Function at 0x47c284
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x47c28c
push ebx
mov eax, 0x47bef4
call fcn.004067d8
xor eax, eax
push ebp
push 0x47c5cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x47ffd0], 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47bb0c]
call fcn.0047bc58
mov dword [0x47fff0], eax
xor eax, eax
push ebp
push 0x47c57b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x47ebc4]
mov eax, dword [eax]
call fcn.0045a2dc
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov edx, 0x47c5e4
call fcn.004090c8
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x42f214]
call fcn.0042f2c4
mov dword [0x47ffd4], eax
xor eax, eax
push ebp
push 0x47c55c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x47c5f4
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x47c614
mov edx, 0x47c628
mov eax, dword [0x47ffd4]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x1c]
mov eax, 0x47ffd8
call fcn.00404584
push 0x47c63c
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x47c654
mov edx, 0x47c668
mov eax, dword [0x47ffd4]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x20]
mov eax, 0x47ffe8
call fcn.00404584
push 0x47c67c
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x47c6a8
mov edx, 0x47c6b4
mov eax, dword [0x47ffd4]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x24]
mov eax, 0x47ffec
call fcn.00404584
push 0
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x47c6c0
mov edx, 0x47c6d0
mov eax, dword [0x47ffd4]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x28]
mov eax, 0x47ffdc
call fcn.00404584
lea eax, [ebp - 0x2c]
mov ecx, 0x47c6e4
mov edx, dword [0x47ffd8]
call fcn.0040483c
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x47fff0]
call fcn.0047be74
lea edx, [ebp - 0x30]
mov eax, dword [0x47fff0]
call fcn.0047bdf0
mov edx, dword [ebp - 0x30]
mov eax, 0x47ffe4
call fcn.00404584
lea eax, [ebp - 0x34]
mov ecx, 0x47c70c
mov edx, dword [0x47ffd8]
call fcn.0040483c
mov edx, dword [ebp - 0x34]
mov eax, dword [0x47fff0]
call fcn.0047be4c
mov eax, 0x47ffe0
mov edx, 0x47c734
call fcn.00404584
mov eax, dword [0x47ffe4]
mov edx, dword [0x47ffe8]
call fcn.0040493c
jbe 0x47c544
mov eax, dword [0x47ffdc]
call fcn.0047b950
test al, al
je 0x47c46d
lea eax, [ebp - 0x38]
mov ecx, 0x47c748
mov edx, dword [0x47ffdc]
call fcn.0040483c
mov eax, dword [ebp - 0x38]
call fcn.0042daf8
call fcn.00403f6c
call fcn.00403f6c
jmp 0x47c5b2
mov eax, dword [0x47eb30]
mov edx, dword [0x47ffe0]
call fcn.00404584
mov edx, dword [0x47ffec]
mov eax, dword [0x47fff0]
call fcn.0047bca8
lea edx, [ebp - 0x40]
mov eax, dword [0x47ebc4]
mov eax, dword [eax]
call fcn.0045a2dc
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040915c
mov edx, dword [ebp - 0x3c]
mov eax, 0x47ffe0
mov ecx, dword [0x47ffe0]
call fcn.0040483c
mov eax, dword [0x47ffe0]
call fcn.00408fd0
test al, al
je 0x47c528
mov byte [0x47ffd0], 1
push 5
mov eax, dword [0x47ffe0]
call fcn.004049f0
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x47ffe4]
mov edx, 0x47c784
call fcn.0040493c
jne 0x47c502
mov eax, 0x47ffe4
mov edx, dword [0x47ffe8]
call fcn.00404584
mov eax, dword [0x47ffe4]
push eax
mov ecx, 0x47c654
mov edx, 0x47c668
mov eax, dword [0x47ffd4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x47ffd4]
mov edx, dword [eax]
call dword [edx + 0x54]
jmp 0x47c544
push 0x40
push 0x47c788
push 0x47c790
mov eax, dword [0x47ebc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c563
mov eax, dword [0x47ffd4]
call fcn.00403720
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c5d4
lea eax, [ebp - 0x40]
mov edx, 0xc
call fcn.00404554
ret