Function at 0x472cec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x472cf4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x473561
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x476cc0]
call fcn.00405824
test eax, eax
jl 0x473501
inc eax
mov dword [ebp - 0x2c], eax
xor ebx, ebx
lea eax, [ebp - 0x10]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8]
call fcn.004045fc
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004710f4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004711cc
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.00408940
mov eax, dword [ebp - 0x4c]
call fcn.00404824
test eax, eax
jne 0x472da8
push 0
mov cx, word [0x473570]
mov dl, 3
mov eax, 0x47357c
call fcn.0042d094
cmp eax, 6
jne 0x472d90
lea eax, [ebp - 8]
mov edx, dword [0x476ca8]
call fcn.004045fc
jmp 0x472da8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, 0x4735ac
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x47352e
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0xc]
call fcn.00408940
mov eax, dword [ebp - 0x50]
call fcn.00404824
test eax, eax
jne 0x472e5d
mov eax, dword [ebp - 0x10]
mov edx, 0x4735c4
call fcn.00404970
jne 0x472de4
lea eax, [ebp - 0xc]
mov ecx, 0x4735d0
mov edx, dword [ebp - 8]
call fcn.00404870
jmp 0x472e5d
mov eax, dword [ebp - 0x10]
mov edx, 0x4735e4
call fcn.00404970
jne 0x472e05
lea eax, [ebp - 0xc]
mov ecx, 0x4735f4
mov edx, dword [ebp - 8]
call fcn.00404870
jmp 0x472e5d
mov eax, dword [ebp - 0x10]
mov edx, 0x47360c
call fcn.00404970
jne 0x472e26
lea eax, [ebp - 0xc]
mov ecx, 0x473618
mov edx, dword [ebp - 8]
call fcn.00404870
jmp 0x472e5d
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x10]
call fcn.004086c8
mov eax, dword [ebp - 0x54]
push eax
lea edx, [ebp - 0x58]
mov eax, 0x47362c
call fcn.004086c8
mov edx, dword [ebp - 0x58]
pop eax
call fcn.00404970
jne 0x472e5d
lea eax, [ebp - 0xc]
mov ecx, 0x473640
mov edx, dword [ebp - 8]
call fcn.00404870
mov eax, dword [ebp - 0x10]
call fcn.00404824
test eax, eax
je 0x4734f7
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 0xc]
call fcn.00409230
mov eax, dword [ebp - 0x5c]
call fcn.004716d8
test al, al
je 0x472f0b
push 0
push 0x473658
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0xc]
call fcn.00409230
push dword [ebp - 0x64]
push 0x473668
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.004048e4
mov eax, dword [ebp - 0x60]
mov cx, word [0x473570]
mov dl, 3
call fcn.0042d094
cmp eax, 6
jne 0x472ef3
jmp 0x472eda
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 0xc]
call fcn.00409230
mov eax, dword [ebp - 0x68]
call fcn.0047184c
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0xc]
call fcn.00409230
mov eax, dword [ebp - 0x6c]
call fcn.004716d8
test al, al
jne 0x472ec7
jmp 0x472f0b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, 0x4735ac
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x47352e
mov eax, dword [0x476cc0]
mov eax, dword [eax + ebx*8 + 4]
call fcn.00405824
test eax, eax
jl 0x4734f7
inc eax
mov dword [ebp - 0x30], eax
xor esi, esi
lea eax, [ebp - 0x14]
lea edi, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov edx, dword [edx + edi*4 + 4]
call fcn.004045fc
lea eax, [ebp - 0x18]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov edx, dword [edx + edi*4 + 8]
call fcn.004045fc
lea eax, [ebp - 0x28]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov edx, dword [edx + edi*4 + 0xc]
call fcn.004045fc
mov eax, dword [ebp - 0x14]
mov edx, 0x473674
call fcn.00404970
jne 0x473226
lea eax, [ebp - 0x70]
mov ecx, 0x473684
mov edx, dword [ebp - 8]
call fcn.00404870
mov edx, dword [ebp - 0x70]
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x10]
call fcn.00471bbc
lea eax, [ebp - 0x48]
call fcn.00415074
test al, al
jne 0x4734ed
mov eax, dword [0x476cb0]
call fcn.00472b90
test al, al
jne 0x472fd3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, 0x47369c
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4734ed
mov eax, dword [ebp - 0x10]
mov edx, 0x47360c
call fcn.00404970
jne 0x472ff1
lea eax, [ebp - 0x24]
mov edx, 0x4736c8
call fcn.004045fc
jmp 0x472ffe
lea eax, [ebp - 0x24]
mov edx, 0x4736dc
call fcn.004045fc
mov eax, dword [ebp - 0x28]
mov edx, 0x4736f0
call fcn.00404970
jne 0x4730e6
mov eax, dword [0x476cc0]
mov eax, dword [eax + ebx*8 + 4]
mov eax, dword [eax + edi*4 + 0x10]
call fcn.00405824
test eax, eax
jl 0x4730e6
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
lea eax, [ebp - 0x1c]
lea edx, [esi + esi*4]
mov ecx, dword [0x476cc0]
mov ecx, dword [ecx + ebx*8 + 4]
mov edx, dword [ecx + edx*4 + 0x10]
lea ecx, [edi + edi*4]
mov edx, dword [edx + ecx*4 + 4]
call fcn.004045fc
lea eax, [ebp - 0x20]
lea edx, [esi + esi*4]
mov ecx, dword [0x476cc0]
mov ecx, dword [ecx + ebx*8 + 4]
mov edx, dword [ecx + edx*4 + 0x10]
lea ecx, [edi + edi*4]
mov edx, dword [edx + ecx*4 + 8]
call fcn.004045fc
lea eax, [ebp - 0x74]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.00471f54
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x1c]
call fcn.004045fc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x48]
