Function at 0x47b1fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1bf
push 0
push 0
dec ecx
jne 0x47b204
push ecx
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 0xdac]
mov edx, dword [0x407990]
call fcn.00404f70
xor eax, eax
push ebp
push 0x47b754
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x47b76c
lea eax, [ebp - 0xdb0]
call fcn.0047ac2c
push dword [ebp - 0xdb0]
push 0x47b790
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040493c
lea eax, [ebp - 0xdb4]
mov ecx, 0x47b7d4
mov edx, dword [ebp - 8]
call fcn.004048c8
mov eax, dword [ebp - 0xdb4]
lea ecx, [ebp - 0xdac]
mov edx, 0x3f
call fcn.004091c4
test eax, eax
jne 0x47b44d
lea ecx, [ebp - 0xdb8]
mov edx, 4
mov eax, dword [ebp - 0xda0]
call fcn.0042d90c
mov edx, dword [ebp - 0xdb8]
mov eax, 0x47b7e0
call fcn.004049c8
jne 0x47b43a
lea eax, [ebp - 0xdbc]
mov ecx, dword [ebp - 0xda0]
mov edx, dword [ebp - 8]
call fcn.004048c8
mov eax, dword [ebp - 0xdbc]
lea edx, [ebp - 0x630]
xor ecx, ecx
call fcn.0047ada0
test al, al
je 0x47b43a
lea eax, [ebp - 0xdc4]
lea edx, [ebp - 0x630]
mov ecx, 0x105
call fcn.0040482c
mov eax, dword [ebp - 0xdc4]
lea edx, [ebp - 0xdc0]
call fcn.00408664
mov edx, dword [ebp - 0xdc0]
mov eax, 0x47b7f0
call fcn.00404bc0
test eax, eax
jle 0x47b43a
lea eax, [ebp - 0xdcc]
lea edx, [ebp - 0x21b]
mov ecx, 0x105
call fcn.0040482c
mov eax, dword [ebp - 0xdcc]
lea edx, [ebp - 0xdc8]
call fcn.00408664
mov edx, dword [ebp - 0xdc8]
mov eax, 0x47b808
call fcn.00404bc0
test eax, eax
jle 0x47b43a
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0xda0]
mov edx, dword [ebp - 8]
call fcn.004048c8
lea eax, [ebp - 0xdd0]
lea edx, [ebp - 0x630]
mov ecx, 0x105
call fcn.0040482c
mov edx, dword [ebp - 0xdd0]
lea eax, [ebp - 0xc54]
call fcn.00409564
lea esi, [ebp - 0x52b]
lea edi, [ebp - 0xb4f]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x42b]
lea edi, [ebp - 0xa4f]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x948], eax
lea esi, [ebp - 0x320]
lea edi, [ebp - 0x944]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x47b810
lea edi, [ebp - 0x83f]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ax, word [ebp - 0x116]
mov word [ebp - 0x73a], ax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x734], eax
mov esi, 0x47b918
lea edi, [ebp - 0x730]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0xc54]
mov eax, dword [ebp - 4]
call fcn.0047b054
lea eax, [ebp - 0xdac]
call fcn.00409214
test eax, eax
je 0x47b289
lea eax, [ebp - 0xdac]
call fcn.00409238
lea eax, [ebp - 8]
mov edx, 0x47ba20
call fcn.00404654
lea eax, [ebp - 0xdd4]
mov ecx, 0x47b7d4
mov edx, dword [ebp - 8]
call fcn.004048c8
mov eax, dword [ebp - 0xdd4]
lea ecx, [ebp - 0xdac]
mov edx, 0x3f
call fcn.004091c4
test eax, eax
jne 0x47b65a
lea ecx, [ebp - 0xdd8]
mov edx, 4
mov eax, dword [ebp - 0xda0]
call fcn.0042d90c
mov edx, dword [ebp - 0xdd8]
mov eax, 0x47b7e0
call fcn.004049c8
jne 0x47b647
lea eax, [ebp - 0xddc]
mov ecx, dword [ebp - 0xda0]
mov edx, dword [ebp - 8]
call fcn.004048c8
mov eax, dword [ebp - 0xddc]
lea edx, [ebp - 0x630]
xor ecx, ecx
call fcn.0047ada0
test al, al
je 0x47b647
lea eax, [ebp - 0xde4]
lea edx, [ebp - 0x630]
mov ecx, 0x105
call fcn.0040482c
mov eax, dword [ebp - 0xde4]
lea edx, [ebp - 0xde0]
call fcn.00408664
mov edx, dword [ebp - 0xde0]
mov eax, 0x47b7f0
call fcn.00404bc0
test eax, eax
jle 0x47b647
lea eax, [ebp - 0xdec]
lea edx, [ebp - 0x21b]
mov ecx, 0x105
call fcn.0040482c
mov eax, dword [ebp - 0xdec]
lea edx, [ebp - 0xde8]
call fcn.00408664
mov edx, dword [ebp - 0xde8]
mov eax, 0x47b808
call fcn.00404bc0
test eax, eax
jle 0x47b647
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0xda0]
mov edx, dword [ebp - 8]
call fcn.004048c8
lea eax, [ebp - 0xdf0]
lea edx, [ebp - 0x630]
mov ecx, 0x105
call fcn.0040482c
mov edx, dword [ebp - 0xdf0]
lea eax, [ebp - 0xc54]
call fcn.00409564
lea esi, [ebp - 0x52b]
lea edi, [ebp - 0xb4f]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x42b]
lea edi, [ebp - 0xa4f]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x948], eax
lea esi, [ebp - 0x320]
lea edi, [ebp - 0x944]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x47b810
lea edi, [ebp - 0x83f]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ax, word [ebp - 0x116]
mov word [ebp - 0x73a], ax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x734], eax
mov esi, 0x47b918
lea edi, [ebp - 0x730]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0xc54]
mov eax, dword [ebp - 4]
call fcn.0047b054
lea eax, [ebp - 0xdac]
call fcn.00409214
test eax, eax
je 0x47b496
lea eax, [ebp - 0xdac]
call fcn.00409238
lea edx, [ebp - 0xc]
mov eax, dword [0x47fc18]
mov eax, dword [eax]
call fcn.004597bc
lea eax, [ebp - 0xdf4]
push eax
mov ecx, 0x47ba88
mov edx, 0x47ba98
mov eax, dword [ebp - 0xc]
call fcn.0042d8e0
mov edx, dword [ebp - 0xdf4]
lea eax, [ebp - 0xc]
call fcn.00404654
cmp dword [ebx + 0x320], 0
je 0x47b6dc
push 0
push 0x47baa8
push dword [ebp - 0xc]
push 0x47babc
push dword [ebx + 0x320]
lea eax, [ebp - 0xdf8]
mov edx, 4
call fcn.0040493c
mov eax, dword [ebp - 0xdf8]
call fcn.00404a7c
push eax
call sub.kernel32.dll_WinExec
jmp 0x47b70c
push 0
push 0x47baa8
push dword [ebp - 0xc]
push 0x47bac8
lea eax, [ebp - 0xdfc]
mov edx, 3
call fcn.0040493c
mov eax, dword [ebp - 0xdfc]
call fcn.00404a7c
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x47fc18]
mov eax, dword [eax]
call fcn.00459298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b75b
lea eax, [ebp - 0xdfc]
mov edx, 0x14
call fcn.004045e0
lea eax, [ebp - 0xdac]
mov edx, dword [0x407990]
call fcn.00405040
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045e0
ret