Function at 0x47ec0b
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x6ca54d
call fcn.006b9c3c
push ecx
mov eax, 0x3ea4
call fcn.0068aad0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov byte [ebp - 4], 1
mov eax, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x7f
mov esi, dword [sym.imp.KERNEL32.DLL_WinExec]
cmp eax, 2
jge 0x47f45e
push ecx
lea ecx, [ebp - 0x1b74]
call fcn.004859d2
mov edi, eax
mov ecx, ebx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x68
jae 0x47ec89
imul eax, dword [edi + ecx*4 + 0x6c], 0xf
sub eax, 0xf
cdq
idiv dword [ebp - 0x1c]
push 0x7f
pop eax
add eax, edx
cdq
idiv dword [ebp - 0x1c]
mov byte [ecx + edi], dl
inc ecx
jmp 0x47ec66
mov byte [edi + 0x68], bl
push ebx
push edi
call esi
push ecx
lea ecx, [ebp - 0x564]
call fcn.004857c7
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x28], edi
cmp edi, 0x41
jae 0x47ecc8
push 0x18
pop ecx
sub ecx, dword [eax + edi*4 + 0x44]
imul eax, ecx, 0x12
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47eca1
mov byte [eax + 0x41], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x1f94]
call fcn.00485447
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x2c], edi
cmp edi, 0x6a
jae 0x47ed07
push 0x21
pop ecx
sub ecx, dword [eax + edi*4 + 0x6c]
imul eax, ecx, 0x1a
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ece0
mov byte [eax + 0x6a], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x1d80]
call fcn.004850c8
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x30], edi
cmp edi, 0x68
jae 0x47ed46
push 0x46
pop ecx
sub ecx, dword [eax + edi*4 + 0x6c]
imul eax, ecx, 0x23
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ed1f
mov byte [eax + 0x68], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x21b8]
call fcn.00484d33
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x34], edi
cmp edi, 0x6d
jae 0x47ed85
push 0x33
pop ecx
sub ecx, dword [eax + edi*4 + 0x70]
imul eax, ecx, 0x24
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ed5e
mov byte [eax + 0x6d], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x36c4]
call fcn.0048489a
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x38], edi
cmp edi, 0x86
jae 0x47edca
push 0x12
pop ecx
sub ecx, dword [eax + edi*4 + 0x88]
imul eax, ecx, 0x2c
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ed9d
mov byte [eax + 0x86], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x3424]
call fcn.0048441c
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x3c], edi
cmp edi, 0x82
jae 0x47ee12
mov ecx, dword [eax + edi*4 + 0x84]
sub ecx, 0xd
imul eax, ecx, 0x37
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ede5
mov byte [eax + 0x82], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x3964]
call fcn.00483f78
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x40], edi
cmp edi, 0x86
jae 0x47ee5a
push 0x4e
pop ecx
sub ecx, dword [eax + edi*4 + 0x88]
imul eax, ecx, 0x2d
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ee2d
mov byte [eax + 0x86], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x3c04]
call fcn.00483ada
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x44], edi
cmp edi, 0x86
jae 0x47eea2
mov ecx, dword [eax + edi*4 + 0x88]
sub ecx, 3
imul eax, ecx, 0x29
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ee75
mov byte [eax + 0x86], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x3eb0]
call fcn.0048362f
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x48], edi
cmp edi, 0x88
jae 0x47eeea
mov ecx, dword [eax + edi*4 + 0x8c]
sub ecx, 0x52
imul eax, ecx, 0x13
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47eebd
mov byte [eax + 0x88], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x3198]
call fcn.004831d7
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x4c], edi
cmp edi, 0x7e
jae 0x47ef2f
mov ecx, dword [eax + edi*4 + 0x80]
sub ecx, 0x69
imul eax, ecx, 0xf
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ef05
mov byte [eax + 0x7e], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x2f20]
call fcn.00482dde
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x50], edi
cmp edi, 0x76
jae 0x47ef6e
push 0x72
pop ecx
sub ecx, dword [eax + edi*4 + 0x78]
imul eax, ecx, 0x3e
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ef47
mov byte [eax + 0x76], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x23e0]
call fcn.00482a41
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x54], edi
cmp edi, 0x6e
jae 0x47efad
mov ecx, dword [eax + edi*4 + 0x70]
sub ecx, 0x19
imul eax, ecx, 0x1f
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47ef86
mov byte [eax + 0x6e], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x2a88]
call fcn.0048267b
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x58], edi
cmp edi, 0x73
jae 0x47efec
push 6
pop ecx
sub ecx, dword [eax + edi*4 + 0x74]
imul eax, ecx, 0x23
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47efc5
mov byte [eax + 0x73], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x2848]
call fcn.004822be
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x5c], edi
cmp edi, 0x72
jae 0x47f02b
mov ecx, dword [eax + edi*4 + 0x74]
sub ecx, 0x63
imul eax, ecx, 7
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f004
mov byte [eax + 0x72], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x2cd0]
call fcn.00481ef4
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x60], edi
