Function at 0x4ebcc8
Capabilities:
Create process on windows
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x4ebcd0
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ec7ad
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x4ec746
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp word [ebx + 0x81e], 1
jne 0x4ec72c
cmp edx, 1
jne 0x4ebdf0
mov eax, dword [ebx + 0x374]
cmp byte [eax + 0x57], 0
jne 0x4ec73c
mov dword [ebx + 0x6a4], 1
mov byte [ebx + 0x686], 1
mov eax, dword [ebx + 0x4c0]
mov edx, 0x4ec7c0
call fcn.004813b4
mov eax, dword [ebx + 0x4c4]
mov edx, 0x4ec7c0
call fcn.004813b4
mov eax, dword [ebx + 0x488]
xor edx, edx
call fcn.0044e1c0
mov eax, dword [ebx + 0x370]
xor edx, edx
call fcn.0044e1c0
mov eax, dword [ebx + 0x374]
mov dl, 1
call fcn.0044e1c0
mov byte [ebx + 0x828], 0
xor eax, eax
mov dword [ebx + 0x6a8], eax
xor eax, eax
mov dword [ebx + 0x6ac], eax
mov eax, dword [ebx + 0x534]
xor edx, edx
call fcn.0043caf8
lea eax, [ebx + 0x690]
mov edx, 0x4ec7e0
call fcn.00404c70
mov byte [ebx + 0x684], 1
push 0x4ec7ec
push dword [ebx + 0x690]
push 0x4ec7fc
push dword [ebx + 0x694]
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404fb0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x680]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebx + 0x684], 0
jmp 0x4ec73c
cmp edx, 2
jne 0x4ebe0a
push 0x4ec808
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
jmp 0x4ec73c
cmp edx, 3
jne 0x4ebf97
push 0x4ec848
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4ebe38
push 0x4ec86c
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
jmp 0x4ec73c
mov eax, dword [ebx + 0x848]
mov edx, 0x4ec8a0
call fcn.00405044
jne 0x4ebe75
push dword [ebx + 0x838]
push 0x4ec8ac
push dword [ebx + 0x83c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404fb0
mov edx, dword [ebp - 8]
mov eax, 0x4ec8b8
call fcn.004df1c4
mov dword [ebx + 0x6a4], 3
mov dx, 6
mov eax, ebx
call fcn.004f2a24
mov eax, dword [ebx + 0x488]
mov dl, 1
call fcn.0044e1c0
push 5
lea edx, [ebp - 0x10]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040a3d0
mov eax, dword [ebp - 0xc]
call fcn.004050ac
push eax
push dword [ebx + 0x794]
push 0x4ec8e0
push dword [ebx + 0x730]
push 0x4ec8f0
push dword [ebx + 0x734]
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404fb0
mov eax, dword [ebp - 0x14]
call fcn.004050ac
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0040a3d0
lea eax, [ebp - 0x18]
mov edx, 0x4ec900
call fcn.00404ee8
mov eax, dword [ebp - 0x18]
call fcn.004050ac
push eax
push 0
mov eax, dword [0x500168]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.00456384
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebx + 0x488]
xor edx, edx
call fcn.0044e1c0
lea eax, [ebx + 0x690]
mov edx, 0x4ec914
call fcn.00404c70
mov byte [ebx + 0x684], 1
push 0x4ec7ec
push dword [ebx + 0x690]
push 0x4ec920
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404fb0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x680]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebx + 0x684], 0
mov byte [ebx + 0x686], 1
jmp 0x4ec73c
cmp edx, 4
jne 0x4ec124
push 0x4ec924
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4ebfc5
push 0x4ec944
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
jmp 0x4ec73c
mov eax, dword [ebx + 0x848]
mov edx, 0x4ec8a0
call fcn.00405044
jne 0x4ec002
push dword [ebx + 0x838]
push 0x4ec8ac
push dword [ebx + 0x83c]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404fb0
mov edx, dword [ebp - 0x24]
mov eax, 0x4ec8b8
call fcn.004df1c4
mov dword [ebx + 0x6a4], 4
mov dx, 6
mov eax, ebx
call fcn.004f2a24
mov eax, dword [ebx + 0x488]
mov dl, 1
call fcn.0044e1c0
push 5
lea edx, [ebp - 0x2c]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0040a3d0
mov eax, dword [ebp - 0x28]
call fcn.004050ac
push eax
push dword [ebx + 0x7c4]
push 0x4ec97c
push dword [ebx + 0x738]
push 0x4ec97c
push dword [ebx + 0x73c]
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00404fb0
mov eax, dword [ebp - 0x30]
call fcn.004050ac
push eax
lea edx, [ebp - 0x38]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0040a3d0
lea eax, [ebp - 0x34]
mov edx, 0x4ec988
call fcn.00404ee8
mov eax, dword [ebp - 0x34]
call fcn.004050ac
push eax
push 0
mov eax, dword [0x500168]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.00456384
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebx + 0x488]
xor edx, edx
call fcn.0044e1c0
lea eax, [ebx + 0x690]
mov edx, 0x4ec99c
call fcn.00404c70
mov byte [ebx + 0x684], 1
push 0x4ec7ec
push dword [ebx + 0x690]
push 0x4ec920
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404fb0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebx + 0x680]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebx + 0x684], 0
mov byte [ebx + 0x686], 1
jmp 0x4ec73c
cmp edx, 5
jne 0x4ec1ff
push 0x4ec9a0
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4ec152
push 0x4ec9b8
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
jmp 0x4ec73c
mov eax, dword [ebx + 0x848]
mov edx, 0x4ec8a0
call fcn.00405044
jne 0x4ec18f
push dword [ebx + 0x838]
push 0x4ec8ac
push dword [ebx + 0x83c]
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.00404fb0
mov edx, dword [ebp - 0x40]
mov eax, 0x4ec8b8
call fcn.004df1c4
mov dword [ebx + 0x6a4], 5
mov dx, 6
mov eax, ebx
call fcn.004f2a24
mov eax, dword [ebx + 0x560]
mov edx, 0x4ec7c0
call fcn.004813b4
lea eax, [ebp - 0x44]
mov edx, dword [ebx + 0x7d0]
call fcn.00405558
mov edx, dword [ebp - 0x44]
mov eax, dword [ebx + 0x560]
call fcn.004813b4
mov eax, dword [ebx + 0x488]
mov dl, 1
call fcn.0044e1c0
xor eax, eax
mov dword [ebx + 0x6a8], eax
xor eax, eax
mov dword [ebx + 0x6ac], eax
mov eax, dword [ebx + 0x534]
mov dl, 1
call fcn.0043caf8
jmp 0x4ec73c
cmp edx, 6
jne 0x4ec2db
push 0x4ec9dc
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4ec22d
push 0x4ec9f4
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
jmp 0x4ec73c
push 5
lea edx, [ebp - 0x4c]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.0040a3d0
mov eax, dword [ebp - 0x48]
call fcn.004050ac
push eax
push dword [ebx + 0x6b8]
push 0x4ec97c
push dword [ebx + 0x6bc]
push 0x4ec97c
push dword [ebx + 0x740]
push 0x4ec97c
push dword [ebx + 0x744]
lea eax, [ebp - 0x50]
mov edx, 7
call fcn.00404fb0
mov eax, dword [ebp - 0x50]
call fcn.004050ac
push eax
lea edx, [ebp - 0x58]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.0040a3d0
lea eax, [ebp - 0x54]
mov edx, 0x4eca20
call fcn.00404ee8
mov eax, dword [ebp - 0x54]
call fcn.004050ac
push eax
push 0
mov eax, dword [0x500168]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.00456384
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4ec73c
cmp edx, 7
jne 0x4ec38c
lea eax, [ebx + 0x690]
mov edx, 0x4eca34
call fcn.00404c70
mov byte [ebx + 0x684], 1
push 0x4ec7ec
push dword [ebx + 0x690]
push 0x4ec920
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00404fb0
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebx + 0x680]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebx + 0x684], 0
mov dx, 0xc
mov eax, ebx
call fcn.004f2a24
push dword [ebx + 0x7ac]
push 0x4ec8e0
push dword [ebx + 0x76c]
push 0x4ec8f0
push dword [ebx + 0x770]
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.00404fb0
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
call fcn.00405558
mov edx, dword [ebp - 0x60]
mov eax, dword [ebx + 0x66c]
call fcn.004813b4
mov eax, dword [ebx + 0x66c]
mov dl, 1
call fcn.0049bf7c
jmp 0x4ec73c
cmp edx, 8
jne 0x4ec468
push 0x4ec9dc
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4ec3ba
push 0x4ec9f4
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
jmp 0x4ec73c
push 5
lea edx, [ebp - 0x6c]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.0040a3d0
mov eax, dword [ebp - 0x68]
call fcn.004050ac
push eax
push dword [ebx + 0x6b8]
push 0x4ec97c
push dword [ebx + 0x6bc]
push 0x4ec97c
push dword [ebx + 0x740]
