Function at 0x47e02b
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp + 0x14]
lea edi, [ebp - 4]
or dword [ebp - 4], 0xffffffff
mov edx, eax
push 2
push 1
mov ecx, dword [esi]
xor ebx, ebx
mov eax, ecx
mov dword [ebp - 0xc], ebx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
push ebx
push edi
mov eax, dword [eax*4 + 0x4f0ce0]
push edx
push dword [eax + ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x47e28c
push dword [esi]
call fcn.004b3062
push dword [ebp + 0xc]
or dword [esi], 0xffffffff
push dword [esi + 4]
call fcn.004b9f8e
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x14], edi
test edi, edi
je 0x47e28c
push ebx
call fcn.0047ec90
mov esi, eax
pop ecx
test esi, esi
jne 0x47e0b9
push edi
call fcn.0047907e
pop ecx
jmp 0x47e28c
push 0x4dbed8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ebx
push eax
call fcn.004780de
add esp, 0xc
test eax, eax
je 0x47e0dd
cmp eax, 0x16
je 0x47e2eb
jmp 0x47e0e7
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x47e0ee
mov dword [ebp - 8], 0x4dbeb0
xor eax, eax
push 0x44
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0046c480
mov ecx, dword [0x4f0ce0]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x44], 0x100
jne 0x47e121
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
jmp 0x47e130
cmp dword [ebp + 0x10], 1
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
je 0x47e133
mov eax, dword [ecx + 0x50]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 0x88]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x30], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc]
jne 0x47e145
sub ecx, edx
mov edx, str.__c
sar ecx, 1
lea eax, [edx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0xc]
jne 0x47e160
mov edi, dword [ebp + 8]
sub edx, dword [ebp - 0x10]
sar edx, 1
lea eax, [edi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [edi]
add edi, 2
cmp ax, word [ebp - 0xc]
jne 0x47e17a
mov eax, edi
mov dword [ebp - 0x10], edi
sub eax, dword [ebp - 0x1c]
inc edx
sar eax, 1
add eax, ecx
add eax, edx
push 2
push eax
mov dword [ebp - 0x10], eax
call fcn.004ae807
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
test eax, eax
jne 0x47e1cf
xor eax, eax
push eax
call fcn.004ae86a
push ebx
call fcn.004ae86a
xor eax, eax
push edi
mov dword [esi + 4], eax
mov dword [esi], eax
call fcn.0047907e
add esp, 0xc
jmp 0x47e28c
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call fcn.004b1d06
add esp, 0xc
test eax, eax
jne 0x47e2e2
push str.__c
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.004b958c
add esp, 0xc
test eax, eax
jne 0x47e2e2
push dword [ebp + 8]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.004b958c
add esp, 0xc
test eax, eax
jne 0x47e2e2
push dword [ebp - 8]
call fcn.0047e5fd
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x47e22e
push dword [ebp - 0xc]
jmp 0x47e1af
mov eax, ecx
lea edi, [ebp - 0x2c]
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
and eax, ecx
mov dword [ebp - 0x10], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x70]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x47e2a2
push dword [ebp - 0x10]
call fcn.004ae86a
push edi
call fcn.004ae86a
push ebx
call fcn.004ae86a
mov edi, dword [ebp - 0x14]
xor eax, eax
push edi
mov dword [esi + 4], eax
mov dword [esi], eax
call fcn.0047907e
add esp, 0x10
cmp dword [ebp - 4], 0xffffffff
je 0x47e29b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov dword [esi + 4], eax
mov dword [esi], edi
call fcn.004ae86a
push dword [ebp - 0xc]
call fcn.004ae86a
push ebx
call fcn.004ae86a
add esp, 0xc
cmp dword [ebp - 4], 0xffffffff
je 0x47e2de
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x47e29d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x47e2f0
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004ae786
int3