Function at 0x418e44
Capabilities:
Create process on windows

Disassembly:
push 0x190
mov eax, 0x48fb2b
call fcn.0047ae59
mov eax, dword [ebp + 8]
xor edi, edi
push eax
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x19c], edi
call fcn.00405b15
mov dword [ebp - 4], edi
cmp dword [ebp - 0x1c], edi
je 0x4191f4
xor ebx, ebx
inc ebx
cmp byte [0x4b659e], bl
je 0x4191f4
push str.RE5PS18TUtQUT9O
lea eax, [ebp - 0x80]
mov byte [0x4b659e], bl
call fcn.00401556
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], bl
call fcn.00404533
mov ecx, eax
lea eax, [ebp - 0x64]
call fcn.00404573
push ebx
lea esi, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.0040162a
push 0x49c198
lea esi, [ebp - 0x64]
call fcn.00401c1b
pop ecx
mov edi, 0x200
test al, al
je 0x418eee
push str.iexplore
lea eax, [ebp - 0x17c]
call fcn.00401556
mov byte [ebp - 4], 4
mov dword [ebp - 0x19c], ebx
jmp 0x419059
push 0x49c154
lea esi, [ebp - 0x64]
call fcn.00401c1b
pop ecx
test al, al
je 0x418f26
push str.firefox
lea eax, [ebp - 0x198]
call fcn.00401556
mov dword [ebp - 4], 5
mov dword [ebp - 0x19c], 2
jmp 0x41903f
push 0x49c1b4
lea esi, [ebp - 0x64]
call fcn.00401c1b
pop ecx
test al, al
je 0x418f5e
push str.chrome
lea eax, [ebp - 0x144]
call fcn.00401556
mov dword [ebp - 4], 6
mov dword [ebp - 0x19c], 4
jmp 0x419021
push 0x49e290
lea esi, [ebp - 0x64]
call fcn.00401c1b
pop ecx
test al, al
je 0x418f93
push str.opera
lea eax, [ebp - 0x10c]
call fcn.00401556
mov dword [ebp - 4], 7
mov dword [ebp - 0x19c], 8
jmp 0x419003
push 0x49e294
lea esi, [ebp - 0x64]
call fcn.00401c1b
pop ecx
test al, al
je 0x418fc8
push str.safari
lea eax, [ebp - 0xd4]
call fcn.00401556
mov dword [ebp - 4], 8
mov dword [ebp - 0x19c], 0x10
jmp 0x418fe8
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0xb8]
call fcn.00405b15
mov dword [ebp - 4], 9
mov dword [ebp - 0x19c], 0x20
mov ebx, eax
lea esi, [ebp - 0x128]
call fcn.00406bcb
mov dword [ebp - 4], 0xa
or dword [ebp - 0x19c], 0x40
mov ebx, eax
lea esi, [ebp - 0x9c]
call fcn.00406bcb
mov dword [ebp - 4], 0xb
or dword [ebp - 0x19c], 0x80
mov ebx, eax
lea esi, [ebp - 0xf0]
call fcn.00406bcb
mov dword [ebp - 4], 0xc
or dword [ebp - 0x19c], 0x100
mov ebx, eax
lea esi, [ebp - 0x160]
call fcn.00406bcb
mov dword [ebp - 4], 0xd
or dword [ebp - 0x19c], edi
mov ebx, eax
lea esi, [ebp - 0x48]
call fcn.00406bcb
mov dword [ebp - 4], 0xe
mov ebx, dword [ebp - 0x19c]
test edi, ebx
je 0x419089
push 1
xor edi, edi
lea esi, [ebp - 0x160]
and ebx, 0xfffffdff
call fcn.0040162a
test ebx, 0x100
je 0x4190a6
push 1
xor edi, edi
lea esi, [ebp - 0xf0]
and ebx, 0xfffffeff
call fcn.0040162a
test bl, bl
jns 0x4190bf
push 1
xor edi, edi
lea esi, [ebp - 0x9c]
and ebx, 0xffffff7f
call fcn.0040162a
test bl, 0x40
je 0x4190d6
push 1
xor edi, edi
lea esi, [ebp - 0x128]
and ebx, 0xffffffbf
call fcn.0040162a
test bl, 0x20
je 0x4190ed
push 1
xor edi, edi
lea esi, [ebp - 0xb8]
and ebx, 0xffffffdf
call fcn.0040162a
test bl, 0x10
je 0x419104
push 1
xor edi, edi
lea esi, [ebp - 0xd4]
and ebx, 0xffffffef
call fcn.0040162a
test bl, 8
je 0x41911b
push 1
xor edi, edi
lea esi, [ebp - 0x10c]
and ebx, 0xfffffff7
call fcn.0040162a
test bl, 4
je 0x419132
push 1
xor edi, edi
lea esi, [ebp - 0x144]
and ebx, 0xfffffffb
call fcn.0040162a
test bl, 2
je 0x419149
push 1
xor edi, edi
lea esi, [ebp - 0x198]
and ebx, 0xfffffffd
call fcn.0040162a
mov byte [ebp - 4], 0x18
test bl, 1
je 0x419161
push 1
xor edi, edi
lea esi, [ebp - 0x17c]
call fcn.0040162a
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x41916d
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x48]
call fcn.00401c5a
test eax, eax
jne 0x419196
mov esi, 0x49bf80
push esi
call fcn.0047519c
pop ecx
mov ecx, esi
lea esi, [ebp - 0x2c]
call fcn.00401827
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x4191a2
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x4191ae
lea eax, [ebp - 0x48]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
xor ebx, ebx
push ebx
push ecx
push eax
mov edi, 0x4986d4
push edi
push ebx
call esi
cmp eax, 2
jne 0x4191de
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4191d5
lea eax, [ebp - 0x2c]
push 1
push ebx
push ebx
push eax
push edi
push ebx
call esi
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040162a
push 1
lea esi, [ebp - 0x64]
call fcn.0040162a
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.0040162a
call fcn.0047aedc
ret