Function at 0x479c00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x479ebf
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040312c
mov eax, dword [0x47e600]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x479c35
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jl 0x479cff
mov eax, dword [0x47e600]
mov eax, dword [eax]
mov edx, 0x479ed4
call fcn.00405338
je 0x479cff
mov eax, dword [0x47e880]
cmp dword [eax], 2
jne 0x479c6f
mov eax, dword [0x47e8dc]
mov dword [eax], 2
jmp 0x479ea4
mov eax, dword [0x47e880]
cmp dword [eax], 1
jne 0x479cff
mov ecx, dword [0x47e7f8]
mov eax, dword [0x47e860]
mov eax, dword [eax]
mov edx, dword [0x46fce4]
call fcn.00457d50
call fcn.00403154
fcomp dword [0x479ee8]
wait
fnstsw ax
sahf
jbe 0x479cbf
mov eax, dword [0x47e7f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x368]
mov edx, 0x479ef4
call fcn.0043b490
jmp 0x479cd9
mov edx, dword [0x47e600]
mov edx, dword [edx]
mov eax, dword [0x47e7f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x368]
call fcn.0043b490
mov eax, dword [0x47e8dc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x47e7f8]
mov eax, dword [eax]
call fcn.00454248
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457c24
jmp 0x479ea4
mov eax, dword [0x47e600]
mov edx, 0x479f10
call fcn.00404f7c
mov ecx, dword [0x47e72c]
mov ecx, dword [ecx]
mov edx, dword [0x47e6dc]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.00405238
mov eax, dword [ebp - 8]
call fcn.0040946c
and eax, 1
test eax, eax
jle 0x479d89
mov eax, dword [0x47e76c]
mov eax, dword [eax]
push eax
push 0xffffffffffffffff
push 0
push 0x479f3c
mov eax, dword [0x47e76c]
push dword [eax]
push 0x479f54
push 0x479f80
push 0x479f8c
push 0x479f80
push 0x479f80
push 0x479fb0
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004052ac
mov eax, dword [ebp - 0xc]
movzx ecx, word [0x479ff4]
mov dl, 2
call fcn.00475fec
call fcn.00403154
fld xword [0x479ff8]
fcompp
wait
fnstsw ax
sahf
jae 0x479e40
mov eax, dword [0x47e76c]
mov eax, dword [eax]
push eax
push 0xffffffffffffffff
push 0
push 0x479f3c
mov eax, dword [0x47e76c]
push dword [eax]
push 0x47a00c
push 0x479f80
push 0x47a028
push 0x47a034
lea eax, [ebp - 0x10]
mov edx, 6
call fcn.004052ac
mov eax, dword [ebp - 0x10]
movzx ecx, word [0x47a074]
mov dl, 3
call fcn.00475fec
cmp eax, 6
jne 0x479e14
push 5
push 0x47a078
push 0x47a078
push 0x47a07c
push 0x47a0b0
mov eax, ebx
call fcn.00442f9c
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x479e33
mov eax, dword [0x47e76c]
mov eax, dword [eax]
push eax
push 0xffffffffffffffff
push 0
movzx ecx, word [0x479ff4]
mov dl, 2
mov eax, 0x47a0c0
call fcn.00475fec
mov eax, dword [0x47e8dc]
mov dword [eax], 1
jmp 0x479ea4
mov ecx, dword [0x47e7f8]
mov eax, dword [0x47e860]
mov eax, dword [eax]
mov edx, dword [0x46fce4]
call fcn.00457d50
mov edx, dword [0x47e600]
mov edx, dword [edx]
mov eax, dword [0x47e7f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x368]
call fcn.0043b490
mov eax, dword [0x47e7f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x368]
mov eax, dword [eax + 0x68]
mov edx, 0xced4ff
call fcn.004205ac
mov eax, dword [0x47e7f8]
mov eax, dword [eax]
call fcn.00454248
mov eax, dword [0x47e860]
mov eax, dword [eax]
call fcn.00457c24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479ec6
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404f4c
ret