Function at 0x51b398
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x51b3a0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x51b893
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x54c730]
mov eax, dword [eax]
cmp dword [eax + 8], 0
jle 0x51b818
mov eax, dword [0x54cee4]
mov eax, dword [eax]
call fcn.0040afbc
mov eax, dword [0x54c730]
mov eax, dword [eax]
cmp dword [eax + 8], 0x64
jge 0x51b3fb
mov eax, dword [0x54c730]
mov eax, dword [eax]
mov dl, 0x64
sub dl, byte [eax + 8]
mov cl, 1
mov eax, esi
call fcn.00519814
jmp 0x51b406
mov cl, 1
xor edx, edx
mov eax, esi
call fcn.00519814
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00519814
mov eax, dword [0x54c730]
mov eax, dword [eax]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x51b82e
inc eax
mov dword [ebp - 0x18], eax
xor edi, edi
mov eax, dword [0x54c730]
mov eax, dword [eax]
mov edx, edi
call fcn.0041c19c
mov ebx, eax
mov byte [ebp - 0x11], 0
movzx eax, byte [ebx + 0x25b]
dec al
je 0x51b452
sub al, 2
je 0x51b49a
jmp 0x51b74a
lea edx, [ebx + 0x3d]
lea eax, [ebp - 0xac]
call fcn.004036b8
lea edx, [ebx + 0xa2]
lea eax, [ebp - 0xac]
mov cl, 0x8c
call fcn.00403688
lea edx, [ebp - 0xac]
lea eax, [ebp - 0x1c]
call fcn.004050fc
mov eax, dword [ebp - 0x1c]
call fcn.0040a868
test al, al
jne 0x51b74a
mov byte [ebp - 0x11], 1
jmp 0x51b74a
lea eax, [ebp - 0xb0]
lea edx, [ebx + 0xa2]
call fcn.004050fc
mov eax, dword [ebp - 0xb0]
mov edx, 0x51b8ac
call fcn.00409afc
test eax, eax
jne 0x51b4d4
lea eax, [ebp - 4]
mov edx, dword [0x54ce24]
mov edx, dword [edx]
call fcn.00404f30
jmp 0x51b5d1
lea eax, [ebp - 0xb8]
lea edx, [ebx + 0xa2]
call fcn.004050fc
mov eax, dword [ebp - 0xb8]
lea ecx, [ebp - 0xb4]
mov edx, 5
call fcn.0043e820
mov eax, dword [ebp - 0xb4]
mov edx, 0x51b8bc
call fcn.004052c0
jne 0x51b5a2
lea eax, [ebp - 0xc0]
lea edx, [ebx + 0xa2]
call fcn.004050fc
mov eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0xbc]
movzx edx, byte [ebx + 0xa2]
sub edx, 5
call fcn.0043e83c
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x54cc1c]
call fcn.00404eec
lea eax, [ebp - 0xc4]
lea edx, [ebx + 0x3d]
call fcn.004050fc
mov edx, dword [ebp - 0xc4]
mov ecx, dword [0x54cc1c]
mov ecx, dword [ecx]
lea eax, [ebp - 4]
call fcn.004051b0
mov eax, dword [0x54cc1c]
mov eax, dword [eax]
call fcn.00518798
test al, al
jne 0x51b5d1
push 6
push 0
push 0
mov eax, dword [0x54cc1c]
mov eax, dword [eax]
call fcn.00405328
push eax
push 0x51b8c4
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x51b5d1
lea edx, [ebx + 0x3d]
lea eax, [ebp - 0xac]
call fcn.004036b8
lea edx, [ebx + 0xa2]
lea eax, [ebp - 0xac]
mov cl, 0x8c
call fcn.00403688
lea edx, [ebp - 0xac]
lea eax, [ebp - 4]
call fcn.004050fc
mov edx, 0x51b8cc
lea eax, [ebp - 0x110]
call fcn.004036b8
mov edx, ebx
lea eax, [ebp - 0x110]
mov cl, 0x45
call fcn.00403688
lea edx, [ebp - 0x110]
lea eax, [ebp - 0xc8]
call fcn.004050fc
mov edx, dword [ebp - 0xc8]
mov eax, esi
call fcn.0051ab8c
