Function at 0x40479c
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x417b8a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e0
push ebx
push esi
push edi
call fcn.0040d480
cdq
mov ecx, 0x1626
idiv ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], 0x3614287
mov eax, dword [esp + 0xc]
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x4047eb
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
add eax, 0x1628
je 0x404804
inc dword [esp + 0xc]
push 0x10
lea eax, [esp + 0x78]
push ebx
push eax
call fcn.0040ebb0
add esp, 0xc
mov dword [esp + 0xc], ebx
push 2
mov dword [esp + 0x1c], 0x1629
mov dword [esp + 0x10], ebx
pop edi
jmp 0x404837
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], eax
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, edi
jl 0x404829
push 0x44
pop esi
push esi
lea eax, [esp + 0x1a4]
push ebx
push eax
call fcn.0040ebb0
add esp, 0xc
call fcn.0040d480
cdq
mov ecx, 0x36205dc
idiv ecx
mov dword [esp + 0xc], edx
call fcn.0040d480
cdq
mov ecx, 0x162b
idiv ecx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
imul eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x1a0], esi
call fcn.0040d480
cdq
mov ecx, 0x3622ced
idiv ecx
mov dword [esp + 0xc], edx
call fcn.0040d480
cdq
mov ecx, 0x162c
idiv ecx
mov esi, dword [ebp + 8]
mov dword [esp + 0x1c], 0x20
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
imul eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov eax, dword [eax]
and eax, 0xf000
mov dword [esp + 0x18], ebx
cmp eax, 0x2000
je 0x404908
cmp eax, 0x8000
jne 0x404938
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
add eax, 0x1633
mov dword [esp + 0x1c], 0x80
je 0x404938
inc dword [esp + 0xc]
jmp 0x404938
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0x1631
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0xc], ebx
jmp 0x404930
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], eax
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, edi
jl 0x404922
call fcn.004037f5
mov dword [esi + 0x10], eax
lea eax, [esi + 0x1c]
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xfc]
push eax
mov dword [esi + 0x14], edx
call fcn.00406d54
push eax
lea eax, [esp + 0x174]
push eax
mov dword [esp + 0x204], ebx
call fcn.00406dc9
add esi, 0x38
lea ecx, [esp + 0xec]
push esi
push ecx
mov ecx, eax
mov byte [esp + 0x20c], 1
call fcn.00406dfe
add esp, 0x18
push 1
xor edi, edi
lea esi, [esp + 0x16c]
mov byte [esp + 0x1f8], 3
call fcn.00403438
push 1
lea esi, [esp + 0xfc]
mov byte [esp + 0x1f8], 4
call fcn.00403438
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], ebx
call esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4049d7
call esi
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x10]
lea ebx, [esp + 0x2c]
call fcn.00406e29
mov byte [esp + 0x1f4], 5
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
add eax, 0x1637
je 0x404a03
inc dword [esp + 0xc]
lea ecx, [esp + 0xdc]
lea ebx, [esp + 0x58]
call fcn.00406e29
mov byte [esp + 0x1f4], 6
call fcn.0040d480
cdq
mov ecx, 0x1638
idiv ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0x36401b9
mov eax, dword [esp + 0xc]
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x404a44
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x14], 0x10
mov dword [esp + 0xc], eax
jb 0x404a56
mov eax, dword [edi]
jmp 0x404a58
mov eax, edi
xor ebx, ebx
push ebx
push eax
call fcn.00408fdd
pop ecx
pop ecx
test al, al
jne 0x404cdc
mov eax, edi
call fcn.00406281
cmp eax, 0xffffffff
jne 0x404cdc
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x404a9e
push str.windows5691XP
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x404a9e
mov dword [esp + 0xc], ebx
push str.PATH
lea esi, [esp + 0x188]
call fcn.0040879a
pop ecx
push eax
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x1fc], 7
call fcn.00408580
pop ecx
pop ecx
push 1
xor edi, edi
mov byte [esp + 0x1f8], 9
call fcn.00403438
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x404af9
push str.windows5692XP
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x404af9
mov dword [esp + 0xc], ebx
push str.SYSTEMROOT
lea esi, [esp + 0xc4]
call fcn.0040879a
pop ecx
mov byte [esp + 0x1f4], 0xa
xor eax, eax
mov byte [esp + 0x28], bl
lea edi, [esp + 0x29]
stosb byte es:[edi], al
mov al, byte [0x41a6b1]
cmp dword [esp + 0xd4], 0x10
mov byte [esp + 0x28], al
mov eax, dword [esp + 0xc0]
jae 0x404b3a
mov eax, esi
push eax
lea eax, [esp + 0x150]
push str._sSYSTEM32
push eax
call fcn.00408c79
add esp, 0xc
mov ecx, eax
lea edi, [esp + 0x48]
mov byte [esp + 0x1f4], 0xb
call fcn.00406345
push 1
xor edi, edi
lea esi, [esp + 0x150]
mov byte [esp + 0x1f8], 0xa
call fcn.00403438
xor eax, eax
mov byte [esp + 0x20], bl
lea edi, [esp + 0x21]
stosb byte es:[edi], al
mov al, byte [0x41a6c9]
mov byte [esp + 0x20], al
lea ecx, [esp + 0xc0]
lea edi, [esp + 0x48]
call fcn.004063bc
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], ebx
call esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x404bbd
call esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x404bc9
mov eax, dword [eax]
