Function at 0x484610
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
imul eax, eax, 0
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0xff
jae 0x48463f
jmp 0x484644
call fcn.004b64ae
mov ecx, dword [ebp - 0x314]
mov byte [ebp + ecx - 0x104], 0
push str.SOFTWAREClientsMail
lea edx, [ebp - 0x304]
push edx
call fcn.004b5e60
add esp, 8
lea eax, [ebp - 0x104]
push eax
push 0x55058f
lea ecx, [ebp - 0x304]
push ecx
push 0x80000001
call fcn.00487ad0
add esp, 0x10
mov dword [ebp - 0x308], eax
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x304]
push eax
mov ecx, dword [ebp - 0x308]
push ecx
push 0x4eef58
lea edx, [ebp - 0x204]
push edx
call fcn.004b6e08
add esp, 0x14
lea eax, [ebp - 0x204]
push eax
push 3
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x308], 0
je 0x4847f2
mov ecx, 1
imul ecx, ecx, 0
movsx edx, byte [ebp + ecx - 0x104]
test edx, edx
je 0x4847f2
push 0x4eef64
lea eax, [ebp - 0x304]
push eax
call fcn.004b5e70
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x304]
push edx
call fcn.004b5e70
add esp, 8
push str.Protocolsmailto_shellopencommand
lea eax, [ebp - 0x304]
push eax
call fcn.004b5e70
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
push 0x550590
lea edx, [ebp - 0x304]
push edx
push 0x80000001
call fcn.00487ad0
add esp, 0x10
mov dword [ebp - 0x308], eax
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x304]
push ecx
mov edx, dword [ebp - 0x308]
push edx
push 0x4eef90
lea eax, [ebp - 0x204]
push eax
call fcn.004b6e08
add esp, 0x14
lea ecx, [ebp - 0x204]
push ecx
push 3
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x308], 0
jne 0x4847f2
lea edx, [ebp - 0x104]
push edx
push 0x550591
lea eax, [ebp - 0x304]
push eax
push 0x80000002
call fcn.00487ad0
add esp, 0x10
mov dword [ebp - 0x308], eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x304]
push edx
mov eax, dword [ebp - 0x308]
push eax
push str._d__s:__s
lea ecx, [ebp - 0x204]
push ecx
call fcn.004b6e08
add esp, 0x14
lea edx, [ebp - 0x204]
push edx
push 3
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x308], 0
jne 0x48481f
lea eax, [ebp - 0x104]
push eax
push 0x550592
push str.mailto_shellopencommand
push 0x80000000
call fcn.00487ad0
add esp, 0x10
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
je 0x484abc
push 0xc350
call fcn.004b6c11
add esp, 4
mov dword [ebp - 0x310], eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.004ca3dc
add esp, 4
push 0x4eefc4
lea edx, [ebp - 0x104]
push edx
call fcn.004b5ff0
add esp, 8
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x484abc
push 0x4eefcc
lea eax, [ebp - 0x104]
push eax
call fcn.004b5ff0
add esp, 8
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x4848a1
mov ecx, dword [ebp - 0x30c]
mov byte [ecx], 0
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ebp + edx - 0x104]
cmp eax, 0x22
jne 0x4848ce
lea ecx, [ebp - 0x103]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.004b5e60
add esp, 8
jmp 0x4848e4
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004b5e60
add esp, 8
push 0x22
lea edx, [ebp - 0x204]
push edx
call fcn.004b95a0
add esp, 8
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x48491d
mov eax, dword [ebp - 0x30c]
add eax, 1
push eax
mov ecx, dword [ebp - 0x30c]
push ecx
call fcn.004b5e60
add esp, 8
mov dword [ebp - 0x308], 1
push str.OUTLOOK
lea edx, [ebp - 0x204]
push edx
call fcn.004b5ff0
add esp, 8
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x204]
push eax
push str.mailto:__s
mov ecx, dword [ebp - 0x310]
push ecx
call fcn.004b6e08
add esp, 0xc
mov edx, dword [ebp - 0x310]
push edx
push 3
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x30c], 0
je 0x4849dc
mov dword [ebp - 0x308], 0
push str._PROGRAMFILES_
lea eax, [ebp - 0x204]
push eax
call fcn.004b5ff0
add esp, 8
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x4849af
mov dword [ebp - 0x308], 1
jmp 0x4849dc
push str.PROGRA
lea ecx, [ebp - 0x204]
push ecx
call fcn.004b5ff0
add esp, 8
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x4849dc
mov dword [ebp - 0x308], 1
cmp dword [ebp - 0x308], 0
jne 0x4849fd
push str.OFFICE12
lea edx, [ebp - 0x204]
push edx
call fcn.004b5ff0
add esp, 8
test eax, eax
je 0x484a1e
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00485d70
add esp, 0x14
jmp 0x484aa6
mov edx, 1
imul edx, edx, 0
mov eax, dword [ebp + 0x14]
movsx ecx, byte [eax + edx]
test ecx, ecx
je 0x484a66
push 0x22
mov edx, dword [ebp + 0x14]
push edx
push 0x22
push 0x22
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0x22
lea eax, [ebp - 0x204]
push eax
push str._s_cmailto:_s_subject_sbody_s_c_c_s_c
mov ecx, dword [ebp - 0x310]
push ecx
call fcn.004b6e08
add esp, 0x2c
jmp 0x484a91
push 0x22
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x22
lea edx, [ebp - 0x204]
push edx
push str._s_cmailto:_s_subject_sbody_s_c
mov eax, dword [ebp - 0x310]
push eax
call fcn.004b6e08
add esp, 0x20
push 5
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x308], eax
mov edx, dword [ebp - 0x310]
push edx
call fcn.004b6bd9
add esp, 4
mov eax, 1
jmp 0x484abe
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret