Function at 0x472220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
mov eax, dword [0x54e938]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
mov esi, ecx
mov dword [ebp - 0x288], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebx
je 0x4722d6
cmp eax, 0x104
je 0x4722d6
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x472283
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x228]
call fcn.00406300
push 1
push 0xffffffffffffffff
push 0x5104d4
lea ecx, [ebp - 0x228]
call fcn.0045a940
cmp eax, 0xffffffff
jne 0x4722eb
cmp dword [ebp - 0x214], 8
jb 0x4722d6
mov eax, dword [ebp - 0x228]
push eax
call fcn.00406ec9
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x218]
inc eax
cmp eax, ecx
ja 0x472306
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x228]
call fcn.0041a8e0
jmp 0x472315
sub eax, ecx
push ebx
push eax
lea ecx, [ebp - 0x228]
call fcn.0040cd10
push ebx
lea ecx, [ebp - 0x328]
push ecx
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x340], 0x514d6c
mov dword [ebp - 0x330], 0x510384
mov dword [ebp - 0x2e0], 0x514c78
mov dword [ebp - 0x338], ebx
mov dword [ebp - 0x334], ebx
call fcn.00470340
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 4]
mov dword [ebp + eax - 0x330], 0x514c74
mov ecx, dword [ebp - 0x340]
mov edx, dword [ecx + 4]
mov dword [ebp + edx - 0x340], 0x514c7c
mov eax, dword [ebp - 0x340]
mov ecx, dword [eax + 4]
mov dword [ebp + ecx - 0x340], 0x514d50
lea ecx, [ebp - 0x328]
call fcn.0046f560
mov eax, dword [ebp - 0x330]
mov edx, dword [esi]
mov dword [ebp - 0x328], 0x514cf0
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2e8], ebx
mov eax, dword [eax + 4]
mov ecx, dword [edx + 8]
mov edx, dword [ebp + eax - 0x31c]
lea eax, [ebp + eax - 0x330]
push edi
push 0x514d98
push ecx
and edx, 0xfffff9ff
or edx, 0x800
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x330]
mov eax, dword [eax + 4]
push 0x514d74
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x330]
lea eax, [ebp + eax - 0x330]
push 0x5130d8
mov esi, 8
or dword [eax + 0x14], esi
push edx
call fcn.004703e0
add esp, 8
push eax
call fcn.00470640
add esp, 8
push eax
call fcn.004703e0
add esp, 8
mov ecx, eax
call fcn.00470e10
push eax
call fcn.00470860
add esp, 8
mov ecx, eax
call fcn.00470e10
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x328]
call fcn.00472130
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x26c], esi
jae 0x472468
lea eax, [ebp - 0x280]
push eax
call fcn.0040c975
add esp, 4
mov edi, eax
mov dword [ebp - 0x284], edi
cmp dword [ebp - 0x26c], esi
jb 0x472490
mov ecx, dword [ebp - 0x280]
push ecx
call fcn.00406ec9
add esp, 4
push 0x40
lea edx, [ebp - 0x380]
push ebx
push edx
call fcn.004e15a0
add esp, 0xc
lea ecx, [ebp - 0x298]
mov dword [ebp - 0x384], 0x44
call fcn.004135c0
lea ecx, [ebp - 0x264]
call fcn.0045b3b0
lea ecx, [ebp - 0x264]
call fcn.0045b6c0
test al, al
jne 0x47250f
lea ecx, [ebp - 0x264]
call fcn.0045b410
lea ecx, [ebp - 0x298]
call fcn.00432f90
cmp edi, ebx
je 0x4724f4
push edi
call fcn.00402d0e
add esp, 4
lea ecx, [ebp - 0x340]
call fcn.0046ffd0
lea ecx, [ebp - 0x228]
call fcn.0040a2c0
jmp 0x4722d6
lea eax, [ebp - 0x244]
push eax
call fcn.00429910
add esp, 4
cmp dword [ebp - 0x234], ebx
jne 0x472554
lea ecx, [ebp - 0x244]
call fcn.0040a2c0
lea ecx, [ebp - 0x264]
call fcn.0045b410
lea ecx, [ebp - 0x298]
call fcn.00432f90
lea ecx, [ebp - 0x284]
call fcn.00432fe0
jmp 0x4724f4
cmp dword [ebp - 0x230], esi
mov esi, dword [ebp - 0x244]
jae 0x472568
lea esi, [ebp - 0x244]
lea ecx, [ebp - 0x298]
call fcn.0042f960
push eax
lea ecx, [ebp - 0x384]
push ecx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x472526
mov edx, dword [ebp - 0x298]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x298]
mov esi, eax
lea eax, [ebp - 0x288]
push eax
push ecx
mov dword [ebp - 0x288], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne al
cmp esi, 0x102
je 0x472526
cmp al, bl
je 0x4725d7
cmp dword [ebp - 0x288], ebx
jne 0x4725d7
mov bl, 1
lea ecx, [ebp - 0x244]
call fcn.0040a2c0
lea ecx, [ebp - 0x264]
call fcn.0045b410
lea ecx, [ebp - 0x298]
call fcn.00432f90
lea ecx, [ebp - 0x284]
call fcn.00432fe0
lea ecx, [ebp - 0x340]
call fcn.0046ffd0
lea ecx, [ebp - 0x228]
call fcn.0040a2c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00401316
mov esp, ebp
pop ebp
ret 4