Function at 0x4591fc
Capabilities:
Create process on windows

Disassembly:
push 0x20
mov eax, 0x6616e0
call fcn.0065dfa3
mov esi, ecx
cmp dword [ebp + 0x1c], 0
jne 0x459568
mov edi, dword [ebp + 0xc]
xor ecx, ecx
inc ecx
xor ebx, ebx
cmp edi, ecx
jne 0x459232
push dword [ebp + 0x14]
mov dword [esi + 0x24], ecx
mov ecx, esi
call fcn.00459c4b
jmp 0x45934e
cmp edi, 0x10
jne 0x459269
mov eax, dword [esi + 0xe0]
mov dword [esi + 0x24], ecx
cmp eax, 2
je 0x45925d
cmp eax, ecx
je 0x45925d
cmp eax, 3
je 0x45925d
sub esp, 0x10
mov ecx, esi
call fcn.0045a9be
jmp 0x459318
mov ecx, esi
call fcn.0045bd95
jmp 0x459318
cmp edi, 2
jne 0x45927d
mov dword [esi + 0x24], ecx
mov ecx, esi
call fcn.0045a8ed
jmp 0x459318
cmp edi, 0x14
jne 0x459292
xor eax, eax
mov dword [esi + 0x24], ecx
cmp dword [ebp + 0x10], eax
setne al
jmp 0x45934e
cmp edi, 0x111
je 0x4592a2
cmp edi, 0x100
jne 0x4592a7
mov dword [esi + 0x24], ecx
jmp 0x459318
cmp edi, 0x101
jne 0x4592ca
cmp dword [ebp + 0x10], 0x1b
mov dword [esi + 0x24], ecx
jne 0x459318
push ebx
push ebx
push 0x403
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x459318
cmp edi, 7
jne 0x459308
mov eax, dword [esi + 0xc8]
mov dword [esi + 0x24], ecx
sub eax, 1
je 0x4592f7
sub eax, 1
je 0x4592ef
sub eax, 1
jne 0x459318
mov eax, dword [esi + 0xb8]
jmp 0x4592fd
mov eax, dword [esi + 0xb0]
jmp 0x4592fd
mov eax, dword [esi + 0xa8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x459318
cmp edi, 0xf
jne 0x45931f
mov dword [esi + 0x24], ecx
push ecx
mov ecx, esi
call fcn.0045b693
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
jmp 0x459353
cmp edi, 0x86
jne 0x4593b6
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x28], ecx
mov ecx, dword [esi + 0xe4]
call fcn.00461195
push ebx
lea eax, [ebp - 0x28]
push eax
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [esi + 0x24], ebx
jne 0x4595df
mov edx, dword [ebp + 0x14]
lea ecx, [esi + 0x24]
movzx eax, dx
shr edx, 0x10
mov dword [ebp - 0x24], edx
mov edx, ecx
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
cmp edi, 0x83
jne 0x45940c
push dword [ebp + 0x14]
mov dword [ecx], 1
mov ecx, esi
push dword [ebp + 0x10]
call fcn.0045b959
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [esi + 0x24], ebx
jne 0x4595df
mov edx, dword [ebp - 0x14]
jmp 0x459474
cmp edi, 0x84
jne 0x45935c
mov edx, dword [ebp + 0x14]
lea eax, [esi + 0x24]
mov dword [eax], ecx
mov dword [ebp - 0x14], eax
movzx eax, dx
mov ecx, eax
mov dword [ebp - 0x24], ecx
movsx ecx, ax
mov eax, edx
shr eax, 0x10
mov dword [ebp - 0x28], eax
cwde
push eax
push ecx
mov ecx, esi
call fcn.0045b8eb
mov ecx, dword [ebp + 0x18]
lea edx, [esi + 0x24]
xor ebx, ebx
mov dword [ecx], eax
cmp dword [edx], ebx
jne 0x4595df
mov eax, dword [ebp - 0x24]
movzx eax, ax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x459474
cmp edi, 0x200
jne 0x459471
mov dword [ecx], 1
movsx ecx, ax
mov eax, dword [ebp - 0x24]
cwde
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, esi
call fcn.0045b9bf
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
mov eax, dword [ebp - 0x18]
cmp dword [eax], ebx
jne 0x4595df
cmp edi, 0x404
jne 0x45963d
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x98]
lea eax, [ebp - 0x2c]
push eax
call fcn.00471f5f
mov dword [ebp - 4], ebx
mov edi, dword [eax]
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
jmp 0x459683
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x28]
movzx eax, ax
