Function at 0x474b4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov esi, eax
mov edi, dword [0x47b260]
xor eax, eax
push ebp
push 0x475143
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0xff
call fcn.00418f68
cmp byte [edi + 1], 0x3e
jne 0x474d37
mov eax, dword [0x47b160]
cmp dword [eax], 0
je 0x474bc7
lea eax, [ebp - 0x20]
mov edx, edi
call fcn.00404e58
mov edx, dword [ebp - 0x20]
mov eax, dword [0x47b1d0]
call fcn.00409294
mov ecx, dword [0x47b1d0]
mov eax, dword [0x47b160]
mov eax, dword [eax]
mov dl, 1
call fcn.004446f8
lea eax, [ebp - 0x124]
push eax
xor ecx, ecx
mov cl, byte [edi]
dec ecx
mov eax, edi
mov edx, 2
call fcn.00402798
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x24]
call fcn.00404e58
mov edx, dword [ebp - 0x24]
mov eax, dword [0x47b1d0]
call fcn.00409294
push 5
mov eax, dword [0x47b1d0]
push eax
call sub.kernel32.dll_WinExec
mov ebx, eax
cmp ebx, 0x20
jge 0x474d2d
mov eax, ebx
sub eax, 1
jb 0x474c27
dec eax
sub eax, 2
jb 0x474c3b
dec eax
je 0x474c4f
sub eax, 3
jne 0x474c63
mov eax, dword [0x47b1d0]
mov edx, 0x47515c
call fcn.00409294
jmp 0x474ce4
mov eax, dword [0x47b1d0]
mov edx, 0x475198
call fcn.00409294
jmp 0x474ce4
mov eax, dword [0x47b1d0]
mov edx, 0x4751cc
call fcn.00409294
jmp 0x474ce4
lea edx, [ebp - 0x124]
mov eax, ebx
call fcn.004035d0
lea edx, [ebp - 0x124]
lea eax, [ebp - 7]
mov cl, 2
call fcn.00403044
mov edx, 0x4751e4
lea eax, [ebp - 0x134]
call fcn.00403038
lea edx, [ebp - 7]
lea eax, [ebp - 0x134]
mov cl, 9
call fcn.00403008
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x160]
call fcn.00403038
mov edx, 0x4751ec
lea eax, [ebp - 0x160]
mov cl, 0x2a
call fcn.00403008
lea edx, [ebp - 0x160]
lea eax, [ebp - 0x128]
call fcn.00404e58
mov edx, dword [ebp - 0x128]
mov eax, dword [0x47b1d0]
call fcn.00409294
mov eax, dword [0x47b160]
cmp dword [eax], 0
je 0x474d14
mov edx, dword [0x47b1d0]
mov eax, dword [0x47b1d0]
call fcn.0041be1c
mov ecx, dword [0x47b1d0]
mov eax, dword [0x47b160]
mov eax, dword [eax]
xor edx, edx
call fcn.004446f8
jmp 0x474d2d
push 0
mov eax, dword [0x47b5cc]
mov eax, dword [eax]
push eax
mov eax, dword [0x47b1d0]
push eax
mov eax, dword [esi + 0xc]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00419590
jmp 0x47511d
call fcn.00456238
mov eax, edi
mov edx, 0x475210
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
jne 0x474d67
lea eax, [ebp - 0x124]
call fcn.00419aa8
lea edx, [ebp - 0x124]
mov eax, edi
call fcn.00403038
mov eax, edi
mov edx, 0x475214
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x474d8c
mov ecx, edi
mov eax, esi
mov edx, 0x475218
call fcn.00474434
test al, al
je 0x474d93
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x474da2
mov edx, edi
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xb8]
mov dword [ebp - 4], eax
mov ecx, edi
mov eax, esi
mov edx, 0x47521c
call fcn.00474434
test al, al
je 0x474e3f
mov edx, edi
mov eax, 0x475220
call fcn.00402a80
mov ebx, eax
cmp ebx, 2
jle 0x474de9
cmp byte [edi + ebx - 1], 0x20
jne 0x474de9
xor edx, edx
mov dl, byte [edi]
lea ecx, [ebx + 2]
cmp edx, ecx
jle 0x474de9
mov al, byte [edi + ebx + 3]
cmp al, 0x20
je 0x474e3f
cmp al, 0x3d
je 0x474e3f
mov edx, edi
mov eax, 0x475224
call fcn.00402a80
mov ebx, eax
test ebx, ebx
jne 0x474e09
mov edx, edi
mov eax, 0x475228
call fcn.00402a80
mov ebx, eax
test ebx, ebx
mov eax, dword [0x47b574]
sete byte [eax]
mov eax, dword [0x47b574]
cmp byte [eax], 0
jne 0x474e2f
push 8
push 0x151
mov eax, dword [esi + 0x47]
push eax
call sub.user32.dll_CheckMenuItem
jmp 0x474e3f
push 0
push 0x151
mov eax, dword [esi + 0x47]
push eax
call sub.user32.dll_CheckMenuItem
cmp dword [ebp - 4], 0
jne 0x474f31
mov eax, dword [0x47b160]
cmp dword [eax], 0
je 0x474ec1
mov eax, edi
mov edx, 0x47522c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x474ec1
mov eax, edi
mov edx, 0x475230
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x474ec1
mov eax, edi
mov edx, 0x475214
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x474ec1
mov ecx, edi
mov eax, esi
mov edx, 0x475218
call fcn.00474434
test al, al
jne 0x474ec1
mov eax, edi
mov edx, 0x475238
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x474ec1
mov ecx, edi
mov eax, dword [0x47b160]
mov eax, dword [eax]
mov dl, 1
call fcn.004447e8
mov eax, dword [0x4c15f4]
mov edx, dword [eax]
call dword [edx + 0x90]
mov ebx, eax
mov ecx, edi
mov eax, esi
mov edx, 0x47521c
call fcn.00474434
test al, al
je 0x474eeb
mov edx, edi
mov eax, ebx
call fcn.00453804
call fcn.00419590
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x90]
cmp word [0x47b15c], 0
jne 0x475118
mov word [0x47b15c], 0x1c6
push 0
mov eax, dword [0x47b23c]
mov eax, dword [eax]
push eax
movzx eax, word [0x47b15c]
push eax
mov eax, dword [esi + 0xc]
push eax
call sub.user32.dll_SetTimer
jmp 0x475118
mov ecx, edi
mov eax, esi
mov edx, 0x47523c
call fcn.00474434
test al, al
jne 0x474f59
mov ecx, edi
mov eax, esi
mov edx, 0x475240
call fcn.00474434
test al, al
je 0x474ffd
mov eax, dword [edi + 0x200]
test eax, eax
je 0x474f7b
lea edx, [edi + 0x311]
push edx
mov cx, word [edi + 0x204]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0043d2b0
cmp byte [edi + 0x306], 0
je 0x474f92
lea edx, [edi + 0x306]
mov eax, dword [ebp - 4]
call fcn.0043f490
cmp byte [edi + 0x206], 0
je 0x474fb5
mov eax, dword [ebp - 4]
add eax, 0x485
lea edx, [edi + 0x206]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
jne 0x474fbf
mov eax, dword [0x47b1cc]
cmp byte [eax], 2
jne 0x474fe0
mov ebx, dword [ebp - 4]
mov byte [ebx + 0x160], 1
lea edx, [edi + 0x206]
mov eax, ebx
call fcn.0043b0c4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x90]
cmp word [edi + 0x204], 0x226
jne 0x474ffd
mov eax, dword [ebp - 4]
mov byte [eax + 0x160], 1
mov edx, dword [eax]
call dword [edx + 0x90]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x53], eax
mov eax, esi
call fcn.004107d0
push 0
push 2
push 6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_SendMessageA
mov ecx, edi
mov eax, esi
mov edx, 0x47521c
call fcn.00474434
test al, al
je 0x4750ec
mov byte [ebp - 0x1a], 0
mov edx, edi
mov eax, 0x475220
call fcn.00402a80
mov ebx, eax
test ebx, ebx
jle 0x4750b5
add ebx, 3
jmp 0x475051
inc ebx
xor eax, eax
mov al, byte [edi]
cmp ebx, eax
jge 0x47505f
cmp byte [edi + ebx], 0x20
je 0x475050
xor eax, eax
mov al, byte [edi]
cmp ebx, eax
jge 0x4750b5
cmp byte [edi + ebx], 0x3d
jne 0x4750b5
inc ebx
jmp 0x475071
inc ebx
xor eax, eax
mov al, byte [edi]
cmp ebx, eax
jge 0x4750a7
cmp byte [edi + ebx], 0x20
je 0x475070
jmp 0x4750a7
cmp byte [ebp - 0x1a], 8
jae 0x4750a6
lea eax, [ebp - 0x164]
mov dl, byte [edi + ebx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x164]
lea eax, [ebp - 0x1a]
mov cl, 0x12
call fcn.00403008
inc ebx
xor eax, eax
mov al, byte [edi]
cmp ebx, eax
jg 0x4750b5
cmp byte [edi + ebx], 0x20
jne 0x475081
cmp byte [ebp - 0x1a], 0
je 0x4750d6
lea eax, [ebp - 0x1a]
call fcn.0041940c
test al, al
jne 0x4750d6
lea edx, [ebp - 0x1a]
mov eax, dword [ebp - 4]
call fcn.00449c40
test al, al
jne 0x4750ec
mov edx, edi
mov ebx, dword [ebp - 4]
mov eax, ebx
call fcn.00453804
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x90]
mov eax, dword [0x47b160]
cmp dword [eax], 0
je 0x475118
mov ecx, edi
mov eax, esi
mov edx, 0x47521c
call fcn.00474434
test al, al
je 0x475118
mov ecx, edi
mov eax, dword [0x47b160]
mov eax, dword [eax]
mov dl, 1
call fcn.004447e8
call fcn.00419590
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47514a
lea eax, [ebp - 0x128]
call fcn.00404bf4
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404c18
ret