Function at 0x47d4d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b9e62
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x4ff1a0]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
push edi
mov eax, dword [0x4ff1a0]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x47d91a
call fcn.00410830
lea ebx, [esp + 0xe8]
mov ecx, eax
call fcn.00411e50
xor ebx, ebx
mov dword [esp + 0x130], ebx
cmp dword [esp + 0xf8], ebx
jne 0x47d70c
push 1
push 2
lea ecx, [esp + 0x1c]
call fcn.00413cc0
mov byte [esp + 0x130], 1
push esi
push ecx
lea eax, [esp + 0x1c]
push str.appdata_is_EMPTY._lnkPath:
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 8
push 0x20
mov esi, 0xf
push str.CShellUtility::RemoveFromTaskbar
lea ecx, [esp + 0xb8]
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
call fcn.0040ebe0
mov byte [esp + 0x130], 2
mov edi, 0x10
push edi
push str.ShellUtility.cpp
lea ecx, [esp + 0x10c]
mov dword [esp + 0x120], esi
mov dword [esp + 0x11c], ebx
mov byte [esp + 0x10c], bl
call fcn.0040ebe0
mov byte [esp + 0x130], 3
lea ecx, [esp + 0xcc]
push ecx
lea ecx, [esp + 0x18]
call fcn.00413de0
mov byte [esp + 0x130], 4
push eax
lea edx, [esp + 0xb4]
push edx
push 0x15e
lea eax, [esp + 0x110]
push eax
push ebx
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x130], 3
cmp dword [esp + 0xe0], 8
jb 0x47d63e
mov ecx, dword [esp + 0xcc]
push ecx
call fcn.00490458
add esp, 4
xor edx, edx
mov dword [esp + 0xe0], 7
mov dword [esp + 0xdc], ebx
mov word [esp + 0xcc], dx
mov byte [esp + 0x130], 2
cmp dword [esp + 0x118], edi
jb 0x47d67b
mov eax, dword [esp + 0x104]
push eax
call fcn.00490458
add esp, 4
mov dword [esp + 0x118], esi
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
mov byte [esp + 0x130], 1
cmp dword [esp + 0xc4], edi
jb 0x47d6b1
mov ecx, dword [esp + 0xb0]
push ecx
call fcn.00490458
add esp, 4
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
mov byte [esp + 0x130], bl
lea ecx, [esp + 0x14]
call fcn.00412cc0
mov dword [esp + 0x130], 0xffffffff
cmp dword [esp + 0xfc], 8
jb 0x47d6fb
mov edx, dword [esp + 0xe8]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov word [esp + 0xe8], ax
xor al, al
jmp 0x47da0d
call fcn.0042c710
cmp eax, ebx
je 0x47d921
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0xb8]
push edx
call fcn.00410b20
add esp, 0xc
mov byte [esp + 0x130], 5
push esi
push eax
lea eax, [esp + 0xd4]
push eax
call fcn.00410c00
add esp, 0xc
mov byte [esp + 0x130], 6
cmp dword [eax + 0x14], 8
jb 0x47d760
mov eax, dword [eax]
push 5
push ebx
push ebx
push eax
push str.TaskbarUnpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
mov byte [esp + 0x130], 5
cmp dword [esp + 0xe0], 8
jb 0x47d795
mov ecx, dword [esp + 0xcc]
push ecx
call fcn.00490458
add esp, 4
xor edx, edx
mov dword [esp + 0xe0], 7
mov dword [esp + 0xdc], ebx
mov word [esp + 0xcc], dx
mov byte [esp + 0x130], bl
cmp dword [esp + 0xc4], 8
jb 0x47d7d2
mov eax, dword [esp + 0xb0]
push eax
call fcn.00490458
add esp, 4
xor ecx, ecx
mov dword [esp + 0xc4], 7
mov dword [esp + 0xc0], ebx
mov word [esp + 0xb0], cx
cmp edi, 0x20
ja 0x47d9dc
push 1
push 2
lea ecx, [esp + 0x1c]
call fcn.00413cc0
mov byte [esp + 0x130], 7
push esi
push ecx
push str.._lnkPath:
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea edx, [esp + 0x2c]
push str.ShellExecute_Failed._GetLastError:
push edx
call fcn.00416b90
add esp, 0xc
push eax
call fcn.004135f0
add esp, 4
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 8
push str.CShellUtility::RemoveFromTaskbar
lea ecx, [esp + 0xb4]
call fcn.0040ece0
mov byte [esp + 0x130], 8
push str.ShellUtility.cpp
lea ecx, [esp + 0xd0]
call fcn.0040ece0
mov byte [esp + 0x130], 9
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x18]
call fcn.00413de0
mov byte [esp + 0x130], 0xa
push eax
lea ecx, [esp + 0xb4]
push ecx
push 0x167
lea edx, [esp + 0xd8]
push edx
push ebx
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x130], 9
lea ecx, [esp + 0x104]
call fcn.0040f320
mov byte [esp + 0x130], 8
lea ecx, [esp + 0xcc]
call fcn.0040f350
mov byte [esp + 0x130], 7
lea ecx, [esp + 0xb0]
call fcn.0040f350
mov byte [esp + 0x130], bl
lea ecx, [esp + 0x14]
call fcn.00412cc0
mov dword [esp + 0x130], 0xffffffff
lea ecx, [esp + 0xe8]
call fcn.0040f320
xor al, al
jmp 0x47da1f
push 0x4c4f30
push esi
mov edi, 1
call fcn.0041a550
cmp eax, 0xffffffff
je 0x47d9dc
mov ecx, dword [esi + 0x10]
sub ecx, eax
push ecx
push eax
lea eax, [esp + 0xb8]
push eax
mov ecx, esi
call fcn.00413c40
mov byte [esp + 0x130], 0xb
push str.MicrosoftInternet_ExplorerQuick_Launch_
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0x10c]
push edx
call fcn.00410b20
add esp, 0xc
mov byte [esp + 0x130], 0xc
lea ecx, [esp + 0xb0]
push ecx
push eax
lea edx, [esp + 0xd4]
push edx
call fcn.00410c00
add esp, 0xc
mov byte [esp + 0x130], 0xe
lea ecx, [esp + 0x104]
call fcn.0040f320
push edi
lea esi, [esp + 0xd0]
call fcn.00423ad0
add esp, 4
mov byte [esp + 0x130], 0xb
mov ecx, esi
call fcn.0040f320
mov byte [esp + 0x130], bl
lea ecx, [esp + 0xb0]
call fcn.0040f320
mov dword [esp + 0x130], 0xffffffff
cmp dword [esp + 0xfc], 8
jb 0x47da01
mov eax, dword [esp + 0xe8]
push eax
call fcn.00490458
add esp, 4
xor ecx, ecx
mov word [esp + 0xe8], cx
mov al, 1
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], 7
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.004911d1
mov esp, ebp
pop ebp
ret