Function at 0x4471a7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402fc8
push 0x45db24
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc40
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edx, dword [ebp + 8]
mov dword [0x534a50], edx
mov edi, dword [ebp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x447224
mov esi, 0x40f0b4
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov cl, byte [edi]
mov al, cl
cmp cl, byte [esi]
jne 0x447214
cmp al, bl
je 0x447210
mov cl, byte [edi + 1]
mov al, cl
cmp cl, byte [esi + 1]
jne 0x447214
inc edi
inc edi
inc esi
inc esi
cmp al, bl
jne 0x4471f2
xor eax, eax
jmp 0x447219
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x447226
call fcn.00447ff7
jmp 0x447268
xor ebx, ebx
push dword [ebp + 0x10]
push edx
call fcn.004478e5
pop ecx
pop ecx
test eax, eax
je 0x447268
call fcn.00448340
call fcn.00429718
mov esi, 0x476a00
mov ecx, esi
call fcn.0042a4fc
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call fcn.0042a55e
mov ecx, 0x5341b0
call fcn.0042d9f8
test eax, eax
jne 0x44726f
xor eax, eax
jmp 0x4475db
mov ecx, 0x45fc40
call fcn.00411e17
call fcn.0042a0a3
mov dword [0x534af0], ebx
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x44734a
push 0x40f0a8
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x44734a
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x840]
rep stosd dword es:[edi], eax
push dword [ebp + 0x10]
push 0x40a158
push 0x7ff
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x840]
push eax
call fcn.0042632e
lea edi, [ebp - 0x840]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 0x18
mov edx, eax
mov dword [0x534af0], edx
lea edi, [ebp - 0x840]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
push ebx
push ebx
push 1
pop edi
push edi
lea eax, [ebp - 0x840]
push eax
mov esi, 0x4776b0
mov ecx, esi
call fcn.004160a5
mov dword [ebp - 0x20], edi
jmp 0x447371
cmp dword [0x473a40], ebx
je 0x44736c
push ebx
mov esi, 0x4776b0
mov ecx, esi
call fcn.00416337
test eax, eax
je 0x447371
mov dword [ebp - 0x20], 1
jmp 0x447371
mov esi, 0x4776b0
mov ecx, esi
call fcn.00417e7e
test eax, eax
jne 0x44738a
cmp dword [ebp - 0x20], ebx
jne 0x44738a
call fcn.0044713a
test eax, eax
je 0x447392
cmp dword [0x473ab4], ebx
je 0x4473a3
push ebx
push ebx
push ebx
push 1
push 0x40a66c
mov ecx, esi
call fcn.004160a5
push 1
pop esi
mov dword [0x534af4], esi
mov ecx, 0x5341b0
call fcn.00430d3e
call fcn.00447fab
push esi
call fcn.0043f801
pop ecx
push 0x6d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4474d0
cmp dword [ebp - 0x38], 0x20
jne 0x447400
cmp dword [0x46327c], 0xffffffff
jne 0x4473dc
push dword [0x5341b4]
call esi
test eax, eax
je 0x447453
push dword [0x4989cc]
call esi
test eax, eax
je 0x447441
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x4989c8
call fcn.00452a8d
test eax, eax
jne 0x4473dc
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
push dword [0x4989cc]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x4473dc
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x4972e8
call fcn.0045b031
test eax, eax
jne 0x4473dc
cmp dword [0x475328], ebx
je 0x447482
cmp dword [0x4972b8], ebx
je 0x447482
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x463278
call fcn.0043397d
cmp eax, 1
je 0x4473dc
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4473dc
or dword [ebp - 4], 0xffffffff
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00448321
cmp dword [0x473904], ebx
je 0x4474f0
push ebx
call fcn.00446c6f
pop ecx
call fcn.00423c72
mov eax, dword [0x534af0]
cmp eax, ebx
je 0x44750c
push eax
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov dword [0x534af0], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov esi, 0x476a00
mov ecx, esi
call fcn.0042a5c9
mov ecx, esi
call fcn.0042a513
call fcn.004297b4
call fcn.00448383
call fcn.00447a87
cmp dword [0x534a90], ebx
je 0x4475a1
push 0x40b574
mov esi, 0x104
push esi
lea eax, [ebp - 0xb4c]
push eax
push dword [0x534a50]
call fcn.00426466
push ebx
push esi
lea eax, [ebp - 0x944]
push eax
push dword [0x534a50]
call fcn.00426466
push 0x40e548
push esi
lea eax, [ebp - 0xa48]
push eax
push dword [0x534a50]
call fcn.00426466
add esp, 0x30
push 5
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0xb4c]
jmp 0x4475cb
cmp dword [0x534a8c], ebx
je 0x4475d8
push 0x104
lea eax, [ebp - 0xc50]
push eax
push dword [0x534a50]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 5
push ebx
push ebx
lea eax, [ebp - 0xc50]
push eax
push 0x40a7e0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10