push 0x4ec97c
push dword [ebx + 0x744]
lea eax, [ebp - 0x70]
mov edx, 7
call fcn.00404fb0
mov eax, dword [ebp - 0x70]
call fcn.004050ac
push eax
lea edx, [ebp - 0x78]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.0040a3d0
lea eax, [ebp - 0x74]
mov edx, 0x4eca20
call fcn.00404ee8
mov eax, dword [ebp - 0x74]
call fcn.004050ac
push eax
push 0
mov eax, dword [0x500168]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.00456384
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4ec73c
cmp edx, 9
jne 0x4ec54e
push 0x4eca38
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4ec496
push 0x4eca58
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
jmp 0x4ec73c
mov eax, dword [ebx + 0x848]
mov edx, 0x4ec8a0
call fcn.00405044
jne 0x4ec4d3
push dword [ebx + 0x838]
push 0x4ec8ac
push dword [ebx + 0x83c]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00404fb0
mov edx, dword [ebp - 0x7c]
mov eax, 0x4ec8b8
call fcn.004df1c4
xor eax, eax
mov dword [ebx + 0x6a8], eax
xor eax, eax
mov dword [ebx + 0x6ac], eax
cmp dword [ebx + 0x6b0], 0
jne 0x4ec4f8
mov dword [ebx + 0x6b0], 1
jmp 0x4ec4fe
inc dword [ebx + 0x6b0]
mov dword [ebx + 0x6a4], 9
mov dx, 7
mov eax, ebx
call fcn.004f2a24
mov eax, dword [ebx + 0x488]
mov dl, 1
call fcn.0044e1c0
lea eax, [ebp - 0x80]
mov edx, dword [ebx + 0x7dc]
call fcn.00405558
mov edx, dword [ebp - 0x80]
mov eax, dword [ebx + 0x55c]
call fcn.004813b4
mov eax, dword [ebx + 0x534]
mov dl, 1
call fcn.0043caf8
jmp 0x4ec73c
cmp edx, 0xa
jne 0x4ec568
push 0x4eca8c
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
jmp 0x4ec73c
cmp edx, 0xb
jne 0x4ec73c
push 0x4ecab4
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4ec596
push 0x4ecad4
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
jmp 0x4ec73c
mov eax, dword [ebx + 0x848]
mov edx, 0x4ec8a0
call fcn.00405044
jne 0x4ec5d9
push dword [ebx + 0x838]
push 0x4ec8ac
push dword [ebx + 0x83c]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00404fb0
mov edx, dword [ebp - 0x84]
mov eax, 0x4ec8b8
call fcn.004df1c4
mov eax, dword [ebx + 0x56c]
mov dl, 1
call fcn.0043caf8
mov dword [ebx + 0x6a4], 0xb
mov dx, 6
mov eax, ebx
call fcn.004f2a24
mov eax, dword [ebx + 0x488]
mov dl, 1
call fcn.0044e1c0
push 5
lea edx, [ebp - 0x8c]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.0040a3d0
mov eax, dword [ebp - 0x88]
call fcn.004050ac
push eax
push dword [ebx + 0x7e8]
push 0x4ec97c
push dword [ebx + 0x784]
push 0x4ec97c
push dword [ebx + 0x788]
lea eax, [ebp - 0x90]
mov edx, 5
call fcn.00404fb0
mov eax, dword [ebp - 0x90]
call fcn.004050ac
push eax
lea edx, [ebp - 0x98]
mov eax, dword [0x500168]
mov eax, dword [eax]
call fcn.0046dbac
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.0040a3d0
lea eax, [ebp - 0x94]
mov edx, 0x4ecb00
call fcn.00404ee8
mov eax, dword [ebp - 0x94]
call fcn.004050ac
push eax
push 0
mov eax, dword [0x500168]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.00456384
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebx + 0x488]
xor edx, edx
call fcn.0044e1c0
lea eax, [ebx + 0x690]
mov edx, 0x4ecb14
call fcn.00404c70
mov byte [ebx + 0x684], 1
push 0x4ec7ec
push dword [ebx + 0x690]
push 0x4ec920
lea eax, [ebp - 0x9c]
mov edx, 3
call fcn.00404fb0
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebx + 0x680]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebx + 0x684], 0
mov byte [ebx + 0x686], 1
jmp 0x4ec73c
push 0x4ecb20
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004eb868
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ec750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec7b4
lea eax, [ebp - 0x9c]
mov edx, 7
call fcn.00404c40
lea eax, [ebp - 0x80]
call fcn.004053fc
lea eax, [ebp - 0x7c]
mov edx, 7
call fcn.00404c40
lea eax, [ebp - 0x60]
call fcn.004053fc
lea eax, [ebp - 0x5c]
mov edx, 6
call fcn.00404c40
lea eax, [ebp - 0x44]
call fcn.004053fc
lea eax, [ebp - 0x40]
mov edx, 0x10
call fcn.00404c40
ret