Function at 0x475148
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004045cc
xor eax, eax
push ebp
push 0x475639
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47560f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x215]
mov edx, dword [ebp - 4]
call fcn.00408d80
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402938
lea eax, [ebp - 0x315]
mov edx, dword [ebp - 8]
call fcn.00408d80
lea eax, [ebp - 0x35c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402dc4
mov dword [ebp - 0x35c], 0x44
mov dword [ebp - 0x330], 1
mov word [ebp - 0x32c], bx
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x35c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x215]
push eax
mov eax, dword [0x479414]
mov eax, dword [eax]
call fcn.004045dc
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x475218
xor ebx, ebx
call fcn.00403be8
jmp 0x47561e
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x479464]
mov edx, dword [ebp - 0x364]
mov dword [eax], edx
mov eax, dword [0x4794cc]
mov edx, dword [ebp - 0x36c]
mov dword [eax], edx
mov eax, dword [0x479464]
mov eax, dword [eax]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4755e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4792c0]
mov eax, dword [eax]
cmp eax, 0x19
ja case.0x475271.0
jmp dword [eax*4 + 0x475278]
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x414f00
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4155e0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x410520
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x41bf90
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x413f80
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4130e0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4141d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x41df20
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4501f0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x41c5d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x412f90
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x414d40
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x412b10
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4174c0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4157d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x417100
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x416f80
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x415ec0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x41b3a0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x41c510
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4145d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4153b0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x416c20
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x490800
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
jmp case.0x475271.0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4158d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadProcessMemory
cmp dword [ebp - 0x14], 0xf0818b
jne 0x4755c8
mov eax, dword [0x47924c]
mov byte [eax], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4755f0
mov eax, dword [0x4793a8]
mov eax, dword [eax]
call fcn.00456e84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475253
push 0x3e8
mov eax, dword [ebp - 0x36c]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475616
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475640
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404140
ret