Function at 0x476c50
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a87f8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x61ac94]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
xor ebx, ebx
xor esi, esi
cmp dword [esp + 0x8c], ebx
je 0x476d61
call fcn.00418b00
test eax, eax
je 0x476d61
call fcn.00473ca0
test eax, eax
jne 0x476d61
push 0x38
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.004e5fc0
mov edx, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x88]
mov dword [esp + 0x3c], edx
add esp, 0xc
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0x1040
mov dword [esp + 0x30], str.runas
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x476e95
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x58]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x88]
cmp eax, ebx
je 0x476d3c
mov edx, dword [esp + 0x58]
push eax
push edx
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
mov eax, esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x60
ret
call fcn.004a581f
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x476d7b
push 0x80004005
call fcn.0040b390
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x6c], ebx
cmp eax, ebx
je 0x476db7
mov ecx, dword [esp + 0x78]
push eax
push ecx
lea edx, [esp + 0x94]
push str.__s___s
push edx
call fcn.0040cbe0
add esp, 0x10
jmp 0x476dd1
mov eax, dword [esp + 0x78]
push eax
lea ecx, [esp + 0x90]
push 0x5c7588
push ecx
call fcn.0040cbe0
add esp, 0xc
push 0x40
lea edx, [esp + 0x28]
push ebx
push edx
call fcn.004e5fc0
mov edi, dword [esp + 0x98]
add esp, 0xc
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x10]
push ecx
mov eax, 5
lea edx, [esp + 0x24]
push edx
mov word [esp + 0x58], ax
mov eax, dword [esp + 0x88]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp esi, ebx
je 0x476e71
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x88]
cmp eax, ebx
je 0x476e5d
push eax
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [edi - 0x10]
mov dword [esp + 0x6c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476e95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x60
ret