Function at 0x4ab560
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b1c0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x4ab5a8
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0045adc0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4ab5c4
push 0x80004005
call fcn.0045a8f0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
mov ecx, 0x5de154
call fcn.0049cca0
or ebx, 0xffffffff
test eax, eax
jne 0x4ab5f4
xor edi, edi
jmp 0x4ab962
push 0xb
push str.chrome.exe
lea ecx, [ebp - 0x18]
call fcn.00472540
call fcn.0045adc0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4ab61f
push 0x80004005
call fcn.0045a8f0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], 0
mov byte [ebp - 4], 1
je 0x4ab643
push str.__restore_last_session
lea ecx, [ebp - 0x14]
call fcn.0045a5f0
call fcn.0045adc0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4ab65f
push 0x80004005
call fcn.0045a8f0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [0x5de90c]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x4ab68b
lea eax, [ebp - 0x10]
push eax
call fcn.004e2a50
test eax, eax
js 0x4ab920
push esi
mov ecx, 0x5de840
call fcn.00515490
test eax, eax
je 0x4ab920
mov edi, dword [eax + 0x2c]
test edi, edi
je 0x4ab744
push 0x583434
lea ecx, [ebp + 8]
call fcn.0045a3a0
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00483440
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
mov edi, eax
call fcn.0048ceb0
test edi, edi
je 0x4ab744
push esi
call fcn.004be120
add esp, 4
lea ecx, [ebp - 0x1c]
test eax, eax
je 0x4ab719
push str.OfferPageUrl
call fcn.0045a3a0
push 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.00483620
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0048ceb0
mov ecx, 1
jmp 0x4ab746
push str.LandingPageUrl
call fcn.0045a3a0
push 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.00483620
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0048ceb0
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4ab920
xor edi, edi
test ecx, ecx
jne 0x4ab803
push dword [esi]
push str.apnu_findme
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
push str.___s_p_dtid_spid_s_
push eax
call fcn.0045ccb0
add esp, 0x18
push 0x38
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00525ee0
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x6c], 0x3c
mov dword [ebp - 0x68], 0x40
mov dword [ebp - 0x60], str.open
mov dword [ebp - 0x50], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4ab920
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0xa
push esi
mov edi, eax
call fcn.004a8f90
mov ecx, eax
call fcn.004bfbf0
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
push esi
call fcn.004a8f90
mov ecx, eax
call fcn.004bfa00
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ab922
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 6
push eax
push dword [esi]
call fcn.004aae70
add esp, 8
test eax, eax
je 0x4ab8e5
cmp dword [ebp - 0x2c], 0
jbe 0x4ab8e5
lea ecx, [ebp - 0x20]
call fcn.0045a530
lea ecx, [ebp - 0x1c]
call fcn.0045a530
lea ecx, [ebp + 8]
call fcn.0045a530
push dword [esi]
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 9
push dword [0x5d67e4]
push eax
call fcn.0045acb0
lea eax, [ebp + 8]
push eax
push 0x583914
push dword [ebp - 0x1c]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00511e70
add esp, 0x1c
test eax, eax
je 0x4ab8cd
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x4ab8cd
push 0x582c9c
lea ecx, [ebp + 8]
call fcn.00497fd0
push 0x583920
lea ecx, [ebp + 8]
call fcn.004ab9a0
push 0
lea ecx, [ebp - 0x30]
call fcn.0049d360
push dword [ebp + 8]
push dword [esi]
push dword [ebp + 0x10]
push dword [eax]
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push 0x583924
push eax
call fcn.0045ccb0
add esp, 0x1c
mov edi, 1
lea ecx, [ebp + 8]
call fcn.0048ceb0
lea ecx, [ebp - 0x1c]
call fcn.0048ceb0
lea ecx, [ebp - 0x20]
call fcn.0048ceb0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.004cca80
test edi, edi
jne 0x4ab779
push 0xa
push esi
call fcn.004a8f90
mov ecx, eax
call fcn.004bfbf0
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
push esi
call fcn.004a8f90
mov ecx, eax
call fcn.004bfa00
xor edi, edi
mov edx, dword [ebp - 0x10]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ab942
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ab962
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x18]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4ab983
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret