lea eax, [ebp - 0xa89]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call esi
mov edx, dword [0x84fec4]
test eax, eax
je 0x516cf0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str..._s__s
mov dword [esp], edi
call fcn.0050d7a0
lea eax, [ebp - 0x985]
mov dword [esp + 8], 0x84fdc0
mov dword [esp + 4], str.dummy_process_dump___s_
mov dword [esp], eax
mov esi, dword fs:[0x18]
call fcn.0050d7a0
lea eax, [ebp - 0xae0]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x985]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edi
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov ebx, eax
mov eax, 0x41e
call fcn.0050dc60
mov eax, dword [esi + 0x34]
mov dword [esp + 8], edi
mov dword [esp + 4], str.CreateProcess___s__failed_:__ld_n
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0050e8b0
lea eax, [ebp - 0xae0]
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0xaec]
call eax
mov ecx, str.argvA0
mov edx, str.Arguments
mov eax, 0x422
sub esp, 0x10
mov dword [esp + 4], 1
mov dword [esp], str.dummy
call fcn.00510420
lea eax, [ebp - 0x985]
mov ecx, str.CommandLineA
mov dword [esp + 4], 1
mov dword [esp], eax
mov edx, str.Arguments
mov eax, 0x423
call fcn.00510420
lea eax, [ebp - 0x60c]
mov dword [esp + 0x14], 0x84fdc0
mov dword [esp + 0x10], 0x600
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x5eeef7
mov dword [esp + 4], str.CommandLineW
mov dword [esp], str.Arguments
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
movzx eax, byte [ebp - 0x60c]
sub esp, 0x18
test al, al
je 0x516ce0
cmp al, 0x2d
je 0x516cd0
lea eax, [ebp - 0x60c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strlen]
test al, 1
jne 0x516e6d
cmp eax, 3
jbe 0x516ce0
shr eax, 2
mov edx, dword [0x57f4a4]
lea ecx, [eax - 1]
lea eax, [eax + eax + 2]
and eax, 0xfffffffc
mov dword [ebp - 0xaf8], ecx
add eax, edx
mov dword [ebp - 0xaec], edx
mov dword [0x57f4a4], eax
cmp eax, 0x84fda0
ja 0x516e8a
xor edx, edx
test ecx, ecx
jne 0x516c0c
lea esi, [esi]
lea esi, [esi]
mov eax, dword [ebp - 0xaec]
mov ebx, dword [ebp - 0xaf8]
xor esi, esi
mov word [eax + ebx*2], si
mov ecx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x985]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0xaf8], ecx
call ecx
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0x18
mov edx, eax
lea eax, [eax + eax]
mov ebx, dword fs:[0x18]
mov dword [ebp - 0xaf0], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0xaf0]
sub esp, 0xc
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x985]
mov dword [ebp - 0xaf0], eax
mov dword [esp + 8], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp - 0xaf8]
call ecx
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov edx, dword [ebp - 0xaec]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], 0
mov dword [ebp - 0xb00], ecx
call ecx
sub esp, 0x20
mov dword [esp + 8], eax
mov dword [ebp - 0xaf8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [ebp - 0xaf8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0xffffffff
mov edx, dword [ebp - 0xaec]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], 0
mov ecx, dword [ebp - 0xb00]
call ecx
sub esp, 0x20
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x424
mov eax, dword [ebp - 0xaf0]
mov dword [esp + 4], eax
mov edx, dword [ebp - 0xaec]
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
lea edx, [ebp - 0x985]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0x14], esi
movzx eax, al
mov dword [esp + 0x10], edx
mov dword [esp], eax
mov dword [esp + 0xc], str.CommandLineW
mov dword [esp + 8], str.Arguments
mov dword [esp + 4], str._s:_s_expected__s__got__s_n
call fcn.0050e8b0
mov eax, dword [ebp - 0xaf0]
mov dword [esp + 4], 0
mov edx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov dword [ebp - 0xaec], edx
call edx
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov edx, dword [ebp - 0xaec]
call edx
mov dword [0x57f4a4], 0x80fda0
sub esp, 0xc
mov dword [esp], 0x84fdc0
mov eax, dword [ebp - 0xaf4]
call eax
sub esp, 4
mov dword [esp], 0x850000
mov eax, dword [ebp - 0xafc]
call eax
lea eax, [ebp - 0xae0]
mov byte [ebp - 0x855], 0
sub esp, 4
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov esi, eax
