Function at 0x47db91
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x542040]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
movzx edi, word [ebp + 8]
lea eax, [esp + 0xc]
push eax
mov esi, ecx
mov dword [esp + 0x10], 0x30
push 0
xorps xmm0, xmm0
mov dword [esp + 0x18], 0x20
push edi
push dword [esi + 0x84]
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x47dc77
lea eax, [edi - 0x3e9]
cmp eax, 0x21
ja case.default.0x47da83
movzx eax, byte [eax + 0x47dcbc]
jmp dword [eax*4 + 0x47dc8c]
push dword [esi + 0x80]
mov edx, dword [esi + 0x70]
push dword [esi + 0x7c]
mov ecx, dword [esi + 4]
push dword [esi + 0x78]
call fcn.0041fe70
jmp 0x47dc74
push dword [esi + 0x80]
mov edx, dword [esi + 0x70]
push dword [esi + 0x7c]
mov ecx, dword [esi + 4]
push dword [esi + 0x78]
call fcn.00428a40
jmp 0x47dc74
push 0
push 0x51cc94
push 0x51cca0
push dword [esi]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 0
push 0x51c748
push 0x51cca0
push dword [esi]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push str.https:__learn.microsoft.com_en_us_windows_win32_api_winnt_ns_winnt_image_nt_headers32
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push str.https:__learn.microsoft.com_en_us_windows_win32_api_winnt_ns_winnt_image_nt_headers64
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push str.https:__learn.microsoft.com_en_us_windows_win32_api_winnt_ns_winnt_image_file_header
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push str.https:__learn.microsoft.com_en_us_windows_win32_api_winnt_ns_winnt_image_optional_header64
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push str.https:__learn.microsoft.com_en_us_windows_win32_api_winnt_ns_winnt_image_optional_header32
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push str.https:__learn.microsoft.com_en_us_windows_win32_api_winnt_ns_winnt_image_data_directory
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push str.https:__learn.microsoft.com_en_us_windows_win32_api_winnt_ns_winnt_image_section_header
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
mov eax, 0xbb8
cmp edi, eax
je case.0x47da83.1001
inc eax
cmp eax, 0xc1c
jb 0x47dc42
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret
push dword [ecx + 0x18]
mov edx, dword [esi + 0x70]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, dword [esi]
call fcn.00494df0
add esp, 0xc
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.004dadd7
mov esp, ebp
pop ebp
ret