Function at 0x481a00
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3e8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3f8]
test esi, esi
push edi
je 0x481fbd
cmp byte [esi], 0
je 0x481fbd
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x3e8
jae 0x481fbd
mov edi, dword [esp + 0x404]
test edi, edi
je 0x481a59
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x3e8
jae 0x481fbd
mov eax, dword [0x510ae0]
mov ebx, dword [esp + 0x400]
test eax, eax
je 0x481a83
test ebx, ebx
mov eax, ebx
jne 0x481a74
mov eax, 0x4ddbb0
push eax
push esi
push str.web_url___s___s_
call fcn.0043bb00
add esp, 0xc
push str.javascript:
push esi
call fcn.0046b1b0
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x481fbd
mov ecx, dword [esp + 0x408]
test ecx, ecx
sete al
push eax
push esi
call fcn.00470520
add esp, 8
test eax, eax
jne 0x481fbd
test ebx, ebx
je 0x481b1b
mov edi, str.aw_3d
mov eax, ebx
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x481af4
test cl, cl
je 0x481af0
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x481af4
add eax, 2
add edi, 2
test cl, cl
jne 0x481acc
xor eax, eax
jmp 0x481af9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x481b1b
push 0x4ddbb0
push 0x4ddbb0
push esi
call fcn.0047e3f0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3e8
ret
mov eax, dword [0x505b1c]
test eax, eax
je 0x481b2e
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push esi
call fcn.0046ade0
mov dword [0x505b1c], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [sym.imp.MSVCRT.dll__stricmp]
lea ebp, [esi - 4]
not ecx
dec ecx
push str..mid
add ecx, ebp
push ecx
call ebx
add esp, 0xc
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esi - 5]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str..midi
add ecx, edx
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..rmi
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..wav
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..avi
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..wma
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..wmv
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..asx
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..vsx
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..mp3
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..mpeg
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esi - 5]
add ecx, eax
push ecx
call ebx
add esp, 8
test eax, eax
je 0x481cc4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push str..mpg
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x481d5f
call fcn.00482fb0
test eax, eax
je 0x481cf0
mov eax, dword [0x505b20]
test eax, eax
je 0x481cdf
mov eax, dword [0x505b2c]
test eax, eax
jne 0x481d08
mov eax, dword [esp + 0x408]
test eax, eax
jne 0x481fbd
jmp 0x481d08
mov eax, dword [esp + 0x408]
test eax, eax
je 0x481d08
call fcn.00482fc0
test eax, eax
je 0x481fbd
mov eax, dword [0x505ae0]
test eax, eax
je 0x481d1f
mov ecx, dword [0x505b1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0
push esi
push str.wmplayer.exe
push str.open
push 0
call ebx
cmp eax, 0x20
jg 0x481fbd
push 1
push 0
push esi
push str.mplayer2.exe
push str.open
push 0
call ebx
cmp eax, 0x20
jg 0x481fbd
jmp 0x481d65
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.00482fb0
test eax, eax
je 0x481f2f
mov eax, dword [0x505b20]
test eax, eax
je 0x481d84
mov eax, dword [0x505b2c]
test eax, eax
jne 0x481db7
mov eax, dword [esp + 0x408]
test eax, eax
jne 0x481fbd
push 0
call fcn.00482020
mov eax, dword [0x505b20]
add esp, 4
test eax, eax
je 0x481fbd
mov eax, dword [0x505b2c]
test eax, eax
je 0x481fbd
mov edx, dword [0x505b1c]
mov eax, dword [0x505ae0]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
push 6
push str.local:
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x481e1a
push 0x4c794c
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x481fbd
add esi, 6
push esi
call fcn.00410b10
push eax
push str._sdefaultweb_s
push 0x5056f4
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x481e9c
push 7
push str.awpath:
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x481e7a
push 0x4c794c
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x481fbd
call fcn.004020d0
test eax, eax
je 0x481ee2
add esi, 7
push esi
call fcn.004020d0
push eax
push 0x4c5924
push 0x5056f4
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0x5056f4
call fcn.0042eab0
add esp, 0x14
test eax, eax
jne 0x481e9c
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x5056f4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x404]
test edx, edx
je 0x481f02
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x481f02
mov eax, dword [esp + 0x400]
test eax, eax
jne 0x481ec5
mov eax, 0x4ddbb0
push edx
push eax
mov eax, dword [0x505b20]
push 0x5056f4
push eax
call fcn.004a6c3a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3e8
ret
lea edi, [esi + 7]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x5056f4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x481e97
mov eax, dword [esp + 0x400]
test eax, eax
jne 0x481f12
mov eax, 0x4ddbb0
mov ecx, dword [0x505b20]
push eax
push 0x5056f4
push ecx
call fcn.004a6c0d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3e8
ret
mov eax, dword [esp + 0x408]
test eax, eax
je 0x481f43
call fcn.00482fc0
test eax, eax
je 0x481fbd
push 0x3a
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x481f92
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x3e1
ja 0x481f92
push esi
lea edx, [esp + 0x14]
push str.http:___s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [0x505afc]
add esp, 0xc
lea eax, [esp + 0x10]
push 1
push 0
push 0
push eax
push str.open
push ecx
jmp 0x481fa5
mov edx, dword [0x505afc]
push 1
push 0
push 0
push esi
push str.open
push edx
call ebx
cmp eax, 0x20
jle 0x481fbd
call fcn.004109d0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.004109e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3e8
ret