Function at 0x4d0190
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xe4
push ebx
push ebp
mov ebp, dword [esp + 0xf0]
push esi
mov dword [esp + 0x18], 0
cmp byte [0x700914], 5
push edi
jb 0x4d01db
cmp dword [ebp + 4], 0
je 0x4d01bd
mov eax, dword [ebp]
jmp 0x4d01c2
mov eax, 0x60f5ec
push eax
push str.LaunchURL__s
push 5
push 0x700918
push 0
push 0
call fcn.0047fa60
add esp, 0x18
lea eax, [esp + 0x7c]
mov dword [esp + 0x30], 0
push eax
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
call fcn.004d2040
add esp, 0x10
test al, al
je 0x4d0307
mov esi, dword [esp + 0x80]
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
test esi, esi
je 0x4d025e
dec esi
jmp 0x4d0260
xor esi, esi
lea eax, [esi + 0x13]
mov dword [esp + 0xb4], esi
test eax, eax
jle 0x4d027d
inc eax
test eax, eax
jle 0x4d027d
push eax
lea ecx, [esp + 0x68]
call fcn.0040ce40
test esi, esi
je 0x4d0292
push esi
push dword [esp + 0x80]
lea ecx, [esp + 0x6c]
call fcn.0040edd0
push 0x13
push str._shellopencommand
lea ecx, [esp + 0x6c]
call fcn.0040edd0
mov ecx, dword [esp + 0x68]
test ecx, ecx
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x64]
mov dword [esp + 0xbc], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0xc0], eax
mov eax, 0x60f5ec
push ecx
cmovne eax, esi
mov dword [esp + 0xbc], esi
push 0
push eax
push 0x80000000
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
call fcn.004d2040
add esp, 0x10
test esi, esi
je 0x4d0307
push esi
call fcn.0043f8f0
add esp, 4
cmp dword [esp + 0x34], 1
mov ebx, dword [esp + 0xfc]
jg 0x4d0339
lea eax, [esp + 0x30]
push eax
push 0
push str.http_shellopencommand
push 0x80000000
call fcn.004d2040
add esp, 0x10
cmp dword [esp + 0x34], 1
jle 0x4d086d
xor esi, esi
lea ecx, [esp + 0x30]
push 0xffffffffffffffff
push esi
push 1
push 0x6112e0
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
call fcn.00410050
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4d0848
lea edi, [eax + 1]
push edi
push esi
push 1
push 0x6112e0
lea ecx, [esp + 0x40]
call fcn.00410050
mov dword [esp + 0x60], eax
cmp eax, 0xffffffff
je 0x4d0848
mov ecx, dword [esp + 0x34]
mov ebx, eax
sub ebx, dword [esp + 0x10]
sub ebx, 1
mov dword [esp + 0x18], esi
js 0x4d04b2
test ecx, ecx
je 0x4d03a9
lea eax, [ecx - 1]
jmp 0x4d03ab
xor eax, eax
test edi, edi
jns 0x4d03b3
xor esi, esi
jmp 0x4d03ba
cmp edi, eax
mov esi, eax
cmovl esi, edi
cdq
mov dword [esp + 0x14], eax
mov eax, edi
mov dword [esp + 0x18], edx
cdq
mov edi, eax
mov dword [esp + 0x10], edx
mov eax, ebx
mov ebx, dword [esp + 0x10]
cdq
add edi, eax
mov eax, esi
adc ebx, edx
cdq
cmp ebx, edx
jg 0x4d03e8
jl 0x4d03e4
cmp edi, eax
jae 0x4d03e8
mov edi, esi
jmp 0x4d040a
mov edx, dword [esp + 0x18]
cmp ebx, edx
jg 0x4d0400
jl 0x4d03fa
mov eax, dword [esp + 0x14]
cmp edi, eax
jae 0x4d0404
mov dword [esp + 0x20], ebx
jmp 0x4d040a
mov eax, dword [esp + 0x14]
mov edi, eax
mov dword [esp + 0x20], edx
test ecx, ecx
mov eax, 0x60f5ec
cmovne eax, dword [esp + 0x30]
sub edi, esi
lea edx, [eax + esi*2]
xor eax, eax
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x54], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
test edx, edx
je 0x4d0496
test edi, edi
jle 0x4d0496
cmp word [edx], ax
je 0x4d0496
lea eax, [edi + 1]
push eax
lea ecx, [esp + 0x58]
call fcn.0040ce40
mov eax, dword [esp + 0x58]
lea ebx, [eax + 1]
add ebx, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x58], ebx
cmp ebx, dword [esp + 0x5c]
jle 0x4d0476
push eax
lea ecx, [esp + 0x58]
call fcn.0040cde0
mov ebx, dword [esp + 0x58]
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x54]
lea eax, [edi + edi]
push eax
push dword [esp + 0x14]
push esi
call fcn.004263f0
add esp, 0xc
xor eax, eax
mov word [esi + ebx*2 - 2], ax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
lea ebx, [eax + 1]
test ecx, ecx
je 0x4d04be
lea eax, [ecx - 1]
jmp 0x4d04c0
xor eax, eax
test ebx, ebx
jns 0x4d04c8
xor edi, edi
jmp 0x4d04cf
cmp ebx, eax
mov edi, eax
cmovl edi, ebx
cdq
mov dword [esp + 0x14], eax
mov eax, ebx
mov dword [esp + 0x10], edx
cdq
mov ebx, eax
mov eax, edx
add ebx, 0x7fffffff
adc eax, 0
mov dword [esp + 0x60], eax
mov eax, edi
cdq
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x60]
cmp eax, edx
jg 0x4d0507
jl 0x4d0503
cmp ebx, dword [esp + 0x1c]
jae 0x4d0507
mov ebx, edi
jmp 0x4d0527
cmp eax, dword [esp + 0x10]
jg 0x4d0519
jl 0x4d0523
mov edx, dword [esp + 0x14]
cmp ebx, edx
jae 0x4d051d
jmp 0x4d0523
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebx, edx
mov dword [esp + 0x20], eax
test ecx, ecx
mov eax, 0x60f5ec
cmovne eax, dword [esp + 0x30]
sub ebx, edi
lea ecx, [eax + edi*2]
xor edi, edi
xor eax, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x44], eax
test ecx, ecx
je 0x4d05c3
test ebx, ebx
jle 0x4d05c3
cmp word [ecx], ax
je 0x4d05c3
lea eax, [ebx + 1]
push eax
lea ecx, [esp + 0x40]
call fcn.0040ce40
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x14], ecx
lea eax, [edx + 1]
add eax, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x40], eax
cmp eax, ecx
jle 0x4d05a1
push edx
lea ecx, [esp + 0x40]
call fcn.0040cde0
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x3c]
lea eax, [ebx + ebx]
push eax
push dword [esp + 0x20]
push edi
call fcn.004263f0
mov ebx, dword [esp + 0x1c]
add esp, 0xc
xor eax, eax
mov word [edi + ebx*2 - 2], ax
jmp 0x4d05c5
xor ebx, ebx
mov eax, dword [esp + 0x48]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
test eax, eax
je 0x4d05ee
push eax
call fcn.0043f8f0
add esp, 4
cmp dword [esp + 0x18], 1
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], eax
jle 0x4d084c
cmp dword [ebp + 4], 0
je 0x4d0614
mov eax, dword [ebp]
jmp 0x4d0619
mov eax, 0x60f5ec
push 1
push eax
push 0x633124
lea ecx, [esp + 0x54]
call fcn.00412320
test eax, eax
jne 0x4d0763
mov edi, dword [ebp + 4]
lea eax, [edi - 1]
neg edi
sbb edi, edi
xor ecx, ecx
and edi, eax
mov dword [esp + 0x14], ecx
xor ebx, ebx
mov dword [esp + 0x2c], ecx
xor edx, edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
lea eax, [edi + 3]
test eax, eax
jle 0x4d0675
push eax
lea ecx, [esp + 0x28]
call fcn.0040ce40
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], ecx
lea eax, [edi + 3]
add eax, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], eax
cmp eax, ecx
jle 0x4d06a4
push edx
lea ecx, [esp + 0x28]
call fcn.0040cde0
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [edi + edi]
mov dword [ebx], 0x220020
push eax
push dword [ebp]
lea eax, [ebx + 4]
push eax
call fcn.005f7171
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov edx, dword [esp + 0x20]
