Function at 0x647a88
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x294], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
lea eax, [ebp - 0x278]
mov edx, dword [0x41f3b0]
call fcn.0040c7ac
xor eax, eax
push ebp
push 0x647d7d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x27c]
mov eax, dword [ebp - 4]
call fcn.00431290
mov edx, dword [ebp - 0x27c]
lea eax, [ebp - 4]
call fcn.0040b89c
lea eax, [ebp - 0x280]
mov ecx, 0x647d98
mov edx, dword [ebp - 4]
call fcn.0040c260
mov eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00428f70
test eax, eax
jne 0x647d1a
mov eax, dword [ebp - 0x264]
mov edx, 0x647db0
call fcn.0040c398
je 0x647cfc
mov eax, dword [ebp - 0x264]
mov edx, 0x647dc0
call fcn.0040c398
je 0x647cfc
mov eax, dword [ebp - 0x268]
and eax, 0x10
cmp eax, 0x10
je 0x647cd3
xor eax, eax
push ebp
push 0x647cc7
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x647dd4
push dword [ebp - 0x264]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x284]
call fcn.00429000
test al, al
jne 0x647cbd
mov eax, dword [ebp - 0x264]
mov edx, 0x647de4
call fcn.0040c398
jne 0x647be9
push 0
push 0
push 0x647dfc
push 0x647e40
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep
jmp 0x647c25
mov eax, dword [ebp - 0x268]
and eax, 1
dec eax
jne 0x647c25
push dword [ebp - 4]
push 0x647dd4
push dword [ebp - 0x264]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x288]
mov cl, 1
mov edx, 0x80
call fcn.00428dec
push dword [ebp - 4]
push 0x647dd4
push dword [ebp - 0x264]
lea eax, [ebp - 0x28c]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x28c]
call fcn.00429000
test al, al
jne 0x647cbd
cmp dword [0x68a254], 0
je 0x647cbd
mov dl, 1
mov eax, dword [0x68a254]
call fcn.00428a3c
test al, al
je 0x647cbd
xor ebx, ebx
jmp 0x647ca8
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
push 0x1f4
call sub.kernel32.dll_Sleep
inc ebx
mov eax, dword [0x68a254]
call fcn.0040bffc
mov edx, eax
lea eax, [ebp - 0x290]
call fcn.0040c05c
mov eax, dword [ebp - 0x290]
call fcn.00429000
mov dl, 1
mov eax, dword [0x68a254]
call fcn.00428a3c
test al, al
je 0x647cbd
cmp ebx, 4
jl 0x647c6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x647cfc
push dword [ebp - 4]
push 0x647dd4
push dword [ebp - 0x264]
lea eax, [ebp - 0x294]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x294]
call fcn.00647a88
lea eax, [ebp - 0x278]
call fcn.00428fc0
test eax, eax
je 0x647b37
lea eax, [ebp - 0x278]
call fcn.00428fe4
xor eax, eax
push ebp
push 0x647d3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00429614
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x647d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x647d84
lea eax, [ebp - 0x294]
mov edx, 7
call fcn.0040b4c4
lea eax, [ebp - 0x278]
mov edx, dword [0x41f3b0]
call fcn.0040cb78
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax