Function at 0x47c680
Capabilities:
Check if file exists
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x64]
sub eax, 0x1f5
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x15
ja case.0x47c6c7.3
mov ecx, dword [ebp - 0x64]
movzx edx, byte [ecx + 0x47c9a8]
jmp dword [edx*4 + 0x47c988]
mov ecx, dword [ebp - 0x60]
call fcn.0047cd10
jmp case.0x47c6c7.3
mov eax, dword [ebp - 0x60]
movzx ecx, byte [eax + 0x4ad]
test ecx, ecx
jne 0x47c6f1
mov ecx, dword [ebp - 0x60]
call fcn.0047cf30
mov edx, dword [ebp - 0x60]
mov byte [edx + 0x4af], 0
jmp case.0x47c6c7.3
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x60]
call fcn.0047cc60
mov byte [ebp - 0x19], al
movzx ecx, byte [ebp - 0x19]
test ecx, ecx
je 0x47c76f
movzx edx, word [ebp - 0xe]
test edx, edx
je 0x47c72e
movzx eax, word [ebp - 0xe]
cmp eax, 0x1e
jne 0x47c74b
movzx ecx, word [ebp - 0xc]
test ecx, ecx
jne 0x47c74b
mov edx, dword [ebp - 0x60]
push edx
push 0
push 0x482990
call fcn.00547a7d
add esp, 0xc
jmp 0x47c76f
movzx eax, word [ebp - 0xe]
cmp eax, 0x1e
jne 0x47c76f
movzx ecx, word [ebp - 0xc]
test ecx, ecx
jne 0x47c76f
mov edx, dword [ebp - 0x60]
push edx
push 0
push 0x482990
call fcn.00547a7d
add esp, 0xc
movzx eax, word [ebp - 0xe]
test eax, eax
jne 0x47c7bb
movzx ecx, word [ebp - 0xc]
test ecx, ecx
jne 0x47c7bb
mov ecx, dword [ebp - 0x60]
add ecx, 0x3e0
call fcn.004b8740
mov ecx, dword [ebp - 0x60]
add ecx, 0x2d8
call fcn.004b5f80
mov edx, dword [ebp - 0x60]
cmp dword [edx + 0x4a0], 0
je 0x47c7bb
push 0
push 0
push 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x4a0]
call fcn.0047c9c0
jmp case.0x47c6c7.3
mov ecx, dword [ebp - 0x60]
push ecx
push 0
push 0x4b9300
call fcn.00547a7d
add esp, 0xc
jmp case.0x47c6c7.3
mov edx, dword [ebp - 0x60]
cmp dword [edx + 0x4b0], 5
jg 0x47c7f3
mov ecx, dword [ebp - 0x60]
call fcn.0047bc70
movzx eax, al
test eax, eax
je 0x47c805
push 0x203
mov ecx, dword [ebp - 0x60]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x4b0]
add ecx, 1
mov edx, dword [ebp - 0x60]
mov dword [edx + 0x4b0], ecx
jmp case.0x47c6c7.3
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
jmp case.0x47c6c7.3
cmp dword [0x5c244c], 1
jne 0x47c850
push 0x20a
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00452830
cmp eax, 0x13
jge 0x47c898
push 5
push 0
push str._checktime
push 0x58ab5c
push 0x5c2724
lea edx, [ebp - 0x40]
push edx
call fcn.0041ca60
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x40]
call fcn.0040f740
jmp case.0x47c6c7.3
push 0
push ecx
mov ecx, esp
push str._checktime
call fcn.0041c8a0
push ecx
mov eax, esp
push 0x58ab5c
push 0x5c2724
push eax
call fcn.0041ca60
add esp, 0xc
call fcn.00446290
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne case.0x47c6c7.3
lea ecx, [ebp - 0x3c]
call fcn.004524b0
push ecx
mov ecx, esp
push str.pcmastersvc.exe
call fcn.0041c8a0
push ecx
push esp
lea ecx, [ebp - 0x3c]
call fcn.004524f0
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00452750
lea ecx, [ebp - 0x24]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47c935
push 0x58ab34
lea ecx, [ebp - 0x54]
call fcn.0041c8a0
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00445410
add esp, 8
lea ecx, [ebp - 0x54]
call fcn.0040f740
push 0
push ecx
mov ecx, esp
push str._checktime
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58ab5c
push 0x5c2724
push ecx
call fcn.0041ca60
add esp, 0xc
call fcn.00446290
add esp, 0xc
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x24]
call fcn.0040f740
lea ecx, [ebp - 0x3c]
call fcn.004524d0
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 0x10