Function at 0x47aae4
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x47aaec
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47b2bf
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040334c
lea eax, [ebp - 8]
mov edx, 0x47b2d8
call fcn.004051ec
mov eax, 0x18
call fcn.00403374
mov edx, eax
inc edx
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.00433fd4
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
mov edx, 1
call fcn.0043400c
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.004051ec
mov eax, 0x270f
call fcn.00403374
lea edx, [ebp - 0x4c]
call fcn.00409a44
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.004730e8
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x38]
call fcn.00473160
mov eax, dword [ebp - 0x38]
push eax
mov eax, 5
call fcn.00403374
mov edx, eax
inc edx
lea ecx, [ebp - 0x34]
pop eax
call fcn.00433fd4
mov edx, dword [ebp - 0x34]
mov eax, 0x484024
call fcn.004051a8
push dword [ebp - 8]
push 0x47b2fc
push dword [0x484024]
push 0x47b308
mov eax, 0x484024
mov edx, 4
call fcn.004054e8
mov eax, 0x270f
call fcn.00403374
lea edx, [ebp - 0x58]
call fcn.00409a44
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x48]
call fcn.004730e8
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x54]
call fcn.00473160
mov eax, dword [ebp - 0x54]
push eax
mov eax, 0x14
call fcn.00403374
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x50]
pop eax
call fcn.00433fd4
mov edx, dword [ebp - 0x50]
mov eax, 0x484028
call fcn.004051a8
push 0x47b314
push dword [0x484028]
push 0x47b328
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004054e8
mov eax, dword [0x483f64]
mov edx, 0x47b338
call fcn.0040557c
jne 0x47b259
lea edx, [ebp - 0x5c]
mov eax, dword [0x47ecd8]
mov eax, dword [eax]
call fcn.00466658
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0xc]
call fcn.0047a74c
mov eax, dword [ebp - 0xc]
call fcn.00409f10
test al, al
jne 0x47ac72
mov eax, 0x47b344
call fcn.00439a64
jmp 0x47b259
xor eax, eax
push ebp
push 0x47acc3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x36c]
mov edx, dword [ebp - 0xc]
call fcn.00470f2c
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x36c]
or edx, 0xffffffff
call fcn.004708c0
lea edx, [ebp - 0x20]
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x36c]
call fcn.00470af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47acfb
xor eax, eax
push ebp
push 0x47ae40
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x47b400
push 0x47b414
push 0x47b420
push 0x47b430
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00410b70
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00410b70
add esp, 0x10
lea eax, [ebp - 0x6c]
push eax
push 0
call fcn.00410b70
add esp, 0x10
push 0
push 0x47b400
push 0x47b448
push 0x47b420
push 0x47b430
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00410b70
add esp, 0xc
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00410b70
add esp, 0x10
lea eax, [ebp - 0x8c]
push eax
push 0
call fcn.00410b70
add esp, 0x10
push 0
push 0x47b400
push 0x47b45c
push 0x47b420
push 0x47b468
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.00410b70
add esp, 0xc
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00410b70
add esp, 0x10
lea eax, [ebp - 0xac]
push eax
push 0
call fcn.00410b70
add esp, 0x10
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x36c]
call fcn.00470c84
sub al, 5
jne 0x47ae36
lea eax, [ebp - 4]
call fcn.00406b84
push eax
push 0x47b478
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x36c]
mov eax, dword [eax + 0x264]
push eax
mov eax, dword [eax]
call dword [eax]
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
lea eax, [ebp - 4]
call fcn.00406b84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ae4a
push 0x47b488
push 0x47b494
push 0x47b430
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.00410b70
add esp, 0xc
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00410b70
add esp, 0xc
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00410b70
add esp, 0xc
lea eax, [ebp - 0xcc]
call fcn.00411610
test eax, eax
jle 0x47af2e
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
xor eax, eax
push ebp
push 0x47af1c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x47b400
mov eax, dword [ebp - 0x24]
push eax
push 0x47b4a4
push 0x47b430
