Function at 0x47f8cf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x24]
push edi
call fcn.00411207
xor ecx, ecx
mov dword [ebp - 0xc], 1
push 0x3c
push ecx
lea eax, [ebp - 0x60]
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 8], ecx
call fcn.00422f40
mov ebx, dword [ebp + 0x10]
add esp, 0xc
mov edi, dword [ebp + 0xc]
cmp ebx, 2
jb 0x47f93f
mov eax, dword [edi + 4]
mov esi, dword [eax + 4]
mov ecx, esi
call fcn.00404d37
mov eax, dword [esi + 8]
xor ecx, ecx
mov eax, dword [eax]
cmp word [eax], cx
je 0x47f93f
mov eax, dword [edi + 4]
mov esi, dword [eax + 4]
mov ecx, esi
call fcn.00404d37
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call fcn.0041436a
mov dword [ebp - 4], eax
cmp ebx, 3
jb 0x47f95e
mov ecx, dword [edi + 4]
mov esi, dword [ecx + 8]
mov ecx, esi
call fcn.00404d37
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call fcn.0041436a
mov dword [ebp - 8], eax
cmp ebx, 4
jb 0x47f9a1
mov ecx, dword [edi + 4]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call fcn.00404d37
mov eax, dword [esi + 8]
xor esi, esi
mov eax, dword [eax]
cmp word [eax], si
je 0x47f9a3
mov eax, dword [edi + 4]
push 0x29
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.0040514e
test al, al
jne 0x47f9a1
mov ecx, esi
call fcn.00404d37
push dword [esi + 8]
lea ecx, [ebp - 0x24]
call fcn.00411c9c
xor esi, esi
cmp ebx, 5
jb 0x47f9b9
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x10]
call fcn.0040502b
movzx eax, ax
mov dword [ebp - 0xc], eax
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00422f40
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ebp - 0x54], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], 0x40
mov dword [ebp - 0x58], esi
mov esi, dword [eax]
mov ecx, esi
call fcn.00404d37
mov eax, dword [esi + 8]
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
test esi, esi
je 0x47fa1a
push esi
call fcn.00420f8c
pop ecx
test ebx, ebx
je 0x47fa25
push ebx
call fcn.00420f8c
pop ecx
test edi, edi
jne 0x47fa4e
mov edx, dword [ebp - 0x10]
xor ebx, ebx
push ebx
inc edi
push edi
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call fcn.00456f18
mov esi, dword [ebp + 0x14]
mov ecx, esi
call fcn.00404dc0
mov dword [esi + 0xc], edi
mov dword [esi], ebx
jmp 0x47fab3
cmp byte [ebp + 8], 0
je 0x47fa62
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov dword [edx + 0x444], eax
jmp 0x47fab3
mov esi, dword [ebp + 0x14]
mov ecx, esi
call fcn.00404dc0
or dword [esi], 0xffffffff
xor edi, edi
inc edi
cmp dword [ebp - 0x28], 0
mov dword [esi + 0xc], edi
je 0x47fab3
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
test eax, eax
jns 0x47fa94
fadd qword [0x4bae48]
mov ecx, esi
fstp qword [ebp - 0x14]
call fcn.00404dc0
fld qword [ebp - 0x14]
push dword [ebp - 0x28]
fstp qword [esi]
mov dword [esi + 0xc], 3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
call fcn.00411cb6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10