Function at 0x647960
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x294], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
lea eax, [ebp - 0x278]
mov edx, dword [0x41f3b0]
call fcn.0040c7ac
xor eax, eax
push ebp
push 0x647c55
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x27c]
mov eax, dword [ebp - 4]
call fcn.00431290
mov edx, dword [ebp - 0x27c]
lea eax, [ebp - 4]
call fcn.0040b89c
lea eax, [ebp - 0x280]
mov ecx, 0x647c70
mov edx, dword [ebp - 4]
call fcn.0040c260
mov eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00428f70
test eax, eax
jne 0x647bf2
mov eax, dword [ebp - 0x264]
mov edx, 0x647c88
call fcn.0040c398
je 0x647bd4
mov eax, dword [ebp - 0x264]
mov edx, 0x647c98
call fcn.0040c398
je 0x647bd4
mov eax, dword [ebp - 0x268]
and eax, 0x10
cmp eax, 0x10
je 0x647bab
xor eax, eax
push ebp
push 0x647b9f
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x647cac
push dword [ebp - 0x264]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x284]
call fcn.00429000
test al, al
jne 0x647b95
mov eax, dword [ebp - 0x264]
mov edx, 0x647cbc
call fcn.0040c398
jne 0x647ac1
push 0
push 0
push 0x647cd4
push 0x647d18
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep
jmp 0x647afd
mov eax, dword [ebp - 0x268]
and eax, 1
dec eax
jne 0x647afd
push dword [ebp - 4]
push 0x647cac
push dword [ebp - 0x264]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x288]
mov cl, 1
mov edx, 0x80
call fcn.00428dec
push dword [ebp - 4]
push 0x647cac
push dword [ebp - 0x264]
lea eax, [ebp - 0x28c]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x28c]
call fcn.00429000
test al, al
jne 0x647b95
cmp dword [0x688250], 0
je 0x647b95
mov dl, 1
mov eax, dword [0x688250]
call fcn.00428a3c
test al, al
je 0x647b95
xor ebx, ebx
jmp 0x647b80
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
push 0x1f4
call sub.kernel32.dll_Sleep
inc ebx
mov eax, dword [0x688250]
call fcn.0040bffc
mov edx, eax
lea eax, [ebp - 0x290]
call fcn.0040c05c
mov eax, dword [ebp - 0x290]
call fcn.00429000
mov dl, 1
mov eax, dword [0x688250]
call fcn.00428a3c
test al, al
je 0x647b95
cmp ebx, 4
jl 0x647b47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x647bd4
push dword [ebp - 4]
push 0x647cac
push dword [ebp - 0x264]
lea eax, [ebp - 0x294]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x294]
call fcn.00647960
lea eax, [ebp - 0x278]
call fcn.00428fc0
test eax, eax
je 0x647a0f
lea eax, [ebp - 0x278]
call fcn.00428fe4
xor eax, eax
push ebp
push 0x647c12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00429614
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x647c1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x647c5c
lea eax, [ebp - 0x294]
mov edx, 7
call fcn.0040b4c4
lea eax, [ebp - 0x278]
mov edx, dword [0x41f3b0]
call fcn.0040cb78
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax