Function at 0x47ed3c
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00403ddc
mov eax, dword [ebp - 8]
call fcn.00403ddc
mov eax, dword [ebp + 0x10]
call fcn.00403ddc
mov eax, dword [ebp + 0xc]
call fcn.00403ddc
mov eax, dword [ebp + 8]
call fcn.00403ddc
xor eax, eax
push ebp
push 0x47f053
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004080cc
test al, al
jne 0x47edbb
push 0
mov cx, word [0x47f064]
mov dl, 1
mov eax, 0x47f070
call fcn.0045061c
jmp 0x47f00e
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.00402b9c
lea eax, [ebp - 0x70]
xor ecx, ecx
mov edx, 0x10
call fcn.00402b9c
mov dword [ebp - 0x60], 0x44
push 0x47f0a0
push dword [ebp - 8]
push 0x47f0b0
push dword [ebp + 0x10]
push 0x47f0c0
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403ce8
cmp dword [ebp + 8], 0
je 0x47ee23
push dword [ebp - 0x18]
push 0x47f0d0
push dword [ebp + 8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403ce8
push 0x14
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov ebx, eax
push 1
push ebx
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push ebx
call sub.advapi32.dll_SetSecurityDescriptorOwner
push 0
push 0
push ebx
call sub.advapi32.dll_SetSecurityDescriptorGroup
mov edi, 8
push edi
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov esi, eax
test esi, esi
je 0x47ee7b
push 2
push edi
push esi
call sub.advapi32.dll_InitializeAcl
test eax, eax
je 0x47ee7b
push 0
push esi
push 0xffffffffffffffff
push ebx
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0x7c], 0xc
mov dword [ebp - 0x78], ebx
xor eax, eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 4]
call fcn.004082f0
mov eax, dword [ebp - 0x80]
call fcn.00403dec
push eax
push 0
push 0x224
push 0
push 0
lea eax, [ebp - 0x7c]
push eax
push 0x47f0e0
push dword [ebp - 4]
push 0x47f0e0
push dword [ebp - 0x18]
lea eax, [ebp - 0x84]
mov edx, 4
call fcn.00403ce8
mov eax, dword [ebp - 0x84]
call fcn.00403dec
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 9], al
push esi
call sub.kernel32.dll_LocalFree_1
push ebx
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapFree
cmp byte [ebp - 9], 0
jne 0x47ef25
push 0
mov cx, word [0x47f064]
mov dl, 1
mov eax, 0x47f0ec
call fcn.0045061c
jmp 0x47f00e
push 0
call fcn.0047ffc3
shr eax, 0x1f
jne 0x47ef36
call fcn.0047ecd0
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 4]
call fcn.004082f0
mov edx, dword [ebp - 0x80]
lea eax, [ebp - 0x1c]
mov ecx, 0x47f108
call fcn.00403c74
mov eax, dword [ebp - 0x1c]
call fcn.00403c28
mov edx, eax
inc edx
lea eax, [ebp - 0x1c]
call fcn.00403f58
mov eax, dword [ebp - 0x1c]
call fcn.00403c28
mov ebx, eax
lea eax, [ebp - 0x1c]
call fcn.00403df8
mov byte [eax + ebx - 1], 0
push 4
push 0x1000
push 0x104
push 0
mov eax, dword [ebp - 0x70]
push eax
call fcn.0047ffcd
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00403c28
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00403dec
push eax
push ebx
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_WriteProcessMemory
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
push 0x47f114
push 0x47f124
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
push eax
push 0
push 0
mov eax, dword [ebp - 0x70]
push eax
call fcn.00480295
mov esi, eax
push 0x7d0
push esi
call sub.kernel32.dll_WaitForSingleObject
push esi
call sub.kernel32.dll_CloseHandle_1
push 0x8000
push 0x104
push ebx
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_VirtualFreeEx
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_ResumeThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f05a
lea eax, [ebp - 0x84]
mov edx, 2
call fcn.004039d0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004039d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004039d0
lea eax, [ebp + 8]
mov edx, 3
call fcn.004039d0
ret