Function at 0x47fd6a
Capabilities:
Create process on windows

Disassembly:
push 0x1ac
mov eax, 0x520557
call fcn.004d8af2
mov bh, dl
mov byte [ebp - 0x41], bh
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov bl, byte [ebp + 0x10]
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x138]
mov dword [ebp - 4], 1
call fcn.00431fa4
push ecx
mov byte [ebp - 4], 2
mov esi, esp
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x34], eax
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x48]
mov dword [esi], eax
call fcn.0042a066
push eax
mov edx, str.key
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.004093b4
pop ecx
pop ecx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.00407189
push ecx
mov esi, esp
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x40], eax
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x30]
mov dword [esi], eax
call fcn.0047fac9
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x2c], esi
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x30]
mov dword [esi], eax
call fcn.0047fa4a
movzx eax, bh
push eax
movzx eax, bl
push eax
lea eax, [ebp - 0x38]
push str.frozen_dsilent_d
push eax
call fcn.004011e0
add esp, 0x14
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x30]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004d5d16
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x8c]
call fcn.00476c24
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 7
call fcn.00476c5c
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00476d88
push eax
mov edx, 0x544518
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x48]
call fcn.004093b4
pop ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x30]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004d5d16
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x48]
call fcn.0040687a
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xa
push eax
mov edx, str.https:__ninite.com_license_
lea ecx, [ebp - 0x38]
call fcn.004093b4
pop ecx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xb
call fcn.00405d6e
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.00407189
push dword [0x57d3f4]
lea ecx, [ebp - 0x1b8]
push dword [0x57d3f0]
call fcn.0042d6ec
push ecx
mov byte [ebp - 4], 0xc
mov esi, esp
mov dword [ebp - 0x2c], esi
mov ebx, dword [ebp - 0x48]
add ebx, 0xfffffff0
mov ecx, ebx
mov dword [ebp - 0x4c], ebx
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x1b8]
mov dword [esi], eax
lea eax, [ebp - 0x70]
push eax
call fcn.0042d9ba
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x70], 0
jge 0x47ffa9
cmp dword [ebp - 0x6c], 0
mov eax, 0x2a0b
cmovne eax, dword [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
push ecx
mov esi, esp
mov dword [ebp - 0x2c], esi
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x1c]
mov dword [esi], eax
call fcn.00406620
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0xe
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x1b8]
call fcn.0042dec1
mov ecx, ebx
jmp 0x480295
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x138]
call fcn.0042ed91
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x64], 0
jge 0x480002
cmp byte [ebp + 0x14], 0
je 0x47fff5
and dword [edi + 4], 0
lea ecx, [edi + 8]
mov dword [edi], 1
call fcn.0040687a
mov ecx, dword [ebp - 0x5c]
jmp 0x47ff8f
lea eax, [ebp - 0x64]
mov ecx, edi
push eax
call fcn.0040121b
jmp 0x47fff0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x124]
call fcn.0040dd33
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push ecx
cmovae eax, dword [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0040dbb2
lea ecx, [ebp - 0x3c]
call fcn.00429ecd
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x12
call fcn.0040fc1e
push 2
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040452e
mov edx, 0x53d410
mov ecx, eax
call fcn.004044d6
mov ecx, dword [ebp - 0x38]
mov bl, al
add ecx, 0xfffffff0
call fcn.00407189
test bl, bl
je 0x48007d
and dword [edi], 0
lea ecx, [edi + 8]
and dword [edi + 4], 0
call fcn.0040687a
jmp 0x480271
push 5
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040452e
mov edx, str.GOTO:
mov ecx, eax
call fcn.004044d6
mov ecx, dword [ebp - 0x38]
mov bl, al
add ecx, 0xfffffff0
call fcn.00407189
test bl, bl
je 0x480249
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x3c]
mov eax, dword [eax - 0xc]
add eax, 0xfffffffb
push eax
push 5
lea eax, [ebp - 0x2c]
push eax
call fcn.0040467c
mov ebx, dword [ebp - 0x34]
push ecx
mov byte [ebp - 4], 0x13
mov esi, esp
mov ecx, ebx
mov dword [ebp - 0x50], esi
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x50]
mov dword [esi], eax
call fcn.0042a066
push eax
mov edx, str.key
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x38]
call fcn.004093b4
pop ecx
pop ecx
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.00407189
push ecx
mov ecx, dword [ebp - 0x38]
mov esi, esp
add ecx, 0xfffffff0
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x34], esi
call fcn.004070e7
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x2c]
push ecx
add eax, 0xfffffff0
mov esi, esp
mov dword [ebp - 0x34], esi
mov ecx, eax
mov dword [ebp - 0x34], eax
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x54]
mov dword [esi], eax
mov byte [ebp - 4], 0x16
call fcn.00429a1c
pop ecx
pop ecx
cmp byte [ebp - 0x41], 0
mov byte [ebp - 4], 0x18
je 0x480216
push 0x2a1f
lea eax, [ebp - 0x54]
mov edx, str.Please_run_in_non_silent_mode_or_go_to
push 0x80004005
push eax
lea ecx, [ebp - 0x50]
call fcn.004093b4
mov ecx, esp
mov byte [ebp - 4], 0x19
push str._for_more_information
mov edx, eax
call fcn.00409442
pop ecx
mov ecx, edi
call fcn.00406620
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x34]
call fcn.00407189
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x1b8]
call fcn.0042dec1
mov ecx, dword [ebp - 0x4c]
call fcn.00407189
lea ecx, [ebp - 0x8c]
call fcn.0047f5e4
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x128]
call fcn.0040ca92
lea ecx, [ebp - 0x12c]
call fcn.00427477
mov ecx, ebx
jmp 0x4802c9
push 1
xor eax, eax
push eax
push eax
push dword [ebp - 0x54]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x2a23
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, edi
call fcn.00406620
jmp 0x48019c
cmp byte [ebp + 0x14], 0
jne 0x480069
push 0x2a2a
push 0x80004005
push ecx
mov ecx, esp
push str.Invalid_response
call fcn.00406fea
mov ecx, edi
call fcn.00406620
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x1b8]
call fcn.0042dec1
mov ecx, dword [ebp - 0x4c]
call fcn.00407189
lea ecx, [ebp - 0x8c]
call fcn.0047f5e4
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x128]
call fcn.0040ca92
lea ecx, [ebp - 0x12c]
call fcn.00427477
mov ecx, dword [ebp - 0x34]
call fcn.00407189
mov ecx, dword [ebp - 0x40]
call fcn.00407189
mov eax, edi
call fcn.004d8aa1
ret