Function at 0x4715d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x6a5670]
mov eax, dword [0x526800]
push ebx
push esi
mov esi, dword [0x526728]
lea edx, [ecx + 0xcb]
push edi
mov edi, dword [0x6a5674]
cmp esi, edx
jl 0x47180c
lea ebx, [ecx + 0xeb]
cmp esi, ebx
jg 0x471703
lea ebx, [edi + 0x38]
cmp eax, ebx
jl 0x471703
lea ebx, [edi + 0x47]
cmp eax, ebx
jg 0x471703
mov ecx, dword [0x5e90d8]
test ecx, ecx
je 0x471644
push 0
push 1
push 0
call fcn.00488d70
call fcn.0047be90
test eax, eax
jne 0x4716c0
mov eax, dword [0x6424b8]
lea eax, [eax + eax*8]
lea ecx, [eax*8 + 0x1a3c148]
mov eax, dword [0x5ec1ec]
add eax, dword [0x1a3ba10]
push ecx
push eax
push 0x1a38da8
call fcn.004cce8a
push 1
call fcn.00470af0
push 8
call fcn.00470df0
mov edx, dword [0x5ec29c]
add edx, dword [0x1a3ba10]
mov dword [0x6333d4], 0
push edx
push 0x53b9e8
mov dword [0x526908], 0x31
call fcn.004cce8a
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5ec1f0]
add ecx, dword [0x1a3ba10]
push ecx
push 0x1a38da8
call fcn.004cce8a
push 1
call fcn.00470af0
push 4
call fcn.00470df0
add esp, 0x10
pop edi
pop esi
mov dword [0x526908], 0x2c
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
cmp esi, edx
jl 0x47180c
lea ebx, [ecx + 0xeb]
cmp esi, ebx
jg 0x471739
lea ebx, [edi + 0x50]
cmp eax, ebx
jl 0x471739
lea ebx, [edi + 0x5f]
cmp eax, ebx
jg 0x471739
mov byte [0x6a5659], 2
mov dword [0x526908], 0x29
jmp 0x471a12
cmp esi, edx
jl 0x47180c
lea edx, [ecx + 0xeb]
cmp esi, edx
jg 0x47180c
lea edx, [edi + 0x68]
cmp eax, edx
jl 0x47180c
lea edx, [edi + 0x77]
cmp eax, edx
jg 0x47180c
mov ecx, dword [0x5e90d8]
xor esi, esi
cmp ecx, esi
je 0x47177a
push esi
push 1
push esi
call fcn.00488d70
push 0x44
lea eax, [ebp - 0x148]
push esi
push eax
call fcn.004cce10
push 0x640e88
lea eax, [ebp - 0x104]
push 0x4e6d90
push eax
mov dword [ebp - 0x148], 0x44
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x114], esi
call fcn.004cce8a
add esp, 0x18
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x148]
push edx
push esi
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 0x1c]
cmp esi, edx
jl 0x47183a
add ecx, 0xaa
cmp esi, ecx
jg 0x47183a
xor ecx, ecx
lea edx, [edi + 0x42]
lea ebx, [edx - 0x10]
cmp eax, ebx
jl 0x471831
cmp eax, edx
jle 0x4718b6
inc ecx
add edx, 0xf
cmp ecx, 5
jl 0x471822
cmp dword [0x6a5560], 5
jle 0x471a27
mov edx, dword [0x6a5670]
lea ecx, [edx + 0xb3]
cmp esi, ecx
jl 0x47196f
lea ecx, [edx + 0xb7]
cmp esi, ecx
jg 0x47196f
mov ecx, dword [0x6a565c]
lea ebx, [ecx + edi + 0x32]
cmp eax, ebx
jl 0x47196f
lea ebx, [ecx + edi + 0x47]
cmp eax, ebx
jg 0x47196f
pop edi
mov dword [0x41ec334], esi
sub eax, ecx
pop esi
mov byte [0x6a565a], 1
mov dword [0x63f0a4], eax
mov dword [0x631e24], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6a5664]
add eax, ecx
mov ecx, dword [0x5e90d8]
mov dword [0x6424b8], eax
test ecx, ecx
je 0x4718d7
push 0
push 1
push 0
call fcn.00488d70
cmp byte [ebp + 8], 0
je 0x471a27
call fcn.0047be90
test eax, eax
jne 0x47195d
mov eax, dword [0x6424b8]
lea ecx, [eax + eax*8]
lea edx, [ecx*8 + 0x1a3c148]
mov ecx, dword [0x5ec1ec]
add ecx, dword [0x1a3ba10]
push edx
push ecx
push 0x1a38da8
call fcn.004cce8a
push 1
call fcn.00470af0
push 8
call fcn.00470df0
mov eax, dword [0x5ec29c]
add eax, dword [0x1a3ba10]
mov dword [0x6333d4], 0
push eax
push 0x53b9e8
mov dword [0x526908], 0x31
call fcn.004cce8a
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
mov edx, dword [0x5ec1f0]
add edx, dword [0x1a3ba10]
push edx
jmp 0x4716cd
lea ecx, [edx + 0xb1]
cmp esi, ecx
jl 0x471a27
lea ebx, [edx + 0xb9]
cmp esi, ebx
jg 0x4719c3
lea ebx, [edi + 0x27]
cmp eax, ebx
jl 0x4719c3
lea ebx, [edi + 0x32]
cmp eax, ebx
jg 0x4719c3
cmp dword [0x6a5664], 0
jle 0x4719ba
dec dword [0x6a5664]
fild dword [0x6a5664]
fdiv dword [0x6a566c]
call fcn.004ccd60
mov dword [0x6a565c], eax
mov byte [0x6a565b], 3
jmp 0x471a12
cmp esi, ecx
jl 0x471a27
add edx, 0xb9
cmp esi, edx
jg 0x471a27
lea edx, [edi + 0x7e]
cmp eax, edx
jl 0x471a27
add edi, 0x89
cmp eax, edi
jg 0x471a27
mov eax, dword [0x6a5664]
cmp eax, dword [0x6a5668]
jge 0x471a0b
inc dword [0x6a5664]
fild dword [0x6a5664]
fdiv dword [0x6a566c]
call fcn.004ccd60
mov dword [0x6a565c], eax
mov byte [0x6a565b], 4
mov ecx, dword [0x5e90d8]
test ecx, ecx
je 0x471a27
push 0
push 1
push 0
call fcn.00488d70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ccd49
mov esp, ebp
pop ebp
ret