mov eax, 0x438
call fcn.0050dc60
xor eax, eax
test esi, esi
mov dword [esp + 4], str.CreateProcessA_unexpectedly_succeeded_n
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x439
call fcn.0050dc60
mov edx, dword [ebx + 0x34]
mov eax, 1
cmp edx, 3
je 0x5165a4
mov ebx, dword [0x8f0770]
xor eax, eax
test ebx, ebx
je 0x516cb0
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_ERROR_PATH_NOT_FOUND__got__ld_n
mov ebx, dword fs:[0x18]
call fcn.0050e8b0
lea eax, [ebp - 0xae0]
mov byte [ebp - 0x985], 0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x985]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edi
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov esi, eax
mov eax, 0x443
call fcn.0050dc60
xor eax, eax
test esi, esi
mov dword [esp + 4], str.CreateProcessA_unexpectedly_succeeded_n
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x444
call fcn.0050dc60
mov edx, dword [ebx + 0x34]
mov eax, 1
cmp edx, 3
je 0x516673
mov ecx, dword [0x8f0770]
xor eax, eax
test ecx, ecx
je 0x516c90
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_ERROR_PATH_NOT_FOUND__got__ld_n
mov ebx, dword fs:[0x18]
call fcn.0050e8b0
lea eax, [ebp - 0xae0]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x985]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov esi, eax
mov eax, 0x44c
call fcn.0050dc60
xor eax, eax
test esi, esi
mov dword [esp + 4], str.CreateProcessA_unexpectedly_succeeded_n
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x44d
call fcn.0050dc60
mov edx, dword [ebx + 0x34]
mov eax, 1
cmp edx, 2
je 0x516744
cmp edx, 3
je 0x516744
cmp edx, 0xa1
je 0x516744
xor eax, eax
cmp edx, 0x57
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], 0x5f0b14
mov ebx, dword fs:[0x18]
call fcn.0050e8b0
lea eax, [ebp - 0xae0]
mov dword [ebp - 0x979], 0x652e7473
mov dword [ebp - 0x855], 0x73656f64
mov dword [ebp - 0x851], 0x65746f6e
mov dword [ebp - 0x84d], 0x74736978
mov dword [ebp - 0x849], 0x6578652e
mov byte [ebp - 0x845], 0
mov dword [ebp - 0x985], 0x73656f64
mov dword [ebp - 0x981], 0x746f6e20
mov dword [ebp - 0x97d], 0x69786520
mov dword [ebp - 0x976], 0x657865
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov esi, eax
mov eax, 0x459
call fcn.0050dc60
xor eax, eax
test esi, esi
mov dword [esp + 4], str.CreateProcessA_unexpectedly_succeeded_n
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x45a
call fcn.0050dc60
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5f0b14
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 2
sete al
mov dword [esp], eax
call fcn.0050e8b0
lea edx, [ebp - 0xae0]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], edx
lea edx, [ebp - 0xad0]
mov dword [esp + 0x20], edx
lea edx, [ebp - 0x985]
mov dword [esp], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov esi, eax
mov eax, 0x45e
call fcn.0050dc60
xor eax, eax
test esi, esi
mov dword [esp + 4], str.CreateProcessA_unexpectedly_succeeded_n
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x45f
call fcn.0050dc60
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5f0b14
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 2
sete al
mov dword [esp], eax
call fcn.0050e8b0
lea edx, [ebp - 0xae0]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], edx
lea edx, [ebp - 0xad0]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
mov edi, dword [ebp - 0xae8]
call edi
sub esp, 0x28
mov esi, eax
mov eax, 0x464
call fcn.0050dc60
xor eax, eax
test esi, esi
mov dword [esp + 4], str.CreateProcessA_unexpectedly_succeeded_n
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x465
call fcn.0050dc60
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5f0b14
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 2
sete al
mov dword [esp], eax
call fcn.0050e8b0
lea eax, [ebp - 0xae0]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x985]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call edi
sub esp, 0x28
mov esi, eax
mov eax, 0x469
call fcn.0050dc60
xor eax, eax
test esi, esi
mov dword [esp + 4], str.CreateProcessA_unexpectedly_succeeded_n
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0x46a
call fcn.0050dc60