add esp, 0xc
mov word [ebx + edi*2 + 4], ax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov eax, ecx
neg eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ecx
sbb eax, eax
mov dword [esp + 0x78], edx
add eax, 2
add eax, ecx
cmp eax, edx
jle 0x4d0712
push eax
lea ecx, [esp + 0x74]
call fcn.0040ce40
push 1
push 0x6112e0
lea ecx, [esp + 0x78]
call fcn.0040edd0
mov ecx, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
lea eax, [ecx - 1]
mov dword [esp + 0x78], 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push edi
lea ecx, [esp + 0x50]
call fcn.0040edd0
test edi, edi
je 0x4d0763
push edi
call fcn.0043f8f0
add esp, 4
cmp dword [esp + 0x4c], 0
mov eax, 0x60f5ec
xorps xmm0, xmm0
mov dword [esp + 0x94], esi
cmovne eax, dword [esp + 0x48]
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], 1
mov dword [esp + 0xb0], 0
movups xmmword [esp + 0xa0], xmm0
test esi, esi
jne 0x4d07b3
call fcn.00609030
nop
int3
test eax, eax
jne 0x4d07be
call fcn.00609050
nop
int3
push 0
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004cb770
add esp, 0xc
cmp dword [esp + 0x1c], 0
je 0x4d0803
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4d07ed
push eax
call fcn.0043f8f0
add esp, 4
test esi, esi
je 0x4d0999
push esi
call fcn.0043f8f0
add esp, 4
jmp 0x4d0999
mov ebx, dword [esp + 0xfc]
test ebx, ebx
je 0x4d0848
push str.UrlFailed
push 0x628cc8
lea eax, [esp + 0xd8]
push str.Failed_launching_URL
push eax
call fcn.0043f090
add esp, 0x10
mov ecx, eax
call fcn.00476dc0
push eax
mov ecx, ebx
call fcn.00417ed0
lea ecx, [esp + 0xd0]
call fcn.00434fe0
mov edi, dword [esp + 0x48]
test edi, edi
je 0x4d0859
push edi
call fcn.0043f8f0
add esp, 4
test esi, esi
je 0x4d0866
push esi
call fcn.0043f8f0
add esp, 4
mov ebx, dword [esp + 0xfc]
push 1
push str.http:__
mov ecx, ebp
call fcn.00413630
test al, al
jne 0x4d0895
push 1
push str.https:__
mov ecx, ebp
call fcn.00413630
test al, al
je 0x4d0999
cmp dword [ebp + 4], 0
je 0x4d08a0
mov eax, dword [ebp]
jmp 0x4d08a5
mov eax, 0x60f5ec
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test ebx, ebx
je 0x4d0999
cmp eax, 0x20
jg 0x4d0907
push str.UrlFailed
push 0x628cc8
lea eax, [esp + 0xf0]
push str.Failed_launching_URL
push eax
call fcn.0043f090
add esp, 0x10
mov ecx, eax
call fcn.00476dc0
push eax
lea ecx, [esp + 0xe0]
call fcn.00416e30
mov esi, dword [esp + 0x88]
mov ebx, 3
jmp 0x4d0928
xor esi, esi
lea eax, [esp + 0x88]
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], esi
lea ebx, [esi + 4]
mov ecx, dword [esp + 0xfc]
push eax
call fcn.004145d0
test bl, 4
je 0x4d094a
and ebx, 0xfffffffb
test esi, esi
je 0x4d094a
push esi
call fcn.0043f8f0
add esp, 4
test bl, 2
je 0x4d0966
mov eax, dword [esp + 0xdc]
and ebx, 0xfffffffd
test eax, eax
je 0x4d0966
push eax
call fcn.0043f8f0
add esp, 4
test bl, 1
je 0x4d0999
mov esi, dword [esp + 0xec]
test esi, esi
je 0x4d0999
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4d0999
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4d0999
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov eax, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x4d09ae
push eax
call fcn.0043f8f0
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4d09bf
push eax
call fcn.0043f8f0
add esp, 4
add esp, 0xe4
ret