Function at 0x6953b2
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x64
mov eax, 0x6ba42c
call fcn.00640244
sub esp, 0xcc
push ebx
push esi
xor eax, eax
mov ebx, ecx
push edi
mov dword [ebp + 0x60], eax
lea ecx, [ebp]
push dword [ebp + 0x70]
mov dword [ebp + 0x64], eax
call fcn.00694350
mov eax, dword [ebp]
and dword [ebp - 4], 0
push 1
pop edi
sub eax, 0
je 0x6956e0
sub eax, 8
je 0x6956cc
sub eax, edi
je 0x695684
sub eax, edi
je 0x695647
sub eax, edi
je 0x6955d0
sub eax, edi
jne 0x695757
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp]
call fcn.004c7322
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0xb
push eax
call fcn.00695b61
push 0
push edi
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0xd
call fcn.0040f52f
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x695457
lea eax, [ebp - 0x24]
push edi
push 0
push 0
push eax
push 0x6c15d4
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp + 0x44]
push eax
call fcn.004626f4
push str.chrome
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 0xe
call fcn.00438eb2
test eax, eax
jne 0x6954a7
push eax
push str.Chrome_WidgetWin_1
call dword [sym.imp.USER32.dll_FindWindowW]
push 2
push eax
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x6954dd
push 0x6c127c
lea ecx, [ebp + 0x44]
call fcn.00438eb2
test eax, eax
jne 0x6954c0
push eax
push str.IEFrame
jmp 0x6954d7
push str.firefox
lea ecx, [ebp + 0x44]
call fcn.00438eb2
test eax, eax
jne 0x6954f8
push eax
push str.MozillaWindowClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x6954f8
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x6955b5
cmp byte [eax + 0x45], 0
je 0x6955b5
push 0x60
call fcn.0063ffa4
mov esi, eax
pop ecx
mov dword [ebp + 0x70], esi
mov byte [ebp - 4], 0xf
test esi, esi
je 0x69557b
sub esp, 0x18
mov ecx, esp
push 0x6c111c
call fcn.00429973
xor eax, eax
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x34], 7
mov dword [ebp + 0x30], eax
mov word [ebp + 0x20], ax
push 6
pop eax
mov dword [ebp + 0x64], eax
mov ecx, esi
mov dword [ebp + 0x60], eax
mov eax, dword [ebx + 0x7c]
mov dword [ebp - 4], 0x11
push dword [eax + 0x48]
lea eax, [ebp + 0x38]
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push 8
call fcn.006941f1
mov esi, eax
jmp 0x69557d
xor esi, esi
mov eax, dword [ebp + 0x64]
test al, 4
je 0x695598
push 0
and eax, 0xfffffffb
lea ecx, [ebp + 0x20]
push edi
mov dword [ebp + 0x64], eax
call fcn.004281f2
mov eax, dword [ebp + 0x64]
test al, 2
je 0x6955a4
lea ecx, [ebp + 0x38]
call fcn.00438b7a
push esi
push 0
push 0x80bd
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push edi
lea ecx, [ebp + 0x44]
call fcn.004281f2
push 0
push edi
lea ecx, [ebp - 0x24]
call fcn.004281f2
jmp 0x695757
push 0x60
call fcn.0063ffa4
mov esi, eax
pop ecx
mov dword [ebp + 0x70], esi
mov byte [ebp - 4], 8
test esi, esi
je 0x695609
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp]
call fcn.004c7322
mov ecx, edi
mov byte [ebp - 4], 9
mov dword [ebp + 0x64], ecx
mov dword [ebp + 0x60], ecx
mov ecx, esi
push eax
call fcn.00693f10
mov esi, eax
jmp 0x69560b
xor esi, esi
test byte [ebp + 0x64], 1
je 0x69561c
push 0
push edi
lea ecx, [ebp + 0x44]
call fcn.0040f52f
cmp dword [esi], 0xb
je 0x695631
push esi
push 0
push 0x80bd
push dword [ebx + 0x20]
jmp 0x6956d8
mov ecx, esi
call fcn.005b2abf
push 0x60
push esi
call fcn.00640264
pop ecx
pop ecx
jmp 0x695757
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp]
call fcn.004c7322
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
call fcn.00694a8c
push 7
pop ecx
mov esi, eax
lea edi, [ebp + 0x1c]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
lea ecx, [ebp + 0x44]
push 0
inc edi
push edi
call fcn.0040f52f
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
jmp 0x6956d5
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp]
call fcn.004c7322
push edi
push 3
push eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 4
call fcn.00693e8c
push 0
push edi
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 6
call fcn.0040f52f
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0xd8]
call fcn.006946b4
push dword [ebp + 0x5c]
push ebx
push 0x8046
jmp 0x695743
push 0
push 0
push 0x804b
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x695757
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp]
call fcn.004c7322
push 1
push 3
push eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 1
call fcn.00693e8c
xor edi, edi
mov byte [ebp - 4], 3
push 0
inc edi
lea ecx, [ebp + 0x44]
push edi
call fcn.0040f52f
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0xd8]
call fcn.006946b4
mov eax, dword [ebp + 0x5c]
push dword [ebx + 0x84]
mov dword [ebx + 0x18], eax
mov byte [ebx + 0x88], 0
call dword [sym.imp.KERNEL32.DLL_SetEvent]
push 0
push 0
push 0x804e
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0xd8]
call fcn.00571bba
push 0
push edi
lea ecx, [ebp + 4]
call fcn.0040f52f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
lea esp, [ebp + 0x68]
pop ebp
ret 4