Function at 0x447e40
Capabilities:
Create process on windows
Inspect load icon resource

Disassembly:
sub esp, 0x4c
push ebx
mov ebx, dword [esp + 0x54]
push ebp
push esi
mov esi, dword [esp + 0x64]
test esi, esi
push edi
mov dword [0x493e10], ebx
mov byte [0x4751e0], 0
je 0x447e81
mov al, byte [esi]
cmp al, 0x20
jl 0x447e81
cmp al, 0x2f
je 0x447eb3
cmp al, 0x2d
je 0x447eb3
cmp al, 0x20
je 0x447e7a
cmp al, 9
je 0x447e7a
cmp al, 0x20
jl 0x447e81
inc esi
mov al, byte [esi]
cmp al, 0x20
jge 0x447e66
call fcn.004483f0
test eax, eax
jne 0x447ee2
push 0x30
push 0x461738
push 0x461718
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
push 0
call fcn.00447cc0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret 0x10
inc esi
mov al, byte [esi]
cmp al, 0x20
jle 0x447e7b
cmp al, 0x44
je 0x447ec2
cmp al, 0x64
jne 0x447eb3
mov al, byte [esi + 1]
inc esi
cmp al, 0x53
je 0x447ece
cmp al, 0x73
jne 0x447eb4
mov al, byte [esi + 1]
inc esi
cmp al, 0x4e
je 0x447eda
cmp al, 0x6e
jne 0x447eb4
inc esi
call fcn.0040f3a0
jmp 0x447eb4
cmp eax, 0xffffffff
jne 0x447efd
push 0
call fcn.00447cc0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret 0x10
mov eax, dword [0x493e10]
mov edi, dword [sym.imp.user32.dll_LoadIconA]
push 0x66
mov ebp, 4
push ebx
mov dword [esp + 0x34], 0x30
mov dword [esp + 0x38], 0x20
mov dword [esp + 0x3c], 0x44aae0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], eax
call edi
mov esi, dword [sym.imp.user32.dll_LoadCursorA]
push 0xc8
push ebx
mov dword [esp + 0x4c], eax
call esi
test eax, eax
mov dword [esp + 0x48], eax
jne 0x447f60
push 0x7f00
push eax
call esi
mov dword [esp + 0x48], eax
mov ebx, dword [sym.imp.gdi32.dll_GetStockObject]
push ebp
call ebx
mov ecx, dword [esp + 0x60]
push 0x66
push ecx
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0x68
mov dword [esp + 0x5c], 0x466f68
call edi
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x5c], eax
call dword [sym.imp.user32.dll_RegisterClassExA]
test ax, ax
jne 0x447fa6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret 0x10
mov ecx, dword [esp + 0x60]
mov eax, dword [0x493e10]
push 0xc8
xor edi, edi
push ecx
mov dword [esp + 0x34], 0x30
mov dword [esp + 0x38], 0x20
mov dword [esp + 0x3c], 0x44c070
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edi
call esi
cmp eax, edi
mov dword [esp + 0x48], eax
jne 0x447ff5
push 0x7f00
push edi
call esi
mov dword [esp + 0x48], eax
push ebp
call ebx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], 0x460840
mov dword [esp + 0x5c], edi
call dword [sym.imp.user32.dll_RegisterClassExA]
test ax, ax
jne 0x448028
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret 0x10
mov ecx, dword [0x45f030]
imul ecx, dword [0x4866a8]
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x45f034]
imul ecx, dword [0x4866ac]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [0x4866c8], edx
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
push 0x4866a0
mov dword [0x48672c], edi
mov dword [0x486738], edi
mov dword [0x48673c], 0x2cb0000
mov dword [0x4866d0], 1
mov dword [0x4866cc], edx
call fcn.0044d2f0
push 0x4866a0
mov esi, eax
call fcn.0044d2f0
mov edx, dword [0x4866a8]
add edx, esi
add eax, edx
push 0x4866a0
mov dword [0x4866a0], eax
call fcn.0044d340
push 0x4866a0
mov esi, eax
call fcn.0044d280
mov ecx, dword [0x4866ac]
mov ebx, dword [0x4866a8]
mov edx, ecx
add edx, esi
mov esi, dword [0x4866c8]
add eax, edx
mov edx, dword [0x4866a0]
mov dword [0x4866a4], eax
sub eax, ecx
mov ecx, dword [0x4866cc]
sub edx, ebx
add esp, 0x10
add edx, esi
mov esi, dword [sym.imp.user32.dll_GetSystemMetrics]
add eax, ecx
push 0x11
mov dword [0x4866c0], edx
mov dword [0x4866c4], eax
call esi
mov ecx, dword [0x4866c4]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
jns 0x448125
xor eax, eax
mov edx, dword [esp + 0x60]
push edi
push edx
push edi
push edi
push ecx
mov ecx, dword [0x4866c0]
push ecx
push eax
push 0x10
call esi
sub eax, dword [0x4866c0]
cdq
sub eax, edx
mov edx, dword [0x48673c]
sar eax, 1
push eax
mov eax, dword [0x486738]
push edx
push 0x468520
push 0x466f68
push eax
call dword [sym.imp.user32.dll_CreateWindowExA]
push edi
mov esi, eax
push edi
push esi
mov dword [0x486740], esi
call dword [sym.imp.user32.dll_SetWindowLongA]
push edi
push edi
call sub.user32.dll_WINNLSEnableIME
mov ecx, dword [0x493e10]
push ecx
call fcn.00427c40
add esp, 4
test eax, eax
jne 0x448198
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10
mov edx, dword [0x493e10]
push edx
call fcn.0041b350
add esp, 4
test eax, eax
jne 0x4481b5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10
mov eax, dword [0x493e10]
push eax
call fcn.0044e060
add esp, 4
test eax, eax
jne 0x4481d1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10
mov ecx, dword [0x493e10]
push ecx
call fcn.00408220
add esp, 4
test eax, eax
jne 0x4481ee
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10
mov edx, dword [esp + 0x6c]
push edx
push esi
call dword [sym.imp.user32.dll_ShowWindow]
push esi
call dword [sym.imp.user32.dll_UpdateWindow]
push esi
call fcn.00448c80
add esp, 4
test eax, eax
jne 0x448236
push 0x30
push 0x468520
push 0x4616f8
push esi
call dword [sym.imp.user32.dll_MessageBoxA]
push esi
call fcn.00447cc0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret 0x10
call fcn.00419ac0
mov eax, dword [0x493e10]
push eax
call fcn.004083c0
mov ecx, dword [0x493e10]
push ecx
call fcn.0041b4f0
push esi
call fcn.00426680
mov edx, dword [0x493e10]
push edx
call fcn.00427e00
mov eax, dword [0x493e10]
push eax
call fcn.0044e200
mov esi, dword [sym.imp.user32.dll_GetMessageA]
add esp, 0x14
push edi
push edi
push edi
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x4482b1
mov edi, dword [sym.imp.user32.dll_TranslateMessage]
mov ebp, dword [sym.imp.user32.dll_DispatchMessageA]
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 0x10]
push eax
call ebp
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
jne 0x448292
mov al, byte [0x4788e0]
test al, al
je 0x4483e0
mov ebp, dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
xor ebx, ebx
mov ecx, 0x11
mov edi, 0x478460
rep stosd dword es:[edi], eax
mov dword [0x478460], 0x44
mov dword [0x478468], ebx
mov dword [0x47846c], ebx
mov dword [0x478470], ebx
mov dword [0x478474], ebx
mov dword [0x478478], ebx
mov dword [0x47847c], ebx
mov dword [0x47848c], ebx
mov word [0x478490], 0xa
mov dword [0x4dc220], ebx
mov cl, byte [0x478a00]
test cl, cl
mov eax, 0x478a00
jne 0x448328
xor eax, eax
push 0x4dc220
push 0x478460
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x4788e0
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessA]
cmp eax, 1
je 0x4483e0
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x4788e0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
shr ecx, 2
mov esi, edi
mov edi, 0x482220
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x460be8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, 0x482220
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x478a00
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, 0x482220
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
push 0x35
push 0x468520
mov ecx, edx
push 0x482220
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call ebp
cmp eax, 2
jne 0x448317
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10