Function at 0x47d49d
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp + 0x14]
lea edi, [ebp - 4]
or dword [ebp - 4], 0xffffffff
mov edx, eax
push 2
push 1
mov ecx, dword [esi]
xor ebx, ebx
mov eax, ecx
mov dword [ebp - 0x10], ebx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
push ebx
push edi
mov eax, dword [eax*4 + 0x4f2ce8]
push edx
push dword [eax + ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x47d707
push dword [esi]
call fcn.004b2c6b
push dword [ebp + 0xc]
or dword [esi], 0xffffffff
push dword [esi + 4]
call fcn.004b9bf3
mov ebx, eax
add esp, 0xc
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x47d707
xor edi, edi
push edi
call fcn.0047e105
mov esi, eax
pop ecx
test esi, esi
jne 0x47d52d
push ebx
call fcn.004784bc
pop ecx
jmp 0x47d707
push 0x4dcef8
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push edi
push eax
call fcn.0047750d
add esp, 0xc
test eax, eax
je 0x47d58c
cmp eax, 0x16
je 0x47d765
mov ebx, edi
mov edi, 0x4dced0
mov dword [ebp - 0xc], edi
xor eax, eax
push 0x44
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0046b590
mov ecx, dword [0x4f2ce8]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 0x100
jne 0x47d59a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
jmp 0x47d5a9
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x47d551
mov edi, ebx
mov dword [ebp - 0xc], ebx
jmp 0x47d559
cmp dword [ebp + 0x10], 1
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
je 0x47d5ac
mov eax, dword [ecx + 0x50]
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 0x88]
mov ecx, edi
mov dword [ebp - 0x2c], eax
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x47d5bf
sub ecx, edx
mov edx, str.__c
sar ecx, 1
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x10]
jne 0x47d5d6
sub edx, edi
mov edi, dword [ebp + 8]
sar edx, 1
lea eax, [edi + 2]
mov dword [ebp - 0x18], eax
mov ax, word [edi]
add edi, 2
cmp ax, word [ebp - 0x10]
jne 0x47d5ef
sub edi, dword [ebp - 0x18]
inc edx
sar edi, 1
push 2
lea eax, [edi + ecx]
add eax, edx
push eax
mov dword [ebp - 0x10], eax
call fcn.004ae38f
mov edi, eax
mov dword [ebp - 0x18], edi
pop ecx
pop ecx
test edi, edi
jne 0x47d63e
push edi
call fcn.004ae3f2
push ebx
call fcn.004ae3f2
mov dword [esi + 4], edi
mov dword [esi], edi
mov eax, dword [ebp - 8]
push eax
call fcn.004784bc
add esp, 0xc
jmp 0x47d707
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push edi
call fcn.004b1913
add esp, 0xc
test eax, eax
jne 0x47d75c
push str.__c
push dword [ebp - 0x10]
push edi
call fcn.004b91a3
add esp, 0xc
test eax, eax
jne 0x47d75c
push dword [ebp + 8]
push dword [ebp - 0x10]
push edi
call fcn.004b91a3
add esp, 0xc
test eax, eax
jne 0x47d75c
push dword [ebp - 0xc]
call fcn.0047da77
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x47d6a9
push edi
call fcn.004ae3f2
push ebx
call fcn.004ae3f2
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
jmp 0x47d62d
mov eax, ecx
lea edi, [ebp - 0x28]
sub eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
and eax, ecx
mov dword [ebp - 0x10], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x6c]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x47d71d
push dword [ebp - 0x10]
call fcn.004ae3f2
push edi
call fcn.004ae3f2
push ebx
call fcn.004ae3f2
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004784bc
add esp, 0x10
cmp dword [ebp - 4], 0xffffffff
je 0x47d716
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
call fcn.004ae3f2
push edi
call fcn.004ae3f2
push ebx
call fcn.004ae3f2
add esp, 0xc
cmp dword [ebp - 4], 0xffffffff
je 0x47d757
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x47d718
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x47d76a
push edi
push edi
push edi
push edi
push edi
call fcn.004ae30e
int3