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00410b70
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.00410b70
add esp, 0x10
lea eax, [ebp - 0xfc]
push eax
push 0
call fcn.00410b70
add esp, 0x10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47af26
inc dword [ebp - 0x24]
dec dword [ebp - 0x28]
jne 0x47aeb5
xor eax, eax
push ebp
push 0x47af59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x36c]
or edx, 0xffffffff
call fcn.004708c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47af63
xor eax, eax
push ebp
push 0x47afdf
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0x47b4b4
push 0x47b4c0
push 0x47b468
lea edx, [ebp - 0x13c]
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x36c]
call fcn.00470af8
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.00410b70
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00410b70
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0
call fcn.00410b70
add esp, 0x10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47afe9
xor eax, eax
push ebp
push 0x47b00a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
call sub.shell32.dll_SHAddToRecentDocs
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b014
mov eax, dword [ebp - 0xc]
call fcn.004055e4
push eax
call sub.kernel32.dll_DeleteFileA
call fcn.004778e0
mov eax, dword [0x48408c]
push eax
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x364]
push eax
mov eax, dword [0x483f60]
push eax
call fcn.004779bc
cmp dword [0x483fc8], 0
je 0x47b0a4
cmp dword [0x483fcc], 0
je 0x47b0a4
xor eax, eax
push ebp
push 0x47b09a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x483fcc]
call fcn.00409b80
mov edx, eax
mov eax, dword [0x483f60]
call fcn.00447b84
mov eax, dword [0x483fc8]
call fcn.00409b80
mov edx, eax
mov eax, dword [0x483f60]
call fcn.00447bb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b0a4
mov eax, dword [0x484014]
mov edx, 0x47b4dc
call fcn.0040557c
jne 0x47b0c1
mov dl, 3
mov eax, dword [0x483f60]
call fcn.0045e944
mov eax, dword [0x47ee40]
cmp dword [eax], 0
je 0x47b163
xor eax, eax
push ebp
push 0x47b159
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x483f60]
call fcn.0045d628
mov ebx, eax
mov eax, dword [0x483fb0]
call fcn.00409b80
add ebx, eax
mov edx, ebx
mov eax, dword [0x47ec90]
mov eax, dword [eax]
call fcn.00462c58
mov eax, dword [0x483f60]
call fcn.0045d648
mov ebx, eax
mov eax, dword [0x483fb4]
call fcn.00409b80
add ebx, eax
mov edx, ebx
mov eax, dword [0x47ec90]
mov eax, dword [eax]
call fcn.00462c94
mov edx, dword [0x47ee40]
mov edx, dword [edx]
mov eax, dword [0x47ec90]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.004484cc
mov eax, dword [0x47ec90]
mov eax, dword [eax]
call fcn.00462254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b163
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x360]
mov dl, 1
call fcn.00437c54
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x370]
mov dl, 1
call fcn.00437c54
cmp dword [0x483fe8], 0
je 0x47b1bb
mov eax, dword [0x483fe8]
mov edx, 0x47b4e8
call fcn.0040557c
je 0x47b1bb
push 1
push 0
push 0
mov eax, dword [0x483fe8]
call fcn.004055e4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
lea edx, [ebp - 0x140]
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x368]
call fcn.0044849c
mov edx, dword [ebp - 0x140]
mov eax, 0x47b4f8
call fcn.00405730
test eax, eax
jg 0x47b1f1
mov eax, dword [0x47ecd8]
mov eax, dword [eax]
call fcn.00465ff0
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x368]
mov edx, 0xc0
call fcn.00447b84
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x368]
mov edx, 0x11
call fcn.00447bb8
mov eax, dword [0x483f60]
mov eax, dword [eax + 0x368]
mov dl, 1
call fcn.004483bc
xor eax, eax
push ebp
push 0x47b24f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043a7b8
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b259
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b2c6
lea eax, [ebp - 0x140]
call fcn.00405154
lea eax, [ebp - 0x13c]
mov edx, dword [0x4010b0]
mov ecx, 0xe
call fcn.00405d08
lea eax, [ebp - 0x5c]
mov edx, 5
call fcn.00405178
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00405178
lea eax, [ebp - 0x20]
call fcn.00410b68
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405178
lea eax, [ebp - 4]
call fcn.00406b84
ret