Function at 0x4bed70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4c
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
push str.GetVersion
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x5b0]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x4bedc4
push 0x100
lea edx, [ebp - 0x5b0]
mov ecx, 0x47d
call fcn.004ca1e0
add esp, 4
call fcn.004ca5f0
test eax, eax
je 0x4beddf
push str.http:__www.winpatrol.com_cgi_bin_versione1.pl_
lea eax, [ebp - 0x5b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 8
lea edx, [ebp - 0xc]
mov ecx, 0x27a
call fcn.004ca1e0
add esp, 4
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
jne 0x4bee18
push 0x4ec4e0
push str.Loc_s
lea edx, [ebp - 0xb0]
push edx
jmp 0x4bee28
lea eax, [ebp - 0xc]
push eax
push str.Loc_s
lea ecx, [ebp - 0xb0]
push ecx
call edi
lea edx, [ebp - 0x90]
add esp, 0xc
push edx
xor ecx, ecx
call fcn.0047c870
add esp, 4
push str.userid
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4fbf9c
lea ecx, [ebp - 0x4b0]
push ecx
call esi
push str.build
lea edx, [ebp - 0x4b0]
push edx
call esi
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0x4b0]
push eax
call esi
cmp dword [0x506e0c], 0
je 0x4beea9
push str.x641
lea ecx, [ebp - 0x4b0]
push ecx
jmp 0x4beeb5
push str.x640
lea edx, [ebp - 0x4b0]
push edx
call esi
push 0x94
lea eax, [ebp - 0xa48]
push 0
push eax
call fcn.004d29c0
add esp, 0xc
lea ecx, [ebp - 0xa48]
push ecx
mov dword [ebp - 0xa48], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [ebp - 0xa3c]
mov eax, dword [ebp - 0xa40]
mov ecx, dword [ebp - 0xa44]
push edx
push eax
push ecx
lea edx, [ebp - 0x90]
push str.winv_d._d._d
push edx
call edi
add esp, 0x14
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x9b0]
mov ebx, str.firefox.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bef68
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4bef68
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x90]
push str.ff_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x9b0]
mov ebx, str.IExplore.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4befb6
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4befb6
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x90]
push str.ie_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x9b0]
mov ebx, str.acrobat.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf004
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4bf004
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x90]
push str.ab_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x9b0]
mov ebx, str.mbam.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf052
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4bf052
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x90]
push str.mbam_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x9b0]
mov ebx, str.msseces.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf0a0
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4bf0a0
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x90]
push str.msse_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x9b0]
mov ebx, str.chrome.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf0ee
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4bf0ee
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x90]
push str.gg_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x9b0]
mov ebx, str.javaws.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf13c
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4bf13c
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x90]
push str.java_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x9b0]
mov ebx, str.iTunes.exe
call fcn.004c1070
add esp, 4
test eax, eax
je 0x4bf18a
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4bf18a
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x90]
push str.it_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
call esi
lea edx, [ebp - 0x5b0]
push edx
lea eax, [ebp - 0x9b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x4b0]
push ecx
lea edx, [ebp - 0x9b0]
push edx
call esi
mov ecx, dword [0x4fbdcc]
push 1
push 0x4e27f8
push 0x4e27f8
lea eax, [ebp - 0x9b0]
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret