Function at 0x474319
Capabilities:
Create process on windows

Disassembly:
push 0xd4
mov eax, 0x4e2845
call fcn.004b53ae
mov dword [ebp - 0x40], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.00476f02
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x18]
push esi
mov dword [ebp - 0x34], ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004424c1
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0043cc0e
test al, al
jne 0x4746d4
xor ebx, ebx
lea ecx, [ebp - 0x2c]
call fcn.0048d48e
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x34]
call fcn.00478005
mov eax, dword [eax + 4]
push 0x5014fc
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.00473e97
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
add esp, 0xc
push 0x1c
pop edi
cdq
mov ecx, edi
idiv ecx
cmp eax, 2
jb 0x47469d
lea ecx, [ebp - 0x14]
mov byte [ebp - 0xd], bl
call fcn.0040c7d0
mov byte [ebp - 4], 1
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00470c02
cmp dword [eax + 0x18], 8
jb 0x4743c9
mov eax, dword [eax + 4]
jmp 0x4743cc
add eax, 4
push eax
mov eax, dword [ebp - 0x40]
add eax, 0x3ac
push eax
lea eax, [ebp - 0x14]
push 0x4f9538
push eax
call fcn.0040e3f0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
mov ecx, edi
cdq
idiv ecx
add esp, 0x10
cmp eax, 3
jb 0x474462
push 2
lea ecx, [ebp - 0x2c]
call fcn.00470c02
cmp dword [eax + 0x14], ebx
je 0x474462
push 2
lea ecx, [ebp - 0x2c]
call fcn.00470c02
cmp dword [eax + 0x14], 0x20
jne 0x474462
push dword [ebp - 0x14]
lea eax, [ebp - 0xe0]
push eax
call fcn.004652ce
pop ecx
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
push 2
lea ecx, [ebp - 0x2c]
call fcn.00470c02
push eax
push esi
call fcn.00442b07
pop ecx
pop ecx
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0xe0]
call fcn.0040d590
cmp byte [ebp - 0xd], bl
je 0x474692
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
mov ecx, edi
cdq
idiv ecx
cmp eax, 4
jb 0x47458a
push 3
lea ecx, [ebp - 0x2c]
call fcn.00481292
cmp dword [eax + 0x14], ebx
je 0x47458a
lea ecx, [ebp - 0x80]
call fcn.0048d48e
mov byte [ebp - 4], 3
push 3
lea ecx, [ebp - 0x2c]
call fcn.00481292
cmp dword [eax + 0x18], 8
jb 0x4744aa
mov eax, dword [eax + 4]
jmp 0x4744ad
add eax, 4
push 0x501510
lea ecx, [ebp - 0x80]
push ecx
push eax
call fcn.00473e97
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x74]
mov ecx, edi
cdq
idiv ecx
add esp, 0xc
xor esi, esi
test eax, eax
jbe 0x47457e
lea ecx, [ebp - 0x68]
call fcn.0048d48e
mov byte [ebp - 4], 4
push esi
lea ecx, [ebp - 0x80]
call fcn.00481292
cmp dword [eax + 0x18], 8
jb 0x4744f4
mov eax, dword [eax + 4]
jmp 0x4744f7
add eax, 4
push 0x4fbb78
lea ecx, [ebp - 0x68]
push ecx
push eax
call fcn.00473e97
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x5c]
mov ecx, edi
cdq
idiv ecx
add esp, 0xc
cmp eax, 2
jb 0x47455e
push ebx
lea ecx, [ebp - 0x68]
call fcn.00481292
cmp dword [eax + 0x18], 8
jb 0x47452d
mov eax, dword [eax + 4]
jmp 0x474530
add eax, 4
push eax
call fcn.004bc3a2
pop ecx
cmp dword [0x53fa0c], eax
jne 0x47455e
push 1
lea ecx, [ebp - 0x68]
call fcn.00481292
cmp dword [eax + 0x18], 8
jb 0x474554
mov eax, dword [eax + 4]
jmp 0x474557
add eax, 4
push eax
call fcn.004bc3a2
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68]
call fcn.004679ad
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x74]
mov ecx, edi
cdq
idiv ecx
inc esi
cmp esi, eax
jb 0x4744d4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x80]
call fcn.004679ad
cmp byte [ebp - 0xd], bl
jne 0x4745a5
push dword [ebp - 0x14]
call fcn.0043b8a5
test eax, eax
setne al
pop ecx
cmp al, bl
je 0x474692
push 0x40
lea eax, [ebp - 0xc0]
push ebx
push eax
call fcn.004b47e0
xor eax, eax
mov dword [ebp - 0x50], ebx
lea edi, [ebp - 0x4c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0xc4]
push eax
mov dword [ebp - 0xc4], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov word [ebp - 0x94], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x98], 1
mov esi, dword [eax - 0xc]
push 1
lea ecx, [ebp - 0x2c]
call fcn.00470c02
mov eax, dword [eax + 0x14]
push 0x541444
lea esi, [eax + esi + 0x10]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b6290
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x474692
push 1
lea ecx, [ebp - 0x2c]
call fcn.00470c02
cmp dword [eax + 0x18], 8
jb 0x47463b
mov eax, dword [eax + 4]
jmp 0x47463e
add eax, 4
push eax
push dword [ebp - 0x14]
push 0x501500
push esi
push edi
call fcn.004bbedd
add esp, 0x14
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xc4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x47468b
push 0xffffffffffffffff
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x50]
call esi
push edi
call fcn.004b5ee1
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004679ad
lea ecx, [ebp - 0x34]
call fcn.004766da
mov eax, dword [ebp + 8]
push eax
push dword [eax + 0x18]
lea ecx, [ebp - 0x3c]
call fcn.004424c1
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0043cc0e
test al, al
je 0x474367
call fcn.004b5486
ret 4