Function at 0x47d692
Capabilities:
Create process on windows

Disassembly:
push 0x12c
mov eax, 0x4be4f0
call fcn.004b6a29
mov dword [ebp - 0xf0], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x58]
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0xec], eax
call fcn.0040ff2a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00488074
cmp dword [ebp - 0x44], 0x10
mov ebx, dword [ebp - 0x58]
jae 0x47d6d4
lea ebx, [ebp - 0x58]
push str..exe
push ebx
call fcn.00496470
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x47d71c
push str..cmd
push ebx
call fcn.00496470
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x47d71c
push str..bat
push ebx
call fcn.00496470
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x47d71c
push str..com
push ebx
call fcn.00496470
pop ecx
pop ecx
mov edi, eax
cmp dword [esi + 0x14], 0x10
jb 0x47d726
mov eax, dword [esi]
jmp 0x47d728
mov eax, esi
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
jb 0x47d733
mov esi, dword [esi]
push dword [ebp - 0xec]
inc ecx
xor edx, edx
add eax, ecx
mov dword [ebp - 0xfc], edx
push eax
push esi
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0xf8], edx
mov dword [ebp - 0xf4], edx
call fcn.004115d2
xor esi, esi
test edi, edi
je 0x47d77f
mov al, byte [edi + 4]
test al, al
je 0x47d76e
cmp al, 0x20
jne 0x47d77f
sub edi, ebx
mov ebx, dword [ebp - 0xfc]
lea esi, [edi + 4]
mov edi, ebx
add esi, ebx
jmp 0x47d7b1
mov ebx, dword [ebp - 0xfc]
cmp byte [ebx], 0x22
je 0x47d79a
push 0x20
push ebx
mov edi, ebx
call fcn.004932a0
pop ecx
pop ecx
mov esi, eax
jmp 0x47d7b1
lea edi, [ebx + 1]
push 0x22
push edi
call fcn.004932a0
pop ecx
pop ecx
test eax, eax
je 0x47d7b1
mov byte [eax], 0
lea esi, [eax + 1]
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
mov byte [ebp - 4], 2
test esi, esi
je 0x47d7ea
cmp byte [esi], al
je 0x47d7ea
mov byte [esi], al
inc esi
cmp byte [esi], 0x20
je 0x47d7ce
cmp byte [esi], 0
je 0x47d7ea
push esi
call fcn.00401468
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004017c0
mov edx, edi
lea ecx, [ebp - 0x88]
call fcn.00430c28
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa0]
call fcn.00430ca8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
mov edx, dword [ebp - 0xec]
call fcn.00430c28
mov edi, dword [ebp - 0xf0]
xor eax, eax
mov byte [ebp - 4], 5
add edi, 0x73c
cmp dword [ebp - 0x74], 8
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov eax, dword [edi]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x138], 0x3c
mov dword [ebp - 0x134], 0x400
mov dword [ebp - 0x12c], str.open
jae 0x47d88f
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x8c], 8
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0xa0]
jae 0x47d8aa
lea eax, [ebp - 0xa0]
cmp dword [ebp - 0x5c], 8
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x70]
jae 0x47d8bc
lea eax, [ebp - 0x70]
mov dword [ebp - 0x120], eax
xor esi, esi
lea eax, [ebp - 0x138]
inc esi
push eax
mov dword [ebp - 0x11c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x47d9d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Error_while_launching:_n_
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.004016ae
push ebx
mov byte [ebp - 4], 6
call fcn.00401468
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00401dc0
cmp dword [ebp - 0x18], 0
je 0x47d936
mov ebx, str.__with_Params:_n_
push ebx
call fcn.004914f0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00401dc0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00401d1b
mov ebx, 0x4eb0b4
push ebx
call fcn.004914f0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00401dc0
mov edx, esi
lea ecx, [ebp - 0xd0]
call fcn.0047af85
mov esi, eax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xe8]
call fcn.00430ca8
push esi
mov edx, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb8]
call fcn.00480356
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0xe8]
xor esi, esi
push ebx
inc esi
push esi
call fcn.0040f05a
push ebx
push esi
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0xb
call fcn.0040f05a
mov ecx, dword [ebp - 0xf0]
lea edx, [ebp - 0xb8]
push ebx
push edx
push edi
mov eax, dword [ecx]
call dword [eax + 0xb0]
push ebx
push esi
lea ecx, [ebp - 0xb8]
call fcn.0040f05a
push ebx
push esi
lea ecx, [ebp - 0x40]
call fcn.0040177c
jmp 0x47d9d5
xor ebx, ebx
push ebx
push esi
lea ecx, [ebp - 0x70]
call fcn.0040f05a
push ebx
push esi
lea ecx, [ebp - 0xa0]
call fcn.0040f05a
push ebx
push esi
lea ecx, [ebp - 0x88]
call fcn.0040f05a
push ebx
push esi
lea ecx, [ebp - 0x28]
call fcn.0040177c
lea ecx, [ebp - 0xfc]
call fcn.004028f1
push ebx
push esi
lea ecx, [ebp - 0x58]
call fcn.0040177c
call fcn.004b69d8
ret 8