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5f0b14
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 2
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov edi, dword [sym.imp.kernel32.dll_GetCommandLineW]
call edi
mov esi, eax
mov eax, 0x46e
call fcn.0050dc60
mov dword [esp + 8], esi
mov dword [esp + 4], str.Expected_address_from_TEB__got__p_n
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x44], esi
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x10]
mov dword [eax + 0x44], 0
call edi
mov edi, eax
mov eax, 0x473
call fcn.0050dc60
xor eax, eax
cmp esi, edi
mov dword [esp + 8], edi
sete al
mov dword [esp + 4], str.Expected_cached_address_from_TEB__got__p_n
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x10]
mov dword [eax + 0x44], esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [ecx - 0x61]
mov ebx, esi
cmp bl, 5
jbe 0x516c58
sub eax, 0x41
cmp al, 5
ja 0x516e16
sub ecx, 0x37
mov eax, ecx
shl eax, 0xc
mov word [ebp - 0xaf0], ax
movsx eax, byte [ebp + edx*4 - 0x60b]
lea esi, [eax - 0x30]
mov ecx, eax
mov ebx, esi
cmp bl, 9
jbe 0x516c40
lea esi, [eax - 0x61]
mov ebx, esi
cmp bl, 5
jbe 0x516c60
sub ecx, 0x41
cmp cl, 5
ja 0x516e16
sub eax, 0x37
shl eax, 8
or ax, word [ebp - 0xaf0]
mov word [ebp - 0xaf0], ax
movsx eax, byte [ebp + edx*4 - 0x60a]
lea esi, [eax - 0x30]
mov ecx, eax
mov ebx, esi
cmp bl, 9
jbe 0x516c30
lea esi, [eax - 0x61]
mov ebx, esi
cmp bl, 5
jbe 0x516c70
sub ecx, 0x41
cmp cl, 5
ja 0x516e16
sub eax, 0x37
movsx ecx, byte [ebp + edx*4 - 0x609]
shl eax, 4
or ax, word [ebp - 0xaf0]
mov word [ebp - 0xaf0], ax
lea esi, [ecx - 0x30]
mov eax, ecx
mov ebx, esi
cmp bl, 9
jbe 0x516c50
lea esi, [ecx - 0x61]
mov ebx, esi
cmp bl, 5
jbe 0x516c80
sub eax, 0x41
cmp al, 5
ja 0x516e16
sub ecx, 0x37
movzx eax, word [ebp - 0xaf0]
mov esi, dword [ebp - 0xaec]
or eax, ecx
mov word [esi + edx*2], ax
mov eax, dword [ebp - 0xaf8]
add edx, 1
cmp edx, eax
je 0x516290
movsx ecx, byte [ebp + edx*4 - 0x60c]
lea esi, [ecx - 0x30]
mov eax, ecx
mov ebx, esi
cmp bl, 9
ja 0x516b00
sub ecx, 0x30
jmp 0x516b1c
sub eax, 0x30
jmp 0x516ba3
sub eax, 0x30
jmp 0x516b5d
sub ecx, 0x30
jmp 0x516be8
sub ecx, 0x57
jmp 0x516b1c
sub eax, 0x57
jmp 0x516b5d
sub eax, 0x57
jmp 0x516ba3
sub ecx, 0x57
jmp 0x516be8
mov eax, 1
cmp edx, 2
je 0x516673
xor eax, eax
cmp edx, 5
sete al
jmp 0x516673
mov eax, 1
cmp edx, 2
je 0x5165a4
xor eax, eax
cmp edx, 5
sete al
jmp 0x5165a4
cmp byte [ebp - 0x60b], 0
jne 0x51622b
lea esi, [esi]
mov dword [ebp - 0xaec], 0
jmp 0x5162a2
mov dword [esp + 8], edx
mov dword [esp + 4], str..__s
mov dword [esp], edi
call fcn.0050d7a0
jmp 0x5160ae
mov dword [esp + 0xc], 0x84fdc0
mov eax, dword [0x84fec4]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str..__s_process_dump___s_
call fcn.0050d7a0
lea eax, [ebp - 0xae0]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xad0]
mov dword [esp + 4], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [ebp - 0xae8]
call eax
sub esp, 0x28
mov dword [ebp - 0xaf8], eax
mov eax, 0x408
call fcn.0050dc60
mov eax, dword [ebx + 0x34]
mov dword [esp + 8], edi
mov dword [esp + 4], str.CreateProcess___s__failed_:__ld_n
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0xaf8]
mov dword [esp], edx
call fcn.0050e8b0
lea eax, [ebp - 0xae0]
call fcn.0050e290
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0xaec]
call eax
mov eax, dword [0x84fec4]
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 4], str..__s
mov dword [esp], edi
call fcn.0050d7a0
jmp 0x515ff0
mov dword [esp + 8], 0xac
mov dword [esp + 4], str..._dlls_kernel32_tests_process.c
mov dword [esp], str.c___A__c___F
call dword [sym.imp.msvcrt.dll__assert]
mov dword [esp + 8], 0x415
mov dword [esp + 4], str..._dlls_kernel32_tests_process.c
mov dword [esp], str.lpFilePart___0
call dword [sym.imp.msvcrt.dll__assert]
mov dword [esp + 8], 0x3db
mov dword [esp + 4], str..._dlls_kernel32_tests_process.c
mov dword [esp], str.lpFilePart___0
call dword [sym.imp.msvcrt.dll__assert]
mov dword [esp + 8], 0x256
mov dword [esp + 4], str..._dlls_kernel32_tests_process.c
mov dword [esp], str.__strlen_buf___1_
call dword [sym.imp.msvcrt.dll__assert]
call fcn.0050db40
nop