cmp edi, 0x74
jae 0x47f06a
mov ecx, dword [eax + edi*4 + 0x78]
sub ecx, 0x5e
imul eax, ecx, 0xc
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f043
mov byte [eax + 0x74], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x139c]
call fcn.00481bd1
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x64], edi
cmp edi, 0x5e
jae 0x47f0a9
mov ecx, dword [eax + edi*4 + 0x60]
sub ecx, 0x21
imul eax, ecx, 0x37
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f082
mov byte [eax + 0x5e], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x1968]
call fcn.00481891
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x68], edi
cmp edi, 0x65
jae 0x47f0e8
push 0x54
pop ecx
sub ecx, dword [eax + edi*4 + 0x68]
imul eax, ecx, 0x2a
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f0c1
mov byte [eax + 0x65], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0xa9c]
call fcn.00481598
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x6c], edi
cmp edi, 0x5b
jae 0x47f127
push 0x25
pop ecx
sub ecx, dword [eax + edi*4 + 0x5c]
imul eax, ecx, 0x3f
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f100
mov byte [eax + 0x5b], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x176c]
call fcn.00481256
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x70], edi
cmp edi, 0x62
jae 0x47f166
mov ecx, dword [eax + edi*4 + 0x64]
sub ecx, 0x3c
imul eax, ecx, 0x13
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f13f
mov byte [eax + 0x62], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x1580]
call fcn.00480f32
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x74], edi
cmp edi, 0x60
jae 0x47f1a5
mov ecx, dword [eax + edi*4 + 0x64]
sub ecx, 0x45
imul eax, ecx, 0x1c
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f17e
mov byte [eax + 0x60], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x260c]
call fcn.00480b82
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x78], edi
cmp edi, 0x6f
jae 0x47f1e4
push 0x6a
pop ecx
sub ecx, dword [eax + edi*4 + 0x70]
imul eax, ecx, 0x12
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f1bd
mov byte [eax + 0x6f], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x714]
call fcn.004808ad
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x7c], edi
cmp edi, 0x56
jae 0x47f223
mov ecx, dword [eax + edi*4 + 0x58]
sub ecx, 0x57
imul eax, ecx, 0x1f
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f1fc
mov byte [eax + 0x56], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x1c0]
call fcn.004806fe
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x80], edi
cmp edi, 0x36
jae 0x47f262
mov ecx, dword [eax + edi*4 + 0x38]
sub ecx, 0x36
imul eax, ecx, 0x22
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f23b
mov byte [eax + 0x36], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x41c]
call fcn.004804fe
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x84], edi
cmp edi, 0x3e
jae 0x47f2a4
push 0x31
pop ecx
sub ecx, dword [eax + edi*4 + 0x40]
imul eax, ecx, 0x24
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f27a
mov byte [eax + 0x3e], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.00480323
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x88], edi
cmp edi, 0x3a
jae 0x47f2e6
mov ecx, dword [eax + edi*4 + 0x3c]
sub ecx, 0x72
imul eax, ecx, 0xc
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f2bc
mov byte [eax + 0x3a], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x8d4]
call fcn.00480043
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x8c], edi
cmp edi, 0x59
jae 0x47f328
push 0x27
pop ecx
sub ecx, dword [eax + edi*4 + 0x5c]
imul eax, ecx, 0x17
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f2fe
mov byte [eax + 0x59], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0xc64]
call fcn.0047fd58
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x90], edi
cmp edi, 0x5b
jae 0x47f36a
push 0x76
pop ecx
sub ecx, dword [eax + edi*4 + 0x5c]
imul eax, ecx, 0x2d
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f340
mov byte [eax + 0x5b], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0xe2c]
call fcn.0047fa74
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x94], edi
cmp edi, 0x5b
jae 0x47f3ac
push 0xf
pop ecx
sub ecx, dword [eax + edi*4 + 0x5c]
imul eax, ecx, 0x3f
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f382
mov byte [eax + 0x5b], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0xff4]
call fcn.0047f799
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x98], edi
cmp edi, 0x5b
jae 0x47f3ee
push 0x18
pop ecx
sub ecx, dword [eax + edi*4 + 0x5c]
imul eax, ecx, 0x14
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f3c4
mov byte [eax + 0x5b], bl
push ebx
push eax
call esi
push ecx
lea ecx, [ebp - 0x11c4]
call fcn.0047f4aa
mov dword [ebp - 0x18], eax
mov edi, ebx
mov dword [ebp - 0x9c], edi
cmp edi, 0x5c
jae 0x47f430
mov ecx, dword [eax + edi*4 + 0x60]
sub ecx, 0x3d
imul eax, ecx, 0xf
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x18]
mov byte [eax + edi], dl
inc edi
jmp 0x47f406
mov byte [eax + 0x5c], bl
push ebx
push eax
call esi
mov dword [ebp - 0xa4], 0x3e8
mov dword [ebp - 0xa0], ebx
lea ecx, [ebp - 0xa4]
call fcn.0041cecb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
jmp 0x47ec4d
mov byte [ebp - 4], bl
test ebx, ebx
je 0x47f46c
mov ecx, ebx
call fcn.0040f5b8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret