Function at 0x471200
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52190c
mov eax, dword fs:[0]
push eax
sub esp, 0x400
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x3f8], eax
push ebx
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x410]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
cmp word [eax], di
mov ebx, ecx
mov dword [esp + 0x38], eax
je 0x4715d9
call fcn.00473c80
cmp byte [eax + 0x128], 0
je 0x471267
add eax, 0x18
jmp 0x47126a
mov eax, dword [eax + 0x14]
lea esi, [eax + 4]
cmp esi, edi
je 0x4715dd
cmp word [esi], di
je 0x4715dd
lea ecx, [esp + 0x2dc]
call fcn.0046a650
mov eax, esi
lea edx, [esp + 0x2dc]
mov dword [esp + 0x418], edi
call fcn.0046a7f0
push edi
push edi
push edi
push edi
push edi
push str.ErrorReport.exe
lea ecx, [esp + 0xa8]
call fcn.0046da80
cmp byte [esp + 0x1ac], 0
lea eax, [esp + 0x9c]
jne 0x4712cd
mov eax, dword [esp + 0x98]
cmp word [eax + 4], 0x2e
lea esi, [esp + 0x2dc]
jne 0x4712e9
lea ecx, [esp + 0x90]
call fcn.0046ed90
jmp 0x4712f5
lea eax, [esp + 0x90]
call fcn.0046e110
cmp byte [esp + 0x1ac], 0
mov dword [esp + 0x90], vtable.t_str.0
jne 0x471325
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x9c]
cmp eax, ecx
je 0x471325
push eax
call fcn.004fdda1
add esp, 4
mov dword [esp + 0x418], 1
mov dword [esp + 0x18], vtable.t_errorList.0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], vtable.t_errorList::t_mem.0
mov esi, ebx
lea edi, [esp + 0x18]
mov byte [esp + 0x418], 2
call fcn.004797d0
test al, al
jne 0x471385
push 0x5635e0
mov ecx, ebx
call fcn.00401000
lea ecx, [esp + 0x18]
call fcn.00479790
lea ecx, [esp + 0x2dc]
call fcn.0046dfd0
jmp 0x4715f7
mov edi, dword [esp + 0x38]
lea edx, [esp + 0x18]
push edx
mov esi, ebx
call fcn.004798f0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
jne 0x4713b0
push 0x5635fc
jmp 0x471364
push 6
push esi
call fcn.00476c30
push 6
push esi
call fcn.00476c80
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x10
push 0
push 1
push 0x10000000
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x471401
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x563610
jmp 0x471364
push 0x40
lea ecx, [esp + 0x4c]
push 0
push ecx
mov dword [esp + 0x50], 0x44
call fcn.005002f0
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call fcn.0046a650
push 0x554328
lea edx, [esp + 0x1b8]
push 0x551604
push edx
mov byte [esp + 0x424], 3
call fcn.0046adf0
add esp, 0xc
lea ecx, [esp + 0x2dc]
call fcn.0046adb0
push eax
lea eax, [esp + 0x1b8]
push 0x551604
push eax
call fcn.0046adf0
add esp, 0xc
push 0x554328
lea ecx, [esp + 0x1b8]
push 0x551604
push ecx
call fcn.0046adf0
add esp, 0xc
push str.__list
lea edx, [esp + 0x1b8]
push 0x551604
push edx
call fcn.0046adf0
add esp, 0xc
push str.__hevent
lea eax, [esp + 0x1b8]
push 0x551604
push eax
call fcn.0046adf0
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
lea edx, [esp + 0x1b8]
push 0x562788
push edx
call fcn.0046adf0
add esp, 0xc
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x48]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
mov ecx, 0x104
lea eax, [esp + 0x1d4]
call fcn.0046ab40
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x471571
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
lea edi, [esp + 0x1b4]
call fcn.0046ab70
lea ecx, [esp + 0x2dc]
call fcn.0046adb0
push eax
push str._T_vz1Y_
call fcn.00471620
mov ecx, eax
call fcn.00471770
mov ecx, eax
call fcn.00471770
push 0x5635e0
mov ecx, ebx
call fcn.00401000
mov ecx, edi
call fcn.0046dfd0
jmp 0x47136b
lea edi, [esp + 0x1b4]
call fcn.0046ab70
mov eax, dword [esp + 0x28]
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x44]
push ecx
push 2
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x2c]
push eax
call edi
push esi
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea ecx, [esp + 0x1b4]
call fcn.0046dfd0
lea ecx, [esp + 0x18]
call fcn.00479790
lea ecx, [esp + 0x2dc]
call fcn.0046dfd0
mov al, 1
jmp 0x4715f9
mov ecx, ebx
call fcn.00470820
push 0x563594
push 0x551604
push eax
call fcn.0046adf0
add esp, 0xc
xor al, al
mov ecx, dword [esp + 0x410]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3f8]
xor ecx, esp
call fcn.004fe05a
mov esp, ebp
pop ebp
ret