Function at 0x5b7770
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7176b8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00429050
push str.Progid
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.00428840
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00428840
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push SysReAllocStringLen
call fcn.005b6400
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00428810
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00428810
mov edi, dword [ebp + 8]
test esi, esi
je 0x5b79ad
push str._shellopencommand
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00428bd0
push 0x790eb0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00428840
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push SysReAllocStringLen
call fcn.005b6400
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00428810
test esi, esi
je 0x5b79a1
lea ecx, [ebp - 0x14]
call fcn.00429050
push 0x7890fc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.00429b00
test eax, eax
jle 0x5b7898
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.004289a0
push edi
push 0x7890fc
lea ecx, [ebp - 0x14]
call fcn.00429560
jmp 0x5b7926
push 0x789108
lea ecx, [ebp - 0x10]
call fcn.00429b00
test eax, eax
jle 0x5b78c5
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.004289a0
push edi
push 0x789108
lea ecx, [ebp - 0x14]
call fcn.00429560
jmp 0x5b7926
push edi
lea ecx, [ebp - 0x24]
call fcn.00428840
mov esi, eax
push 0x783bbc
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00428bd0
push esi
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 7
push eax
call fcn.00428b20
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.004289a0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.00428810
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.00428810
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.00428810
push 0x40
lea eax, [ebp - 0x74]
mov dword [ebp - 0x78], 0
push 0
push eax
call fcn.006b47d0
add esp, 0xc
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x14]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.00429100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x5b7995
push dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00428810
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00428810
mov esi, 1
jmp 0x5b79b8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00428810
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00428810
push edi
call fcn.005b79e0
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret