Function at 0x554e40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xbbc
push ebp
mov ebp, edx
push ecx
mov edx, 0x3e7
lea ecx, [esp + 0xc]
mov dword [esp + 8], ebp
call fcn.00420d70
mov al, byte [esp + 8]
test al, al
je 0x555273
push ebx
push esi
push edi
mov edx, 0x3e7
lea ecx, [esp + 0x3fc]
call fcn.00420e60
mov edx, 0x3e7
lea ecx, [esp + 0x7e4]
call fcn.00420e60
call fcn.0041f130
call fcn.00519df0
mov eax, dword [0x5c000c]
xor ebx, ebx
test eax, eax
mov esi, 0x5c0008
je 0x554f1f
mov eax, dword [esi + 4]
cmp eax, 1
jne 0x554ed7
mov edx, dword [esi]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x554eb6
sub eax, edi
push eax
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.005a2a05
add esp, 0xc
test eax, eax
je 0x554f1c
jmp 0x55511e
cmp eax, 2
jne 0x555102
mov edx, dword [esi]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x554ee7
sub eax, edi
mov edi, eax
push edi
push edx
lea ecx, [esp + 0x1c]
push ecx
call fcn.005a2a05
add esp, 0xc
test eax, eax
jne 0x55511e
lea eax, [esp + edi + 0x14]
push 0x2e
push eax
call fcn.005912e0
add esp, 8
test eax, eax
je 0x554f1f
mov ebx, dword [esi + 8]
test bl, 0x20
je 0x554f95
lea ecx, [esp + 0x14]
push 0x3a
push ecx
call fcn.005912e0
mov edi, eax
add esp, 8
test edi, edi
je 0x554f95
mov al, byte [edi + 1]
cmp al, 0x2f
lea esi, [edi + 1]
je 0x554f47
cmp al, 0x5c
jne 0x554f69
lea edx, [edi + 2]
mov eax, edx
lea ebp, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x554f50
sub eax, ebp
inc eax
push eax
push edx
push esi
call fcn.00592290
mov ebp, dword [esp + 0x1c]
add esp, 0xc
mov al, byte [esi]
cmp al, 0x2f
je 0x554f73
cmp al, 0x5c
jne 0x554f95
lea edx, [edi + 2]
mov eax, edx
lea edi, [eax + 1]
jmp 0x554f80
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x554f80
sub eax, edi
inc eax
push eax
push edx
push esi
call fcn.00592290
add esp, 0xc
test bl, 0x40
je 0x55500b
lea edx, [esp + 0x14]
push 0x3a
push edx
call fcn.005912e0
mov edi, eax
add esp, 8
test edi, edi
je 0x55500b
mov al, byte [edi + 1]
cmp al, 0x2f
lea esi, [edi + 1]
je 0x554fdd
cmp al, 0x5c
je 0x554fdd
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x554fc2
sub eax, edx
inc eax
push eax
lea eax, [edi + 2]
push esi
push eax
call fcn.00592290
add esp, 0xc
mov byte [esi], 0x2f
mov al, byte [edi + 2]
cmp al, 0x2f
lea esi, [edi + 2]
je 0x55500b
cmp al, 0x5c
je 0x55500b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x554ff0
sub eax, edx
inc eax
push eax
push esi
add edi, 3
push edi
call fcn.00592290
add esp, 0xc
mov byte [esi], 0x2f
test bl, 8
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x555040
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x400]
push str.http:___s
push edx
call edi
add esp, 0xc
xor eax, eax
nop
mov cl, byte [esp + eax + 0x3fc]
mov byte [esp + eax + 0x14], cl
inc eax
test cl, cl
jne 0x555030
test bl, 0x10
je 0x555070
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x400]
push str.ftp:___s
push ecx
call edi
add esp, 0xc
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x3fc]
mov byte [esp + eax + 0x14], cl
inc eax
test cl, cl
jne 0x555060
test bl, 4
je 0x5550a0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x400]
push str.mailto:_s
push eax
call edi
add esp, 0xc
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x3fc]
mov byte [esp + eax + 0x14], cl
inc eax
test cl, cl
jne 0x555090
mov eax, dword [esp + 0xbd0]
test eax, eax
je 0x5550d4
push 7
lea ecx, [esp + 0x18]
push str.mailto:
push ecx
call fcn.005a2a05
add esp, 0xc
test eax, eax
je 0x5550d4
lea ecx, [esp + 0x14]
call fcn.004732b0
test eax, eax
je 0x555270
test bl, 2
je 0x555131
mov eax, dword [0x5f92ec]
push 5
push 0x5ee048
push 0
lea edx, [esp + 0x20]
push edx
push 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xbbc
ret 4
cmp eax, 4
jne 0x55511e
lea edx, [esp + 0x14]
push 0x40
push edx
call fcn.005912e0
add esp, 8
test eax, eax
jne 0x554f1c
mov eax, dword [esi + 0x10]
add esi, 0xc
test eax, eax
jne 0x554ea7
jmp 0x554f1f
test ebp, ebp
je 0x555142
cmp ebp, 1
jne 0x555212
mov esi, ebp
jmp 0x555144
xor esi, esi
mov eax, dword [0x5bfe78]
test eax, eax
je 0x55515a
mov eax, dword [0x5bfe7c]
test eax, eax
jne 0x555212
mov edx, 0x3e7
lea ecx, [esp + 0x3fc]
call fcn.00420e60
mov edx, 0x3e7
lea ecx, [esp + 0x7e4]
call fcn.00420e60
mov eax, dword [0x5bfe78]
test eax, eax
je 0x55519d
test esi, esi
jne 0x55519d
lea ecx, [esp + 0x14]
push ecx
push str.__s_____0x0_0x4_________
lea edx, [esp + 0x404]
push edx
jmp 0x5551af
lea eax, [esp + 0x14]
push eax
push str.__s_____0xFFFFFFFF_0x4_________
lea ecx, [esp + 0x404]
push ecx
call edi
add esp, 0xc
push 0xffffffffffffffff
push 2
lea edx, [esp + 0x7ec]
push edx
lea edx, [esp + 0x408]
mov ecx, str.WWW_OpenURL
call fcn.0046be60
test eax, eax
je 0x555212
mov eax, dword [0x5bfe7c]
test eax, eax
je 0x555270
test esi, esi
jne 0x555270
push 0xffffffffffffffff
push 2
lea eax, [esp + 0x7ec]
push eax
mov edx, str.0xFFFFFFFF_0x0
mov ecx, str.WWW_Activate
call fcn.0046be60
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xbbc
ret 4
mov al, byte [0x5f35f0]
test al, al
push 5
push 0x5ee048
jne 0x555248
mov edx, dword [0x5f92ec]
push 0
lea ecx, [esp + 0x20]
push ecx
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xbbc
ret 4
mov ecx, dword [0x5f92ec]
lea eax, [esp + 0x1c]
push eax
push 0x5f35f0
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x555270
xor ecx, ecx
call fcn.0041f0a0
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xbbc
ret 4