Function at 0x402cdd
Capabilities:
Create process on windows

Disassembly:
push 0xc4
mov eax, 0x457126
call fcn.00456afc
mov eax, edx
mov dword [ebp - 0xd0], eax
and dword [ebp - 0xcc], 0
mov esi, eax
cmp dword [eax + 0x14], 7
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc4], ecx
jbe 0x402d0e
mov esi, dword [eax]
add eax, 0x18
mov dword [ebp - 0xc8], eax
cmp dword [eax + 0x14], 7
jbe 0x402d25
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov ebx, 0x463d18
lea ecx, [ebp - 0x88]
push ebx
call fcn.00403fc1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ebx
call fcn.00403fc1
xor ebx, ebx
inc ebx
cmp byte [ebp + 8], 0
mov byte [ebp - 4], bl
je 0x402db6
mov edx, dword [0x658834]
lea eax, [ebp - 0xb9]
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 0xb9], 0
call fcn.00405de7
pop ecx
push eax
mov edx, 0x46415c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.004048b6
mov edi, eax
lea eax, [ebp - 0x28]
pop ecx
cmp eax, edi
je 0x402d98
mov ecx, eax
call fcn.004044f6
push edi
lea ecx, [ebp - 0x28]
call fcn.00404570
lea ecx, [ebp - 0x40]
call fcn.004044f6
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.004044f6
mov al, byte [ebp - 0xb9]
mov byte [0x658830], al
and dword [ebp - 0xc0], 0
mov edi, dword [sym.imp.VCRUNTIME140.dll_wcsstr]
push str.Google_Chrome
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x402eca
mov ecx, reloc.WS2_32.dll_bind
call fcn.004028e2
test eax, eax
je 0x402df5
mov ecx, reloc.WS2_32.dll_accept
call fcn.004028e2
test eax, eax
jne 0x402f89
mov edi, dword [ebp - 0xc0]
push 0x463d18
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00403fc1
mov esi, dword [ebp - 0xd0]
mov ecx, str.activate0
mov eax, 0x46412c
mov dword [ebp - 0xcc], ebx
cmp dword [esi + 0x7c], 8
cmovne eax, ecx
lea ecx, [ebp - 0x58]
push eax
call fcn.00403f25
mov edx, esi
lea ecx, [ebp - 0xb8]
call fcn.00402bc4
push eax
mov edx, 0x464160
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa0]
call fcn.004048b6
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
push ecx
push eax
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x40]
call fcn.00404eda
lea ecx, [ebp - 0x88]
call fcn.004044f6
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x88]
call fcn.00404570
lea ecx, [ebp - 0x40]
call fcn.004044f6
lea ecx, [ebp - 0xa0]
call fcn.004044f6
lea ecx, [ebp - 0xb8]
call fcn.004044f6
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.004044f6
mov ecx, dword [ebp - 0xc4]
mov eax, accept
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, dword [ebp - 0x18]
jb 0x402fa4
jmp 0x402f1a
push str.Yandex
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x402df5
push str.Microsoft_Edge
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x402df5
push str.Firefox
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x402df5
push str.Opera
push esi
call edi
mov edi, dword [ebp - 0xc0]
test eax, eax
pop ecx
pop ecx
cmove edi, ebx
jmp 0x402dfb
cmp dword [ecx + 0x14], 7
jbe 0x402f22
mov ecx, dword [ecx]
push dword [ebp - 0x18]
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
push edx
push ecx
push ecx
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x40]
call fcn.00405024
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x70]
call fcn.004048f3
pop ecx
lea ecx, [ebp - 0x40]
call fcn.004044f6
cmp dword [ebp - 0x5c], 7
lea eax, [ebp - 0x70]
push ebx
cmova eax, dword [ebp - 0x70]
xor ecx, ecx
push ecx
push eax
push dword [ebp - 0xc8]
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x70]
mov ebx, edi
call fcn.004044f6
lea ecx, [ebp - 0x28]
call fcn.004044f6
lea ecx, [ebp - 0x88]
call fcn.004044f6
mov eax, ebx
call fcn.00456aba
ret
call fcn.004015af
int3