Function at 0x4cd5d8
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xe4
mov eax, 0x5f47fe
call fcn.0059bbd7
mov edi, edx
mov esi, ecx
push 0x633d40
lea ecx, [ebp - 0x70]
call fcn.0040b0d5
xor ebx, ebx
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.004c9bd2
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.0040b67e
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
mov eax, esi
cmovae ecx, dword [ebp - 0x40]
cmp dword [esi + 0x14], 8
jb 0x4cd629
mov eax, dword [esi]
push ecx
push eax
push 0x939
push str.LaunchBrowserCommon
push str.__s__d___LaunchBrowser_szCmd___s_szExePath___s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4cd81b
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
call fcn.004ccd08
test eax, eax
je 0x4cd81b
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xa0]
push 0x6360f8
push eax
call fcn.00445efc
add esp, 0xc
push 0x65cad8
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x88]
call fcn.0041152a
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00411504
mov byte [ebp - 0xa4], bl
lea ecx, [ebp - 0x58]
push dword [ebp - 0xa4]
mov dword [ebp - 0x48], ebx
push eax
mov dword [ebp - 0x44], ebx
call fcn.0040b632
lea ecx, [ebp - 0x88]
call fcn.0040b67e
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 7
call fcn.0040b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.sftldr_wow64.dll
call esi
test eax, eax
jne 0x4cd7c7
push str.sftldr.dll
call esi
test eax, eax
jne 0x4cd7c7
call fcn.004cd54c
test al, al
jne 0x4cd7c7
push 0x94a
mov edi, str.LaunchBrowserCommon
push edi
push str.__s__d___Not_NeedEscapeJob_____
call fcn.0040a649
add esp, 0xc
lea eax, [ebp - 0xf0]
push 0x44
pop esi
push esi
push ebx
push eax
call fcn.005b24a0
xor eax, eax
mov dword [ebp - 0xf0], esi
inc eax
mov dword [ebp - 0xe8], str.Default
add esp, 0xc
mov dword [ebp - 0xc4], eax
mov word [ebp - 0xc0], ax
lea edi, [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0x20]
cmp dword [ebp - 0x44], 8
push ecx
stosd dword es:[edi], eax
lea ecx, [ebp - 0xf0]
push ecx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4cd7b2
push ebx
push str.360se6_Frame
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x4cd7b2
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
xor ebx, ebx
inc ebx
jmp 0x4cd80e
push 0x93e
mov edi, str.LaunchBrowserCommon
push edi
push str.__s__d___NeedEscapeJob_____
call fcn.0040a649
add esp, 0xc
mov dword [ebp - 0xa4], ebx
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0x58]
call fcn.0043d474
test al, al
jne 0x4cd80c
push 0x942
push edi
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
jmp 0x4cd80e
mov bl, 1
lea ecx, [ebp - 0x58]
call fcn.0040b67e
jmp 0x4cd8d1
test edi, edi
je 0x4cd8cf
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4cd82d
mov eax, dword [esi]
push eax
push 0x968
mov edi, str.LaunchBrowserCommon
push edi
push str.__s__d___LaunchBrowser_open_url_szCmd___s
call fcn.0040a649
add esp, 0x10
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], ebx
push esi
call fcn.0040b155
push 0x656264
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 8
call fcn.0040b0d5
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x28]
call fcn.004e1190
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 8
call fcn.0040b67e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x96b
push edi
push str.__s__d___RemoveSubstring_open_url_strCmd___s
call fcn.0040a649
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push 1
push ebx
push ebx
push eax
push 0x63afc8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x28]
call fcn.0040b67e
xor ebx, ebx
inc ebx
jmp 0x4cd8d1
mov bl, 1
lea ecx, [ebp - 0x40]
call fcn.0040b67e
mov al, bl
call fcn.0059bb81
ret