lea eax, [ebp - 8]
lea edx, [ebx + 0x13a]
call fcn.004050fc
mov byte [ebp - 0x11], 1
push esi
push 0x51ab50
lea ecx, [ebp - 0x120]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00481b24
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x10]
call fcn.00481a7c
push 0
lea eax, [ebp - 0x124]
push eax
mov byte [ebp - 0x128], 0x3b
lea ecx, [ebp - 0x128]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004ad224
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 8]
call fcn.00404f30
cmp dword [ebp - 0xc], 0
je 0x51b74a
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00409afc
test eax, eax
jne 0x51b644
lea eax, [ebp - 0x12c]
lea edx, [ebx + 0xa2]
call fcn.004050fc
mov edx, dword [ebp - 0x12c]
mov eax, 0x51b8e0
call fcn.00405474
test eax, eax
jg 0x51b6d6
lea eax, [ebp - 0x130]
lea edx, [ebx + 0xa2]
call fcn.004050fc
mov edx, dword [ebp - 0x130]
mov eax, 0x51b8f0
call fcn.00405474
test eax, eax
jle 0x51b746
lea edx, [ebx + 0x3d]
lea eax, [ebp - 0xac]
call fcn.004036b8
lea edx, [ebx + 0xa2]
lea eax, [ebp - 0xac]
mov cl, 0x8c
call fcn.00403688
lea edx, [ebp - 0xac]
mov eax, dword [0x54cc1c]
call fcn.004050fc
lea eax, [ebp - 0x134]
lea edx, [ebx + 0xa2]
call fcn.004050fc
mov eax, dword [ebp - 0x134]
call fcn.00518798
test al, al
jne 0x51b746
push 6
push 0
push 0
mov eax, dword [0x54cc1c]
mov eax, dword [eax]
call fcn.00405328
push eax
push 0x51b8c4
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x51b7a9
mov edx, 0x51b8f8
lea eax, [ebp - 0x110]
call fcn.004036b8
mov edx, ebx
lea eax, [ebp - 0x110]
mov cl, 0x45
call fcn.00403688
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x138]
call fcn.004050fc
mov edx, dword [ebp - 0x138]
mov eax, esi
call fcn.0051ab8c
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00519814
mov edx, ebx
mov eax, esi
call fcn.0051ae24
test al, al
je 0x51b845
mov eax, dword [0x54c730]
mov eax, dword [eax]
mov ebx, dword [eax + 8]
cmp ebx, 0x64
jge 0x51b7d4
mov eax, dword [0x54c730]
mov eax, dword [eax]
mov dl, 0x64
sub dl, byte [eax + 8]
mov eax, edi
add dl, al
inc edx
mov cl, 1
mov eax, esi
call fcn.00519814
jmp 0x51b80c
lea eax, [edi + 1]
mov dword [ebp - 0x13c], eax
fild dword [ebp - 0x13c]
mov eax, dword [0x54c730]
mov dword [ebp - 0x140], ebx
fild dword [ebp - 0x140]
fdivp st(1)
fmul dword [0x51b904]
call fcn.00403590
mov edx, eax
mov cl, 1
mov eax, esi
call fcn.00519814
inc edi
dec dword [ebp - 0x18]
jne 0x51b42a
jmp 0x51b82e
mov cl, 1
mov dl, 0x64
mov eax, esi
call fcn.00519814
xor ecx, ecx
mov dl, 0x64
mov eax, esi
call fcn.00519814
xor ecx, ecx
mov dl, 0x64
mov eax, esi
call fcn.00519814
mov edx, 0x51b910
mov eax, esi
call fcn.0051ab8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b89a
lea eax, [ebp - 0x138]
mov edx, 4
call fcn.00404ebc
lea eax, [ebp - 0x124]
call fcn.00404e98
lea eax, [ebp - 0xc8]
mov edx, 7
call fcn.00404ebc
lea eax, [ebp - 0x1c]
call fcn.00404e98
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404ebc
ret