Function at 0x47ef98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x47efa0
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47f38e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x50df34]
mov edx, 0x47f3a4
call fcn.00405690
jne 0x47f35e
mov eax, dword [0x50dfa0]
mov edx, 0x47f3b0
call fcn.00405690
jne 0x47eff9
mov eax, dword [0x50df30]
mov eax, dword [eax + 0x360]
or ecx, 0xffffffff
mov edx, 0x18
call fcn.0046ce94
jmp 0x47f021
mov eax, dword [0x50dfa0]
mov edx, 0x47f3bc
call fcn.00405690
jne 0x47f021
mov eax, dword [0x50df30]
mov eax, dword [eax + 0x360]
xor ecx, ecx
mov edx, 0x18
call fcn.0046ce94
call fcn.004033ac
lea eax, [ebp - 4]
mov edx, 0x47f3c8
call fcn.00405300
mov eax, 0x18
call fcn.004033d4
mov edx, eax
inc edx
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004347bc
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov edx, 1
call fcn.004347f4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405300
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x2c]
call fcn.00409a9c
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0047422c
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.004742a4
mov eax, dword [ebp - 0x18]
push eax
mov eax, 5
call fcn.004033d4
mov edx, eax
inc edx
lea ecx, [ebp - 0x14]
pop eax
call fcn.004347bc
mov edx, dword [ebp - 0x14]
mov eax, 0x50dff8
call fcn.004052bc
push dword [ebp - 4]
push 0x47f3ec
push dword [0x50dff8]
push 0x47f3f8
mov eax, 0x50dff8
mov edx, 4
call fcn.004055fc
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x38]
call fcn.00409a9c
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x28]
call fcn.0047422c
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x34]
call fcn.004742a4
mov eax, dword [ebp - 0x34]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x30]
pop eax
call fcn.004347bc
mov edx, dword [ebp - 0x30]
mov eax, 0x50dffc
call fcn.004052bc
push dword [0x50dff8]
push dword [0x50dffc]
lea edx, [ebp - 0x3c]
mov eax, dword [0x50df3c]
call fcn.0047e364
push dword [ebp - 0x3c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004055fc
mov eax, dword [0x50dfa4]
mov edx, 0x47f3b0
call fcn.00405690
jne 0x47f167
call fcn.0047b390
lea edx, [ebp - 0x40]
mov eax, dword [0x508320]
mov eax, dword [eax]
call fcn.00466da0
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 8]
call fcn.0047eab4
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 8]
call fcn.00405bc0
mov ecx, dword [ebp - 0x44]
mov eax, dword [0x50df30]
mov eax, dword [eax + 0x360]
mov edx, 1
call fcn.0046d264
mov eax, dword [0x50df30]
mov eax, dword [eax + 0x360]
xor ecx, ecx
mov edx, 0x16
call fcn.0046ce94
cmp dword [0x50df98], 0
je 0x47f21b
cmp dword [0x50df9c], 0
je 0x47f21b
xor eax, eax
push ebp
push 0x47f211
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x50df9c]
call fcn.00409bd8
mov edx, eax
mov eax, dword [0x50df30]
call fcn.00448324
mov eax, dword [0x50df98]
call fcn.00409bd8
mov edx, eax
mov eax, dword [0x50df30]
call fcn.00448358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f21b
mov eax, dword [0x50dfe4]
mov edx, 0x47f3bc
call fcn.00405690
jne 0x47f238
mov dl, 3
mov eax, dword [0x50df30]
call fcn.0045f0e4
mov eax, dword [0x5084a0]
cmp dword [eax], 0
je 0x47f2da
xor eax, eax
push ebp
push 0x47f2d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x50df30]
call fcn.0045ddc8
mov ebx, eax
mov eax, dword [0x50df80]
call fcn.00409bd8
add ebx, eax
mov edx, ebx
mov eax, dword [0x5082d8]
mov eax, dword [eax]
call fcn.004633f8
mov eax, dword [0x50df30]
call fcn.0045dde8
mov ebx, eax
mov eax, dword [0x50df84]
call fcn.00409bd8
add ebx, eax
mov edx, ebx
mov eax, dword [0x5082d8]
mov eax, dword [eax]
call fcn.00463434
mov edx, dword [0x5084a0]
mov edx, dword [edx]
mov eax, dword [0x5082d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.00448c6c
mov eax, dword [0x5082d8]
mov eax, dword [eax]
call fcn.004629f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f2da
mov eax, dword [0x50df30]
mov eax, dword [eax + 0x36c]
mov dl, 1
call fcn.0043843c
mov eax, dword [0x50df30]
mov eax, dword [eax + 0x368]
mov dl, 1
call fcn.0043843c
cmp dword [0x50dfb8], 0
je 0x47f332
mov eax, dword [0x50dfb8]
mov edx, 0x47f404
call fcn.00405690
je 0x47f332
push 1
push 0
push 0
mov eax, dword [0x50dfb8]
call fcn.004056f8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
push ebp
push 0x47f354
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043afa0
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f35e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f395
lea eax, [ebp - 0x44]
call fcn.00405a70
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.0040528c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040528c
ret