Function at 0x422150
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595033
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x602c90]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x5c232c
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x278], eax
call fcn.00401d80
xor ebx, ebx
push 0x75
mov dword [ebp - 4], ebx
call fcn.00473506
cmp eax, ebx
jne 0x4221ab
xor esi, esi
jmp 0x4221bb
push 0x75
push eax
lea ecx, [ebp - 0x258]
call fcn.00401f60
mov esi, eax
lea ecx, [ebp - 0x258]
call fcn.00404e50
mov ecx, eax
call fcn.00404ed0
push eax
lea ecx, [ebp - 0x258]
call fcn.00405100
cmp esi, ebx
je 0x422c8f
mov ecx, dword [ebp - 0x258]
mov eax, dword [ecx - 0xc]
cmp eax, ebx
je 0x422c8f
jl 0x422476
push str.firefox
push ecx
call fcn.00560268
mov ecx, dword [ebp - 0x258]
add esp, 8
cmp eax, ebx
je 0x422476
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x422476
lea ecx, [ebp - 0x270]
call fcn.004891fa
push 0xffffffffffffffff
push 4
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 1
call fcn.00489291
push str.C:Program_Files__x86_Mozilla_Firefox_firefox.exe
lea ecx, [ebp - 0x24c]
call fcn.00401d80
mov byte [ebp - 4], 2
cmp dword [ebp - 0x268], ebx
jg 0x422260
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
push eax
call fcn.00405100
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422292
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:Program_FilesMozilla_Firefox_firefox.exe
lea ecx, [ebp - 0x24c]
call fcn.00401d80
mov byte [ebp - 4], 3
cmp dword [ebp - 0x268], 1
jg 0x4222b4
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
add ecx, 4
push eax
call fcn.00405100
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4222e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.D:Program_Files__x86_Mozilla_Firefox_firefox.exe
lea ecx, [ebp - 0x24c]
call fcn.00401d80
mov byte [ebp - 4], 4
cmp dword [ebp - 0x268], 2
jg 0x42230b
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
add ecx, 8
push eax
call fcn.00405100
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422340
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.D:Program_FilesMozilla_Firefox_firefox.exe
lea ecx, [ebp - 0x24c]
call fcn.00401d80
mov byte [ebp - 4], 5
cmp dword [ebp - 0x268], 3
jg 0x422362
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
add ecx, 0xc
push eax
call fcn.00405100
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422397
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x268]
xor edi, edi
cmp eax, ebx
jle 0x422461
cmp edi, ebx
jl 0x42225b
cmp edi, eax
jge 0x42225b
mov ecx, dword [ebp - 0x26c]
mov eax, dword [ecx + edi*4]
sub eax, 0x10
push eax
call fcn.00405370
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x24c], esi
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 6
call fcn.00487a24
mov byte [ebp - 4], 7
push ebx
lea edx, [ebp - 0x244]
push edx
push esi
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ebx
call fcn.00488d58
cmp eax, 1
je 0x4224eb
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 6
call fcn.00487b54
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422452
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x268]
inc edi
cmp edi, eax
jl 0x4223a7
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0
call fcn.00489438
mov ecx, dword [ebp - 0x258]
cmp dword [ecx - 0xc], ebx
jl 0x422c8f
push str.chrome
push ecx
call fcn.00560268
mov ecx, dword [ebp - 0x258]
add esp, 8
cmp eax, ebx
je 0x422889
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x422889
lea ecx, [ebp - 0x270]
call fcn.004891fa
push 0xffffffffffffffff
push 4
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0xd
call fcn.00489291
push str.C:Program_Files__x86_GoogleChromeApplicationchrome.exe
lea ecx, [ebp - 0x254]
call fcn.00401d80
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x268], ebx
jg 0x42261d
call fcn.004733b9
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x254]
push 0x5c37e0
push edx
call fcn.00420ea0
add esp, 0xc
push str.___osint__url
push eax
lea eax, [ebp - 0x274]
push eax
mov byte [ebp - 4], 8
call fcn.00420dc0
add esp, 0xc
mov ecx, dword [ebp - 0x278]
push ecx
push eax
lea edx, [ebp - 0x248]
push edx
mov byte [ebp - 4], 9
call fcn.00420d00
add esp, 0xc
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x274]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422560
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422586
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x288]
call fcn.00448270
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4225bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 6
call fcn.00487b54
mov byte [ebp - 4], 1
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4225ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0
call fcn.00489438
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x258]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x423218
mov ecx, dword [ebp - 0x26c]
push eax
call fcn.00405100
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42264f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:Program_FilesGoogleChromeApplicationchrome.exe
lea ecx, [ebp - 0x254]
call fcn.00401d80
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x268], 1
jg 0x422671
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
add ecx, 4
push eax
call fcn.00405100
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4226a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.D:Program_Files__x86_GoogleChromeApplicationchrome.exe
lea ecx, [ebp - 0x254]
call fcn.00401d80
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x268], 2
jg 0x4226c8
