Function at 0x4b8670
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x53f4a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, dword [eax]
push esi
push edi
mov dword [ebp - 0x28], ebx
test ecx, ecx
je 0x4b869d
cmp ecx, 0x80
jne 0x4b8a74
mov eax, dword [eax + 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.004bcaf0
mov eax, dword [ebp - 0x1c]
add esp, 8
cmp dword [ebp - 8], 8
jae 0x4b86b9
lea eax, [ebp - 0x1c]
push eax
push str.HYPERLINK_CLICK:__S_n
call fcn.004d9d00
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
add esp, 8
mov eax, edi
cmp esi, 8
jae 0x4b86d7
lea eax, [ebp - 0x1c]
mov ecx, str.sr_killing
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b8706
test dx, dx
je 0x4b8702
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b8706
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b86e0
xor eax, eax
jmp 0x4b870b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4b8749
lea ecx, [ebx - 0x28]
call fcn.004b4740
sub esp, 0x1c
mov ecx, esp
push 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x514d78
mov byte [ecx + 4], 0
call fcn.00401900
mov ecx, 0x542730
call fcn.004bd020
jmp 0x4b8a62
mov eax, edi
cmp esi, 8
jae 0x4b8753
lea eax, [ebp - 0x1c]
mov ecx, str.recheck
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b877e
test dx, dx
je 0x4b877a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b877e
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b8758
xor eax, eax
jmp 0x4b8783
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4b8794
lea ecx, [ebx - 0x28]
call fcn.004b8560
jmp 0x4b8a62
mov eax, edi
cmp esi, 8
jae 0x4b879e
lea eax, [ebp - 0x1c]
mov ecx, str.remote_a
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b87c9
test dx, dx
je 0x4b87c5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b87c9
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b87a3
xor eax, eax
jmp 0x4b87ce
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4b886b
mov ecx, 0x542518
call fcn.0048d5c0
lea edx, [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax - 0x24]
push edx
push ecx
mov dword [ebp - 0x24], 0
call dword [sym.imp.htmlayout.dll_HTMLayoutGetRootElement]
mov eax, dword [ebp - 0x24]
mov edi, dword [sym.imp.htmlayout.dll_HTMLayout_UseElement]
push eax
mov esi, eax
call edi
neg eax
sbb eax, eax
not eax
lea edx, [ebp - 0x24]
and eax, esi
push str.body
push edx
mov dword [ebp - 0x24], eax
call fcn.00462720
add esp, 8
mov ebx, eax
push ebx
call edi
mov esi, eax
neg esi
sbb esi, esi
push ecx
not esi
and esi, ebx
mov ebx, esp
push esi
call edi
mov ecx, dword [ebp - 0x28]
neg eax
sbb eax, eax
not eax
and eax, esi
add ecx, 0xffffffd8
mov dword [ebx], eax
call fcn.004b41b0
mov edi, dword [sym.imp.htmlayout.dll_HTMLayout_UnuseElement]
test esi, esi
je 0x4b8858
push esi
call edi
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4b8a62
push eax
call edi
jmp 0x4b8a62
mov eax, edi
cmp esi, 8
jae 0x4b8875
lea eax, [ebp - 0x1c]
mov ecx, str.share_a
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b88a6
test dx, dx
je 0x4b88a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b88a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b8880
xor eax, eax
jmp 0x4b88ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4b891b
mov ecx, 0x542518
call fcn.0048d6c0
lea ecx, [ebx - 0x24]
call fcn.0045fc60
push eax
lea ecx, [ebp - 0x24]
call fcn.004605c0
lea eax, [ebp - 0x24]
push str.body
push eax
call fcn.00462720
add esp, 8
push eax
lea ecx, [ebp - 0x28]
call fcn.004605c0
push ecx
lea edx, [ebp - 0x28]
mov ecx, esp
push edx
call fcn.004b3e70
lea ecx, [ebx - 0x28]
call fcn.004b40b0
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.htmlayout.dll_HTMLayout_UnuseElement]
test eax, eax
je 0x4b8908
push eax
call esi
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4b8a62
push eax
call esi
jmp 0x4b8a62
mov eax, edi
cmp esi, 8
jae 0x4b8925
lea eax, [ebp - 0x1c]
mov ecx, str.fwall_a
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b8956
test dx, dx
je 0x4b8952
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b8956
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b8930
xor eax, eax
jmp 0x4b895b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4b8976
mov ecx, 0x542518
call fcn.0048d620
lea ecx, [ebx - 0x28]
call fcn.004b8560
jmp 0x4b8a62
mov eax, edi
cmp esi, 8
jae 0x4b8980
lea eax, [ebp - 0x1c]
push 6
push str.fw_btn
push eax
call fcn.004eb575
add esp, 0xc
test eax, eax
jne 0x4b89cd
push 1
push 6
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.0046e4a0
cmp dword [eax + 0x18], 8
jb 0x4b89af
mov eax, dword [eax + 4]
jmp 0x4b89b2
add eax, 4
push eax
call fcn.004eb0b4
add esp, 4
lea ecx, [ebp - 0x44]
mov esi, eax
call fcn.00402d10
lea edi, [ebx + 0x178]
jmp 0x4b8a27
mov eax, dword [ebp - 0x1c]
mov esi, 8
cmp dword [ebp - 8], esi
jae 0x4b89dd
lea eax, [ebp - 0x1c]
push 6
push str.av_btn
push eax
call fcn.004eb575
add esp, 0xc
test eax, eax
jne 0x4b8a62
push 1
push 6
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0046e4a0
cmp dword [eax + 0x18], esi
jb 0x4b8a0b
mov eax, dword [eax + 4]
jmp 0x4b8a0e
add eax, 4
push eax
call fcn.004eb0b4
add esp, 4
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.00402d10
lea edi, [ebx + 0x160]
mov ecx, edi
call fcn.004b3e10
cmp esi, eax
jae 0x4b8a62
push esi
mov ecx, edi
call fcn.004b3e30
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x4b8a48
mov eax, dword [eax + 4]
jmp 0x4b8a4b
add eax, 4
push 5
push 0
push 0x52a4dc
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 8], 8
jb 0x4b8a74
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004ea481
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004ea5a8
mov esp, ebp
pop ebp
ret 8