mov dword [ebp - 0x28], eax
cmp edi, 0xa0
jne 0x4594ae
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
cwde
push eax
movsx eax, dx
push eax
push dword [ebp + 0x10]
mov dword [ecx], 1
mov ecx, esi
call fcn.0045ba12
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
jmp 0x459564
cmp edi, 0xa1
jne 0x459503
mov ecx, dword [ebp - 0x1c]
cwde
mov dword [ecx], 1
mov ecx, dword [esi + 0xe4]
cmp dword [ecx + 4], ebx
je 0x4594d6
mov byte [ecx + 8], 1
call fcn.00461195
jmp 0x4594f9
mov edx, dword [ebp - 0x10]
movzx ecx, ax
movsx eax, dx
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push dword [ebp + 0x10]
push 0xa1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
mov eax, dword [ebp - 0x20]
jmp 0x459564
cmp edi, 0xa2
jne 0x45952c
mov eax, dword [ebp - 0x20]
mov ecx, esi
mov edx, dword [ebp - 0x10]
mov dword [eax], 1
mov eax, dword [ebp - 0x28]
cwde
push eax
movsx eax, dx
push eax
push dword [ebp + 0x10]
call fcn.0045ba84
jmp 0x45955c
cmp edi, 0x2a2
jne 0x459572
mov ecx, dword [esi + 0xe4]
mov dword [edx], 1
mov byte [ecx + 8], bl
call fcn.00461195
mov eax, dword [esi + 0xe4]
mov dword [eax + 4], ebx
mov ecx, dword [esi + 0xe4]
call fcn.00461195
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
mov eax, dword [ebp - 0x14]
cmp dword [eax], ebx
jne 0x4595df
xor eax, eax
call fcn.0065df71
ret 0x18
cmp edi, 0x81
jne 0x4595ac
cmp byte [esi + 0xe8], 0
mov dword [edx], 1
je 0x459591
mov ecx, dword [esi + 4]
call fcn.00458f4a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x81
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x459561
cmp edi, 0x2e0
jne 0x4595c5
mov dword [edx], 1
xor eax, eax
mov dword [ecx], ebx
cmp dword [edx], ebx
setne al
jmp 0x45956a
cmp edi, 0x406
jne 0x4595e4
push ecx
push ecx
push dword [ebp + 0x10]
push ecx
mov ecx, esi
call fcn.0045ae15
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0x45956a
cmp edi, 0x40a
jne 0x459611
cmp dword [esi + 0xe0], ebx
jne 0x45969b
push 2
mov ecx, esi
call fcn.0045ac75
mov ecx, dword [esi + 0xa8]
call fcn.0045fe66
jmp 0x45969b
cmp edi, 0x401
jne 0x459625
sub esp, 0x10
mov ecx, esi
call fcn.0045a935
jmp 0x4595da
cmp edi, 0x403
jne 0x45943d
sub esp, 0x10
mov ecx, esi
call fcn.0045a9be
jmp 0x4595da
cmp edi, 0x405
jne 0x459651
sub esp, 0x10
mov ecx, esi
call fcn.0045b255
jmp 0x4595da
cmp edi, 0x407
jne 0x4596a5
mov ecx, esi
call fcn.0045affb
mov ecx, dword [esi + 0x98]
lea eax, [ebp - 0x2c]
push eax
mov dword [esi + 0xe0], ebx
call fcn.00471f5f
mov dword [ebp - 4], 1
mov edi, dword [eax]
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x68f308]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x45969b
call fcn.0044de70
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x4595df
cmp edi, 0x408
jne 0x4596b6
mov ecx, esi
call fcn.0045affb
jmp 0x45969b
cmp edi, 0x409
jne 0x4596d4
push 1
mov ecx, esi
call fcn.0045ac75
mov ecx, dword [esi + 0xa8]
call fcn.0045fd2b
jmp 0x4596ad
cmp edi, 0x40b
jne 0x4596ee
push ecx
push ecx
push dword [ebp + 0x10]
push ecx
mov ecx, esi
call fcn.0045baf4
jmp 0x4595da
cmp edi, 0x40c
jne 0x459705
sub esp, 0x10
mov ecx, esi
call fcn.0045b5bc
jmp 0x4595da
cmp edi, 0x40d
jne 0x459718
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x45969b
cmp edi, 0x40e
jne 0x45973a
push 5
push ebx
push ebx
push str.https:__web.webex.com_
push 0x717300
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x45969b
cmp edi, 0x40f
jne 0x459568
mov ecx, esi
call fcn.0045b136
jmp 0x45969b