lea ecx, [esp + 0x48]
push ecx
push eax
lea eax, [esp + 0x138]
push eax
call fcn.00409513
add esp, 0xc
mov ecx, eax
lea ebx, [esp + 0x114]
mov byte [esp + 0x1f4], 0xc
call fcn.00406e29
mov ebx, eax
lea eax, [esp + 0x2c]
mov byte [esp + 0x1f4], 0xd
cmp eax, ebx
je 0x404c52
push 1
xor edi, edi
mov esi, eax
call fcn.004066ec
cmp dword [ebx + 0x14], 8
jae 0x404c2d
mov eax, dword [ebx + 0x10]
inc eax
add eax, eax
push eax
mov eax, esi
push ebx
push eax
call fcn.0040ca80
add esp, 0xc
jmp 0x404c35
mov eax, dword [ebx]
mov dword [esp + 0x2c], eax
and dword [ebx], edi
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x3c], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x40], eax
and dword [ebx + 0x10], edi
xor eax, eax
mov dword [ebx + 0x14], 7
mov word [ebx], ax
push 1
xor edi, edi
lea esi, [esp + 0x118]
call fcn.004066ec
push 1
lea esi, [esp + 0x134]
mov byte [esp + 0x1f8], 0xa
call fcn.00403438
call fcn.0040d480
cdq
mov ecx, 0x3656152
idiv ecx
mov dword [esp + 0x10], edx
call fcn.0040d480
cdq
mov ecx, 0x1641
idiv ecx
push 1
lea esi, [esp + 0xc4]
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
imul eax, ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x1f8], 9
call fcn.00403438
lea esi, [esp + 0x48]
mov byte [esp + 0x1f4], 6
call fcn.00406780
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
add eax, 0x1642
je 0x404cef
inc dword [esp + 0x10]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
test dword [eax], 0x600
je 0x404ebf
call fcn.00409b0a
test al, al
jne 0x404ebf
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0x1645
mov dword [esp + 0xc], ebx
jmp 0x404d29
call esi
mov dword [esp + 0x14], eax
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 2
jl 0x404d1f
push 0x3c
pop edi
push edi
lea eax, [esp + 0x88]
push ebx
push eax
call fcn.0040ebb0
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x1c]
add esp, 0xc
add eax, 0x1646
je 0x404d5a
inc dword [esp + 0x10]
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], 0x4140
call fcn.0040d480
cdq
mov ecx, 0x1648
idiv ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x36672c9
mov eax, dword [esp + 0x10]
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x404d95
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x40], 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x90], str.runas
jae 0x404db3
lea eax, [esp + 0x2c]
cmp dword [esp + 0x6c], 8
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x58]
jae 0x404dc9
lea eax, [esp + 0x58]
mov dword [esp + 0x98], eax
call fcn.0040d480
cdq
mov ecx, 0x366e7fc
idiv ecx
mov dword [esp + 0x10], edx
call fcn.0040d480
cdq
mov ecx, 0x164b
idiv ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
imul eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0x164c
mov dword [esp + 0xc], ebx
jmp 0x404e2c
call esi
mov dword [esp + 0x14], eax
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 2
jl 0x404e22
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x404eab
cmp dword [esp + 0xa4], 0x20
jbe 0x404eab
xor eax, eax
mov byte [esp + 0x24], bl
lea edi, [esp + 0x25]
stosb byte es:[edi], al
mov al, byte [0x41a6e1]
mov byte [esp + 0x24], al
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test byte [ecx], 0x44
je 0x404e80
push ebx
push dword [esp + 0xc0]
call fcn.00404511
pop ecx
pop ecx
jmp 0x404e8a
mov ecx, dword [esp + 0xbc]
mov dword [eax + 8], ecx
mov dword [esp + 0x14], ebx
call esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x404f9f
call esi
mov dword [esp + 0x14], eax
jmp 0x404f9f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test dword [eax], 0x400
jne 0x404f9f
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404ee2
push str.windows5714XP
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x404ee2
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x6c], 8
mov ecx, dword [esp + 0x58]
jae 0x404ef1
lea ecx, [esp + 0x58]
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x404f00
lea eax, [esp + 0x2c]
lea edx, [esp + 0x74]
push edx
lea edx, [esp + 0x1a4]
push edx
push ebx
push ebx
push dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404f8a
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x404f45
push str.windows5715XP
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x404f45
mov dword [esp + 0x1c], ebx
mov eax, dword [edi]
test byte [eax], 0x44
je 0x404f5c
push ebx
push dword [esp + 0x78]
mov eax, edi
call fcn.00404511
pop ecx
pop ecx
jmp 0x404f63
mov eax, dword [esp + 0x74]
mov dword [edi + 8], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0x1654
mov dword [esp + 0xc], ebx
jmp 0x404f7f
call esi
mov dword [esp + 0x14], eax
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 2
jl 0x404f75
jmp 0x404f9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esp + 0x1c], eax
push ebx
mov eax, edi
call fcn.00404511
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x5c]
call fcn.004066ec
push 1
lea esi, [esp + 0x30]
call fcn.004066ec
or dword [esp + 0x1f4], 0xffffffff
push 1
lea esi, [esp + 0xe0]
call fcn.00403438
mov ecx, dword [esp + 0x1ec]
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret