Function at 0x47d7ed
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp + 0x14]
lea edi, [ebp - 4]
or dword [ebp - 4], 0xffffffff
mov edx, eax
push 2
push 1
mov ecx, dword [esi]
xor ebx, ebx
mov eax, ecx
mov dword [ebp - 0x10], ebx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
push ebx
push edi
mov eax, dword [eax*4 + 0x4f2d28]
push edx
push dword [eax + ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x47da57
push dword [esi]
call fcn.004b2fbb
push dword [ebp + 0xc]
or dword [esi], 0xffffffff
push dword [esi + 4]
call fcn.004b9f33
mov ebx, eax
add esp, 0xc
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x47da57
xor edi, edi
push edi
call fcn.0047e455
mov esi, eax
pop ecx
test esi, esi
jne 0x47d87d
push ebx
call fcn.0047880c
pop ecx
jmp 0x47da57
push 0x4dcef8
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push edi
push eax
call fcn.0047785d
add esp, 0xc
test eax, eax
je 0x47d8dc
cmp eax, 0x16
je 0x47dab5
mov ebx, edi
mov edi, 0x4dced0
mov dword [ebp - 0xc], edi
xor eax, eax
push 0x44
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0046b7d0
mov ecx, dword [0x4f2d28]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], pe_nt_image_headers32
jne 0x47d8ea
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
jmp 0x47d8f9
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x47d8a1
mov edi, ebx
mov dword [ebp - 0xc], ebx
jmp 0x47d8a9
cmp dword [ebp + 0x10], 1
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
je 0x47d8fc
mov eax, dword [ecx + 0x50]
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 0x88]
mov ecx, edi
mov dword [ebp - 0x2c], eax
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x47d90f
sub ecx, edx
mov edx, str.__c
sar ecx, 1
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x10]
jne 0x47d926
sub edx, edi
mov edi, dword [ebp + 8]
sar edx, 1
lea eax, [edi + 2]
mov dword [ebp - 0x18], eax
mov ax, word [edi]
add edi, 2
cmp ax, word [ebp - 0x10]
jne 0x47d93f
sub edi, dword [ebp - 0x18]
inc edx
sar edi, 1
push 2
lea eax, [edi + ecx]
add eax, edx
push eax
mov dword [ebp - 0x10], eax
call fcn.004ae6df
mov edi, eax
mov dword [ebp - 0x18], edi
pop ecx
pop ecx
test edi, edi
jne 0x47d98e
push edi
call fcn.004ae742
push ebx
call fcn.004ae742
mov dword [esi + 4], edi
mov dword [esi], edi
mov eax, dword [ebp - 8]
push eax
call fcn.0047880c
add esp, 0xc
jmp 0x47da57
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push edi
call fcn.004b1c63
add esp, 0xc
test eax, eax
jne 0x47daac
push str.__c
push dword [ebp - 0x10]
push edi
call fcn.004b94e3
add esp, 0xc
test eax, eax
jne 0x47daac
push dword [ebp + 8]
push dword [ebp - 0x10]
push edi
call fcn.004b94e3
add esp, 0xc
test eax, eax
jne 0x47daac
push dword [ebp - 0xc]
call fcn.0047ddc7
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x47d9f9
push edi
call fcn.004ae742
push ebx
call fcn.004ae742
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
jmp 0x47d97d
mov eax, ecx
lea edi, [ebp - 0x28]
sub eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
and eax, ecx
mov dword [ebp - 0x10], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x6c]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x47da6d
push dword [ebp - 0x10]
call fcn.004ae742
push edi
call fcn.004ae742
push ebx
call fcn.004ae742
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov eax, dword [ebp - 8]
push eax
call fcn.0047880c
add esp, 0x10
cmp dword [ebp - 4], 0xffffffff
je 0x47da66
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
call fcn.004ae742
push edi
call fcn.004ae742
push ebx
call fcn.004ae742
add esp, 0xc
cmp dword [ebp - 4], 0xffffffff
je 0x47daa7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x47da68
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x47daba
push edi
push edi
push edi
push edi
push edi
call fcn.004ae65e
int3