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
add ecx, 8
push eax
call fcn.00405100
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4226fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.D:Program_FilesGoogleChromeApplicationchrome.exe
lea ecx, [ebp - 0x254]
call fcn.00401d80
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x268], 3
jg 0x42271f
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
add ecx, 0xc
push eax
call fcn.00405100
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422754
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x268]
xor ebx, ebx
test eax, eax
jle 0x422872
test ebx, ebx
js 0x42225b
cmp ebx, eax
jge 0x42225b
mov ecx, dword [ebp - 0x26c]
mov esi, dword [ecx + ebx*4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x4227a3
cmp eax, dword [esi - 0x10]
jne 0x4227a3
lea edi, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4227db
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4231d1
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.0055fdb4
add esp, 0x10
lea esi, [edi + 0x10]
mov dword [ebp - 0x254], esi
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x12
call fcn.00487a24
xor eax, eax
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x244]
push ecx
push esi
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
call fcn.00488d58
cmp eax, 1
je 0x4228fc
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x12
call fcn.00487b54
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xd
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x422863
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x268]
inc ebx
cmp ebx, eax
jl 0x422764
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0
call fcn.00489438
mov ecx, dword [ebp - 0x258]
xor ebx, ebx
cmp dword [ecx - 0xc], ebx
jl 0x422c8f
push 0x5c6128
push ecx
call fcn.00560268
add esp, 8
cmp eax, ebx
je 0x422c8f
sub eax, dword [ebp - 0x258]
sar eax, 1
cmp eax, 0xffffffff
je 0x422c8f
lea ecx, [ebp - 0x270]
call fcn.004891fa
push 0xffffffffffffffff
push 4
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0x1b
call fcn.00489291
push str.C:Program_Files__x86_Internet_Exploreriexplore.exe
lea ecx, [ebp - 0x25c]
call fcn.00401d80
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x268], ebx
jg 0x422a25
call fcn.004733b9
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x25c]
push 0x5c37e0
push edx
call fcn.00420ea0
add esp, 0xc
push 0x5c6114
push eax
lea eax, [ebp - 0x24c]
push eax
mov byte [ebp - 4], 0x14
call fcn.00420dc0
add esp, 0xc
mov ecx, dword [ebp - 0x278]
push ecx
push eax
lea edx, [ebp - 0x274]
push edx
mov byte [ebp - 4], 0x15
call fcn.00420d00
add esp, 0xc
push 0x5c37e0
push eax
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 4], 0x16
call fcn.00420dc0
add esp, 0xc
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x274]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42298a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4229b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4229d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x288]
call fcn.00448270
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422a0d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x12
call fcn.00487b54
mov byte [ebp - 4], 0xd
jmp 0x4225d0
mov ecx, dword [ebp - 0x26c]
push eax
call fcn.00405100
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422a57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.C:Program_FilesInternet_Exploreriexplore.exe
lea ecx, [ebp - 0x25c]
call fcn.00401d80
mov byte [ebp - 4], 0x1d
cmp dword [ebp - 0x268], 1
jg 0x422a79
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
add ecx, 4
push eax
call fcn.00405100
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422aae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.D:Program_Files__x86_Internet_Exploreriexplore.exe
lea ecx, [ebp - 0x25c]
call fcn.00401d80
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0x268], 2
jg 0x422ad0
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
add ecx, 8
push eax
call fcn.00405100
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422b05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.D:Program_FilesInternet_Exploreriexplore.exe
lea ecx, [ebp - 0x25c]
call fcn.00401d80
mov byte [ebp - 4], 0x1f
cmp dword [ebp - 0x268], 3
jg 0x422b27
call fcn.004733b9
mov ecx, dword [ebp - 0x26c]
add ecx, 0xc
push eax
call fcn.00405100
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422b5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x268]
xor ebx, ebx
test eax, eax
jle 0x422c7e
lea esp, [esp]
test ebx, ebx
js 0x42225b
cmp ebx, eax
jge 0x42225b
mov ecx, dword [ebp - 0x26c]
mov esi, dword [ecx + ebx*4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x422baf
cmp eax, dword [esi - 0x10]
jne 0x422baf
lea edi, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x422be7
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4231d1
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.0055fdb4
add esp, 0x10
lea esi, [edi + 0x10]
mov dword [ebp - 0x25c], esi
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x20
call fcn.00487a24
xor eax, eax
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x244]
push ecx
push esi
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
call fcn.00488d58
cmp eax, 1
je 0x422cec
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x20
call fcn.00487b54
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x1b
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x422c6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x268]
inc ebx
cmp ebx, eax
jl 0x422b70
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0
call fcn.00489438
xor ebx, ebx
mov byte [ebp - 0x24d], 1
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x27c], ebx
push 0x20019
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push SysReAllocStringLen
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 0x29
call fcn.00421ff0
cmp eax, ebx
jne 0x4231ba
call fcn.0047977b
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x422e15
push 0x80004005
call fcn.00401090
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x24c]
push 0x5c37e0
push edx
call fcn.00420ea0
add esp, 0xc
push 0x5c62d0
push eax
lea eax, [ebp - 0x274]
push eax
mov byte [ebp - 4], 0x22
call fcn.00420dc0
add esp, 0xc
mov ecx, dword [ebp - 0x278]
push ecx
push eax
lea edx, [ebp - 0x254]
push edx
mov byte [ebp - 4], 0x23
call fcn.00420d00
add esp, 0xc
push 0x5c37e0
push eax
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 4], 0x24
call fcn.00420dc0
add esp, 0xc
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422d7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x274]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422da0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422dc6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x288]
call fcn.00448270
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422dfd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x20
call fcn.00487b54
mov byte [ebp - 4], 0x1b
jmp 0x4225d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x248], esi
push str.Progid
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 0x2a
call fcn.00401d80
mov byte [ebp - 4], 0x2b
mov edi, dword [ebp - 0x24c]
mov dword [ebp - 0x25c], 0x104
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x422e79
push 0x104
lea ecx, [ebp - 0x248]
call fcn.00402250
mov esi, dword [ebp - 0x248]
push edi
lea ecx, [ebp - 0x284]
push ecx
lea edi, [ebp - 0x25c]
call fcn.004220a0
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0055ffac
add esp, 8
cmp eax, ebx
jl 0x422fb8
cmp eax, dword [esi - 8]
jg 0x422fb8
mov dword [esi - 0xc], eax
xor edx, edx
mov word [esi + eax*2], dx
mov ecx, str.IE.HTTP
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422ee6
cmp dx, bx
je 0x422ee2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422ee6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x422ec0
xor eax, eax
jmp 0x422eeb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x422ef6
mov byte [ebp - 0x24d], 0
mov eax, dword [ebp - 0x284]
cmp eax, ebx
je 0x422f0d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x284], ebx
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
mov dword [ebp - 0x280], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422f39
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x29
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422f59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp - 0x24d], 0
jne 0x4231ba
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
push 0x20019
push str.http_shellopencommand
push SysReAllocStringLen
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x2c
call fcn.00421ff0
cmp eax, ebx
jne 0x423195
call fcn.0047977b
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x422fc2
push 0x80004005
call fcn.00401090
push 0x80070057
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x248], esi
push 0x5c232c
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 0x2d
call fcn.00401d80
mov byte [ebp - 4], 0x2e
mov edi, dword [ebp - 0x24c]
mov dword [ebp - 0x25c], 0x104
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x423026
push 0x104
lea ecx, [ebp - 0x248]
call fcn.00402250
mov esi, dword [ebp - 0x248]
push edi
lea ecx, [ebp - 0x268]
push ecx
lea edi, [ebp - 0x25c]
call fcn.004220a0
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0055ffac
add esp, 8
cmp eax, ebx
jl 0x422fb8
cmp eax, dword [esi - 8]
jg 0x422fb8
mov dword [esi - 0xc], eax
xor edx, edx
mov word [esi + eax*2], dx
mov eax, dword [ebp - 0x278]
mov eax, dword [eax]
push eax
push 0x5c63c4
lea ecx, [ebp - 0x248]
call fcn.00404af0
test eax, eax
jne 0x423113
mov ecx, dword [ebp - 0x278]
push ecx
lea edx, [ebp - 0x274]
push 0x5c25c8
push edx
call fcn.00420ea0
add esp, 0xc
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x254]
mov bl, 0x2f
push ecx
mov byte [ebp - 4], bl
call fcn.00420d00
add esp, 0xc
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x30
call fcn.00405100
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4230ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x274]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x423113
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x2ac]
call fcn.00448270
mov esi, dword [ebp - 0x268]
test esi, esi
je 0x42313d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x268], esi
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
mov dword [ebp - 0x264], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42316d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4231a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4231a2
mov esi, dword [ebp - 0x268]
mov byte [ebp - 0x24d], 1
mov byte [ebp - 4], 0x29
test esi, esi
je 0x4231b1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x24d], 0
je 0x4231ea
mov ecx, dword [ebp - 0x278]
mov eax, dword [ecx]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x4231d6
call fcn.004022b0
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x284]
test eax, eax
je 0x4231fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x258]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x423224
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055f89e
mov esp, ebp
pop ebp
ret 4