call fcn.00472660
mov eax, dword [0x475498]
mov eax, dword [eax]
call fcn.0045c4ec
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x78]
mov ecx, 0x4736fc
call fcn.00404870
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc edi
dec dword [ebp - 0x34]
jne 0x473031
mov eax, dword [ebp - 0x28]
mov edx, 0x473710
call fcn.00404970
jne 0x4734ed
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x48]
call fcn.00472078
test al, al
je 0x4731ed
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
call fcn.00405824
test eax, eax
jl 0x4734ed
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
lea eax, [ebp - 0x1c]
lea edx, [esi + esi*4]
mov ecx, dword [0x476cc0]
mov ecx, dword [ecx + ebx*8 + 4]
mov edx, dword [ecx + edx*4 + 0x10]
lea ecx, [edi + edi*4]
mov edx, dword [edx + ecx*4 + 4]
call fcn.004045fc
lea eax, [ebp - 0x20]
lea edx, [esi + esi*4]
mov ecx, dword [0x476cc0]
mov ecx, dword [ecx + ebx*8 + 4]
mov edx, dword [ecx + edx*4 + 0x10]
lea ecx, [edi + edi*4]
mov edx, dword [edx + ecx*4 + 8]
call fcn.004045fc
lea eax, [ebp - 0x7c]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.00471f54
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x1c]
call fcn.004045fc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x48]
call fcn.00472660
mov eax, dword [0x475498]
mov eax, dword [eax]
call fcn.0045c4ec
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x80]
mov ecx, 0x4736fc
call fcn.00404870
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc edi
dec dword [ebp - 0x34]
jne 0x473133
jmp 0x4734ed
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0x84]
mov ecx, 0x47371c
call fcn.00404870
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4734ed
mov eax, dword [ebp - 0x14]
mov edx, 0x473734
call fcn.00404970
jne 0x4734ed
mov eax, dword [ebp - 0x28]
mov edx, 0x4736f0
call fcn.00404970
jne 0x473360
mov eax, dword [0x476cc0]
mov eax, dword [eax + ebx*8 + 4]
mov eax, dword [eax + edi*4 + 0x10]
call fcn.00405824
test eax, eax
jl 0x473360
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
push eax
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov eax, dword [eax + edx*4 + 0xc]
push eax
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov eax, dword [eax + edx*4 + 0x10]
push eax
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov edx, dword [eax + edx*4 + 8]
lea eax, [esi + esi*4]
mov ecx, dword [0x476cc0]
mov ecx, dword [ecx + ebx*8 + 4]
mov eax, dword [ecx + eax*4 + 0x10]
lea ecx, [edi + edi*4]
mov eax, dword [eax + ecx*4 + 4]
mov ecx, dword [ebp - 8]
call fcn.00472844
test al, al
je 0x47331b
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x88]
mov ecx, 0x473744
call fcn.00404870
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x473356
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x8c]
mov ecx, 0x473758
call fcn.00404870
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc edi
dec dword [ebp - 0x34]
jne 0x47326c
mov eax, dword [ebp - 0x28]
mov edx, 0x473710
call fcn.00404970
jne 0x4734ed
lea eax, [ebp - 0x90]
mov ecx, 0x47376c
mov edx, dword [ebp - 8]
call fcn.00404870
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004729e4
test al, al
je 0x4734b9
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
call fcn.00405824
test eax, eax
jl 0x4734ed
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
push eax
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov eax, dword [eax + edx*4 + 0xc]
push eax
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov eax, dword [eax + edx*4 + 0x10]
push eax
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov edx, dword [eax + edx*4 + 8]
lea eax, [esi + esi*4]
mov ecx, dword [0x476cc0]
mov ecx, dword [ecx + ebx*8 + 4]
mov eax, dword [ecx + eax*4 + 0x10]
lea ecx, [edi + edi*4]
mov eax, dword [eax + ecx*4 + 4]
mov ecx, dword [ebp - 8]
call fcn.00472844
test al, al
je 0x473472
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x94]
mov ecx, 0x473744
call fcn.00404870
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4734ad
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov eax, dword [edx + eax*4 + 0x10]
lea edx, [edi + edi*4]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x98]
mov ecx, 0x473780
call fcn.00404870
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc edi
dec dword [ebp - 0x34]
jne 0x4733c3
jmp 0x4734ed
lea eax, [esi + esi*4]
mov edx, dword [0x476cc0]
mov edx, dword [edx + ebx*8 + 4]
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0x9c]
mov ecx, 0x47371c
call fcn.00404870
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec dword [ebp - 0x30]
jne 0x472f27
inc ebx
dec dword [ebp - 0x2c]
jne 0x472d28
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x220]
mov edx, 0x4736fc
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, 0x47379c
call fcn.0040915c
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404a24
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473568
lea eax, [ebp - 0x9c]
mov edx, 0x15
call fcn.00404588
lea eax, [ebp - 0x48]
call fcn.0040fc7c
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.00404588
ret