Function at 0x4b87f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6e12b0]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [0x6de9b8]
cmp eax, 3
ja case.default.0x4b8820
jmp dword [eax*4 + 0x4b8b7c]
push 0
mov byte [esi + 0x971], 1
mov ecx, 0x6ca988
push dword [0x6e2098]
call fcn.00441250
mov byte [edi + 0x28649], 0
mov byte [edi + 0x2868a], 0
mov byte [0x6e207c], 1
jmp 0x4b8953
push 0
push 0x1c
call fcn.005196ce
add esp, 8
test eax, eax
jne 0x4b888b
push eax
push 0xf
call fcn.005196ce
add esp, 8
test eax, eax
jne 0x4b888b
mov ecx, 0x6ca988
call fcn.00441030
cmp al, 0xd
jne case.default.0x4b8820
mov byte [esi + 0x971], 2
mov byte [0x6e207c], 1
jmp 0x4b8953
push 0
push 0x1c
call fcn.005196ce
add esp, 8
test eax, eax
jne 0x4b88cb
push eax
push 0xf
call fcn.005196ce
add esp, 8
test eax, eax
jne 0x4b88cb
mov ecx, 0x6ca988
call fcn.00441030
cmp al, 0xd
jne case.default.0x4b8820
mov al, byte [0x6e12ee]
or al, byte [0x6e12e2]
je 0x4b88e8
mov byte [esi + 0x971], 1
mov byte [0x6e207c], 1
jmp 0x4b8953
mov word [esi + 0x970], 0x302
mov byte [0x6e207c], 1
jmp 0x4b8953
push 0
push 0x1c
call fcn.005196ce
add esp, 8
test eax, eax
jne 0x4b8927
push eax
push 0xf
call fcn.005196ce
add esp, 8
test eax, eax
jne 0x4b8927
mov ecx, 0x6ca988
call fcn.00441030
cmp al, 0xd
jne case.default.0x4b8820
mov al, byte [0x6e12ee]
or al, byte [0x6e12e2]
setne al
inc al
mov byte [esi + 0x971], al
mov byte [0x6e207c], 1
jmp 0x4b8953
cmp byte [0x6e207c], 1
jne 0x4b8b65
movzx eax, byte [esi + 0x971]
sub eax, 1
je 0x4b89a0
sub eax, 1
jne 0x4b89fe
push eax
push 1
push 0x20
lea eax, [edi + 0x2868a]
mov ecx, 0x6ca988
push eax
push 0x1a2
push 0x1ce
call fcn.004417e0
push 0x1e
mov ecx, 0x6ca988
call fcn.004412a0
mov dword [0x6de9b8], 2
jmp 0x4b89e9
push 0
push 0
push 0x40
lea eax, [edi + 0x28649]
mov ecx, 0x6ca988
push eax
push 0x17c
push 0x1ce
call fcn.004417e0
push 0x1e
mov ecx, 0x6ca988
call fcn.004412a0
push 0
push dword [0x6e2098]
mov ecx, 0x6ca988
call fcn.00441250
mov dword [0x6de9b8], 1
mov byte [0x6e207e], 0
mov byte [0x6e207d], 0
mov byte [0x6e207c], 0
movzx eax, byte [esi + 0x970]
sub eax, 1
je 0x4b8af3
sub eax, 1
je 0x4b8a28
sub eax, 1
jne 0x4b8b65
mov byte [0x5c3c60], 1
jmp 0x4b8b50
cmp byte [edi + 0x28649], 0
lea eax, [edi + 0x28649]
jne 0x4b8a6d
push 0
push 0
push 0x40
push eax
push 0x17c
push 0x1ce
mov ecx, 0x6ca988
call fcn.004417e0
push 0x1e
mov ecx, 0x6ca988
call fcn.004412a0
mov dword [0x6de9b8], 1
jmp 0x4b8b50
cmp byte [edi + 0x2868a], 0
push ebx
lea ebx, [edi + 0x2868a]
jne 0x4b8a84
mov ecx, 0x6ca988
jmp 0x4b8a9d
push 4
push str.ymir
push ebx
call fcn.005294d0
add esp, 0xc
mov ecx, 0x6ca988
test eax, eax
jne 0x4b8acf
push 0
push 1
push 0x20
push ebx
push 0x1a2
push 0x1ce
call fcn.004417e0
push 0x1e
mov ecx, 0x6ca988
call fcn.004412a0
mov dword [0x6de9b8], 2
pop ebx
jmp 0x4b8b50
call fcn.00440fd0
mov ecx, esi
call fcn.0048c130
push 1
push 2
mov ecx, edi
mov dword [0x6de9b8], 0
call fcn.00470d30
pop ebx
jmp 0x4b8b50
push 0x40
lea eax, [ebp - 0x44]
push eax
push str.NEW_ACCOUNT_URL
call fcn.00446910
add esp, 0xc
test al, al
jne 0x4b8b2b
push str.LOCALE_ERROR:_NEW_ACCOUNT_URL
call fcn.00521c08
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret 4
push 3
push 0
push 0
lea eax, [ebp - 0x44]
push eax
push str.open
push dword [0x6e2098]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x6ca988
call fcn.00440fd0
mov byte [0x6e207c], 0
mov byte [0x6e207d], 0
mov byte [0x6e207e], 0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0052388c
mov esp, ebp
pop ebp
ret 4