Function at 0x470c90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x470c98
push ecx
push ebx
push esi
push edi
mov eax, 0x470a78
call fcn.004065a4
mov esi, 0x474c5c
mov edi, 0x474c34
xor eax, eax
push ebp
push 0x471042
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045c364
call fcn.00402a34
test eax, eax
jle 0x470cf4
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00402a94
mov eax, dword [ebp - 0x14]
mov edx, 0x47105c
call fcn.0040491c
jne 0x470cf4
call fcn.0045c164
call fcn.00402a34
test eax, eax
jle 0x470d43
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00402a94
mov eax, dword [ebp - 0x18]
mov edx, 0x471068
call fcn.0040491c
jne 0x470d43
mov bl, 1
push 0
push 0x47106c
call sub.user32.dll_FindWindowA
test eax, eax
je 0x470d43
push 0
push 0
push 0x10
push 0
push 0x47106c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402a94
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00408e08
mov eax, dword [ebp - 0x1c]
mov edx, 0x471088
call fcn.00408590
test eax, eax
je 0x470e58
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00402a94
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00408dd4
lea eax, [ebp - 0x24]
mov edx, 0x4710a0
call fcn.004047d8
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00402a94
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00408dd4
lea eax, [ebp - 0x2c]
mov edx, 0x4710b8
call fcn.004047d8
mov eax, dword [ebp - 0x2c]
pop edx
call fcn.00408d30
lea edx, [ebp - 0x38]
xor eax, eax
call fcn.00402a94
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00408dd4
lea eax, [ebp - 0x34]
mov edx, 0x4710b8
call fcn.004047d8
mov eax, dword [ebp - 0x34]
push eax
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00402a94
mov eax, dword [ebp - 0x3c]
pop edx
call fcn.00408d30
push 5
lea edx, [ebp - 0x44]
xor eax, eax
call fcn.00402a94
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00408dd4
mov eax, dword [ebp - 0x40]
call fcn.004049d0
push eax
push 0x4710c8
lea edx, [ebp - 0x4c]
xor eax, eax
call fcn.00402a94
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00408dd4
lea eax, [ebp - 0x48]
mov edx, 0x4710b8
call fcn.004047d8
mov eax, dword [ebp - 0x48]
call fcn.004049d0
push eax
push 0x4710cc
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00404420
call fcn.0045a30c
mov eax, ebx
call fcn.0045acd8
call fcn.0045c428
call fcn.00402a34
test eax, eax
jle 0x470e95
lea edx, [ebp - 0x50]
mov eax, 1
call fcn.00402a94
mov eax, dword [ebp - 0x50]
mov edx, 0x4710dc
call fcn.0040491c
jne 0x470e95
mov al, 1
call fcn.0045a02c
call fcn.00402a34
test eax, eax
je 0x470ec3
call fcn.00402a34
test eax, eax
jle 0x470f19
lea edx, [ebp - 0x54]
mov eax, 1
call fcn.00402a94
mov eax, dword [ebp - 0x54]
mov edx, 0x471068
call fcn.0040491c
jne 0x470f19
xor ecx, ecx
mov dl, 1
mov eax, dword [0x470484]
call fcn.00436e44
mov edx, dword [0x473ae0]
mov dword [edx], eax
mov eax, dword [0x473ae0]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xec]
mov eax, dword [0x473abc]
cmp byte [eax], 2
jne 0x470ef7
call fcn.00404420
mov eax, dword [0x473abc]
cmp byte [eax], 1
jne 0x470f08
xor eax, eax
call fcn.0045a02c
mov eax, dword [0x473abc]
cmp byte [eax], 0
jne 0x470f19
mov al, 1
call fcn.0045a02c
push 0
push 0x47106c
call sub.user32.dll_FindWindowA
test eax, eax
jne 0x471027
push 0x4710e0
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x470f4d
push 0x4710f0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474c78], eax
test ebx, ebx
je 0x470f61
push 0x471100
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x474c7c], eax
call dword [0x474c78]
push 0
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
mov dword [edi], 0x80
push 0x471110
push ebx
call sub.user32.dll_LoadIconA
mov dword [edi + 0x14], eax
mov dword [edi + 4], 0x470924
mov dword [edi + 0x10], ebx
mov dword [edi + 0x1c], 0x10
mov eax, 0x47106c
mov dword [edi + 0x24], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [edi + 0x18], eax
push edi
call sub.user32.dll_RegisterClassA
push 0x12c
push 0x12c
push 0x190
push 0xc8
push 0
push 0
push ebx
push 0
mov edx, 0x47111c
mov ecx, 0x80000000
mov eax, dword [edi + 0x24]
call fcn.0040724c
mov ebx, eax
push 0x471138
call fcn.0045a134
push 0
push 0x1388
push 0x1c8
push ebx
call sub.user32.dll_SetTimer
mov edi, eax
jmp 0x47100d
push esi
call sub.user32.dll_TranslateMessage
push esi
call sub.user32.dll_DispatchMessageA
push 0
push 0
push ebx
push esi
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x471001
push 0x1c8
push edi
call sub.user32.dll_KillTimer
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471049
lea eax, [ebp - 0x54]
mov edx, 0x11
call fcn.00404534
ret