Function at 0x477880
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1864
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x185c], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x1070], ax
lea eax, [esp + 0x1072]
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0x1068]
push 0x4def98
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1068]
push 0x4bfb28
push eax
call ebp
push 0x4bfb48
lea eax, [esp + 0x106c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00494805
add esp, 0xc
test eax, eax
jne 0x47847b
push 0x4bfb68
push 0x4bfc1c
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
lea eax, [esp + 0x58]
push eax
call fcn.00496d93
add esp, 4
lea eax, [esp + 0x58]
push eax
call fcn.00496d9e
add esp, 4
mov ebx, eax
xor eax, eax
mov word [esp + 0x868], ax
push 0x7fe
push eax
lea eax, [esp + 0x872]
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0x11c]
mov ecx, 0x2d
lea edi, [esp + 0x68]
mov esi, 0x4bfc28
rep movsd dword es:[edi], dword [esi]
push 0x74c
push 0
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [ebx + 0x28]
push eax
push ebx
push 0x4bfcdc
lea eax, [esp + 0x874]
push 0x104
push eax
call fcn.0040a370
add esp, 0x14
lea eax, [esp + 0x868]
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
mov ecx, 0x57
sub ecx, eax
add ecx, ecx
cmp ecx, 0x800
jae 0x478494
xor eax, eax
mov word [esp + ecx + 0x68], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
push 0x4bfb68
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
push 0x4bfcf8
push 0x4bfdac
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
push 0x2722
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push 0
push 0
push 0x1004
push eax
mov dword [esp + 0x24], eax
call esi
xor edi, edi
mov dword [esp + 0x18], eax
lea ebx, [edi + 0x58]
test eax, eax
jle 0x477b1f
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push dword [esp + 0x20]
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push 0x4bfdc0
lea eax, [esp + 0x70]
push 0x104
push eax
call fcn.0040a370
add esp, 0x10
mov dword [esp + 0x24], 1
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push dword [esp + 0x20]
call esi
lea eax, [esp + 0x868]
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
mov ecx, ebx
sub ecx, eax
add ecx, ecx
cmp ecx, 0x800
jae 0x478494
xor eax, eax
mov word [esp + ecx + 0x68], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x18]
jl 0x477a51
push 0x4bfe80
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4def98
call dword [sym.imp.kernel32.dll_lstrlenW]
sub ebx, eax
add ebx, ebx
cmp ebx, 0x800
jae 0x478494
xor eax, eax
mov word [esp + ebx + 0x68], ax
lea eax, [esp + 0x68]
push 0x4def98
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
push 0x4bff48
push 0x4bfdac
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
push 0x2776
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x477d68
nop word [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
push 0x4bfffc
lea eax, [esp + 0x86c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
push 0x4c0008
lea eax, [esp + 0x86c]
push eax
call ebp
xor eax, eax
mov word [esp + 0x88c], ax
lea eax, [esp + 0x868]
push 0x4c009c
push eax
call ebp
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
push 0x4c00a8
lea eax, [esp + 0x86c]
push eax
call ebp
xor eax, eax
mov word [esp + 0x8d2], ax
lea eax, [esp + 0x868]
push 0x4c0150
push eax
call ebp
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 3
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
push 0x4c0168
lea eax, [esp + 0x86c]
push eax
call ebp
xor eax, eax
mov word [esp + 0x8f8], ax
lea eax, [esp + 0x868]
push 0x4c0194
push eax
call ebp
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 4
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x86c]
push eax
call ebp
lea eax, [esp + 0x868]
push eax
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x18]
jl 0x477bc0
push 0x2808
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x477e8b
push 0x4c01a8
push 0x4bfdac
push dword [esp + 0x18]
call fcn.00478b30
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x477e8b
nop word [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push 0x4c0260
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a370
add esp, 0x10
push 0xf000
push edi
push 0x102c
push ebx
call esi
shr eax, 0xc
sub eax, 1
jne 0x477e28
mov eax, 0x20
mov word [esp + 0x6a], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
xor eax, eax
mov word [esp + 0xa4], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x477dc0
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
push 0x2762
push dword [0x4def88]
call ebx
xor edx, edx
mov ecx, eax
call fcn.00473ba0
push 0x4c0320
push 0x4bfdac
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
push 0x2762
push dword [0x4def88]
call ebx
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
dec eax
mov edi, 1
mov dword [esp + 0x18], eax
cmp eax, edi
jle 0x47807e
nop word [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push 0x4c03d4
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a370
xor eax, eax
mov dword [esp + 0x34], 1
add esp, 0x10
mov word [esp + 0x76], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
call esi
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
push 0x4c0410
lea eax, [esp + 0x6c]
push eax
call ebp
xor eax, eax
mov word [esp + 0xa0], ax
lea eax, [esp + 0x868]
push 0x4ad29c
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
cmp word [esp + 0x868], 0x5b
jne 0x477fdb
push 0x4c0480
jmp 0x477fe3
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
push 0x4c0410
lea eax, [esp + 0x6c]
push eax
call ebp
xor eax, eax
mov word [esp + 0xb8], ax
lea eax, [esp + 0x868]
push 0x4ad29c
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 3
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
cmp word [esp + 0x868], 0x5b
jne 0x47804e
push 0x4c0480
jmp 0x478056
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x18]
jl 0x477ef0
push 0x2819
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x47820c
push 0x4c0498
push 0x4bfdac
push dword [esp + 0x18]
call fcn.00478b30
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x47820c
nop dword [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 3
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x86a]
push eax
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov eax, 0x5b
mov dword [esp + 0x24], 4
mov word [esp + 0x68], ax
xor eax, eax
mov word [esp + 0x70], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x86a]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
xor eax, eax
mov dword [esp + 0x78], 0x20005d
mov word [esp + 0x7c], ax
lea eax, [esp + 0x868]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x34], 2
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
push 0x4c0550
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x868]
mov dword [esp + 0xca], 0x20
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x34], 6
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x4780d0
push 0x27c4
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x47830b
push 0x4c05b8
push 0x4bfdac
push dword [esp + 0x18]
call fcn.00478b30
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x47830b
nop dword [eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push 0x4bfdc0
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a370
add esp, 0x10
mov dword [esp + 0x24], 1
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
call esi
xor eax, eax
mov word [esp + 0xcc], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x478260
push 0x27c9
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
mov ebx, eax
push 0x1004
push ebx
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x47840b
push 0x4c0670
push 0x4bfdac
push dword [esp + 0x18]
call fcn.00478b30
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x14], edi
jle 0x47840b
nop dword [eax + eax]
lea eax, [esp + 0x868]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
mov dword [esp + 0x44], 0x104
call esi
lea eax, [esp + 0x868]
push eax
push 0x4bfdc0
lea eax, [esp + 0x70]
push 0x400
push eax
call fcn.0040a370
add esp, 0x10
mov dword [esp + 0x24], 1
lea eax, [esp + 0x868]
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push edi
push 0x1073
push ebx
call esi
xor eax, eax
mov word [esp + 0x118], ax
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0x6c]
push eax
call ebp
lea eax, [esp + 0x68]
push eax
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x14]
jl 0x478360
push 0x4bfb68
push 0x4c0724
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
push 0x4c0730
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
push 0x4bfb68
push 0x4bfcf0
push dword [esp + 0x18]
call fcn.00478b30
add esp, 0xc
push dword [esp + 0x10]
call fcn.00494cc4
add esp, 4
lea eax, [esp + 0x1068]
push 5
push 0
push eax
push 0x4ade70
push 0x4af6a8
push dword [0x4def88]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x186c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x1864
ret
call fcn.0048d945
int3