Function at 0x481f50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x310], 0
push str.SOFTWAREClientsMail
lea eax, [ebp - 0x110]
push eax
call fcn.00532580
add esp, 8
lea ecx, [ebp - 0x310]
push ecx
push 0x5f902b
lea edx, [ebp - 0x110]
push edx
push reloc.WSOCK32.dll_accept
call fcn.00486ed0
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x56a258
lea eax, [ebp - 0x210]
push eax
call fcn.00532706
add esp, 0x14
lea ecx, [ebp - 0x210]
push ecx
push 3
call fcn.00436500
add esp, 8
cmp dword [ebp - 8], 0
je 0x4820e9
movsx edx, byte [ebp - 0x310]
test edx, edx
je 0x4820e9
push 0x56a264
lea eax, [ebp - 0x110]
push eax
call fcn.00532590
add esp, 8
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.00532590
add esp, 8
push str.Protocolsmailto_shellopencommand
lea eax, [ebp - 0x110]
push eax
call fcn.00532590
add esp, 8
lea ecx, [ebp - 0x310]
push ecx
push 0x5f902c
lea edx, [ebp - 0x110]
push edx
push reloc.WSOCK32.dll_accept
call fcn.00486ed0
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x56a290
lea eax, [ebp - 0x210]
push eax
call fcn.00532706
add esp, 0x14
lea ecx, [ebp - 0x210]
push ecx
push 3
call fcn.00436500
add esp, 8
cmp dword [ebp - 8], 0
jne 0x4820e9
lea edx, [ebp - 0x310]
push edx
push 0x5f902d
lea eax, [ebp - 0x110]
push eax
push reloc.WSOCK32.dll_bind
call fcn.00486ed0
add esp, 0x10
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp - 8]
push eax
push str._d__s:__s
lea ecx, [ebp - 0x210]
push ecx
call fcn.00532706
add esp, 0x14
lea edx, [ebp - 0x210]
push edx
push 3
call fcn.00436500
add esp, 8
cmp dword [ebp - 8], 0
jne 0x482110
lea eax, [ebp - 0x310]
push eax
push 0x5f902e
push str.mailto_shellopencommand
push bind
call fcn.00486ed0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x482356
push 0xc350
call fcn.005324a9
add esp, 4
mov dword [ebp - 0x314], eax
lea ecx, [ebp - 0x310]
push ecx
call fcn.0053aa0e
add esp, 4
push 0x56a2c4
lea edx, [ebp - 0x310]
push edx
call fcn.00532680
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x482356
push 0x56a2cc
lea eax, [ebp - 0x310]
push eax
call fcn.00532680
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x482180
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
movsx edx, byte [ebp - 0x310]
cmp edx, 0x22
jne 0x4821a4
lea eax, [ebp - 0x30f]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00532580
add esp, 8
jmp 0x4821ba
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.00532580
add esp, 8
push 0x22
lea ecx, [ebp - 0x210]
push ecx
call fcn.005350b0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4821e7
mov edx, dword [ebp - 4]
add edx, 1
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00532580
add esp, 8
mov dword [ebp - 8], 1
push str.OUTLOOK
lea ecx, [ebp - 0x210]
push ecx
call fcn.00532680
add esp, 8
mov dword [ebp - 4], eax
lea edx, [ebp - 0x210]
push edx
push str.mailto:__s
mov eax, dword [ebp - 0x314]
push eax
call fcn.00532706
add esp, 0xc
mov ecx, dword [ebp - 0x314]
push ecx
push 3
call fcn.00436500
add esp, 8
cmp dword [ebp - 4], 0
je 0x482288
mov dword [ebp - 8], 0
push str._PROGRAMFILES_
lea edx, [ebp - 0x210]
push edx
call fcn.00532680
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x482264
mov dword [ebp - 8], 1
jmp 0x482288
push str.PROGRA
lea eax, [ebp - 0x210]
push eax
call fcn.00532680
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x482288
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x4822a6
push str.OFFICE12
lea ecx, [ebp - 0x210]
push ecx
call fcn.00532680
add esp, 8
test eax, eax
je 0x4822c4
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00482370
add esp, 0x14
jmp 0x482340
mov ecx, dword [ebp + 0x14]
movsx edx, byte [ecx]
test edx, edx
je 0x482303
push 0x22
mov eax, dword [ebp + 0x14]
push eax
push 0x22
push 0x22
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0x22
lea ecx, [ebp - 0x210]
push ecx
push str._s_cmailto:_s_subject_sbody_s_c_c_s_c
mov edx, dword [ebp - 0x314]
push edx
call fcn.00532706
add esp, 0x2c
jmp 0x48232e
push 0x22
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0x22
lea eax, [ebp - 0x210]
push eax
push str._s_cmailto:_s_subject_sbody_s_c
mov ecx, dword [ebp - 0x314]
push ecx
call fcn.00532706
add esp, 0x20
push 5
mov edx, dword [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x314]
push eax
call fcn.00532828
add esp, 4
mov eax, 1
jmp 0x482358
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret