Function at 0x470b78
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x12b
push 0
push 0
dec ecx
jne 0x470b80
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405590
xor eax, eax
push ebp
push 0x470ff3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x108]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.0040537c
lea edx, [ebp - 0x308]
mov ecx, 0xff
xor eax, eax
call fcn.00402db8
lea eax, [ebp - 0x714]
push eax
mov ecx, 7
mov edx, 1
lea eax, [ebp - 0x108]
call fcn.00402cfc
lea eax, [ebp - 0x714]
mov edx, 0x471000
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403530
je 0x470c5f
lea eax, [ebp - 0x814]
push eax
mov ecx, 8
mov edx, 1
lea eax, [ebp - 0x108]
call fcn.00402cfc
lea eax, [ebp - 0x814]
mov edx, 0x471008
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403530
je 0x470c5f
lea eax, [ebp - 0x914]
push eax
mov ecx, 4
mov edx, 1
lea eax, [ebp - 0x108]
call fcn.00402cfc
lea eax, [ebp - 0x914]
mov edx, 0x471014
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403530
jne 0x470c8f
lea ecx, [ebp - 0x918]
mov edx, 0x471024
mov eax, 0x471038
call fcn.0046f958
mov edx, dword [ebp - 0x918]
lea eax, [ebp - 0x208]
mov ecx, 0xff
call fcn.0040537c
jmp 0x470f15
lea edx, [ebp - 0x108]
mov eax, 0x471040
call fcn.00402eb4
mov ebx, eax
lea eax, [ebp - 0x814]
push eax
lea edx, [ebx + 1]
mov ecx, 3
lea eax, [ebp - 0x108]
call fcn.00402cfc
lea edx, [ebp - 0x814]
lea eax, [ebp - 0x920]
call fcn.00405344
mov eax, dword [ebp - 0x920]
lea edx, [ebp - 0x91c]
call fcn.004707ec
mov edx, dword [ebp - 0x91c]
lea eax, [ebp - 0x714]
mov ecx, 0xff
call fcn.0040537c
lea edx, [ebp - 0x714]
lea eax, [ebp - 8]
mov cl, 3
call fcn.00403490
lea eax, [ebp - 8]
mov edx, 0x471044
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403530
je 0x470d2f
lea eax, [ebp - 8]
mov edx, 0x471048
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403530
jne 0x470e90
lea eax, [ebp - 0x814]
push eax
mov ecx, 3
mov edx, 1
lea eax, [ebp - 0x108]
call fcn.00402cfc
lea edx, [ebp - 0x814]
lea eax, [ebp - 0x924]
call fcn.00405344
lea eax, [ebp - 0x924]
mov edx, 0x471054
call fcn.004053a8
mov edx, dword [ebp - 0x924]
lea eax, [ebp - 0x714]
mov ecx, 0xff
call fcn.0040537c
lea edx, [ebp - 0x714]
lea eax, [ebp - 0x313]
mov cl, 0xa
call fcn.00403490
mov bl, byte [ebp - 0x312]
mov eax, ebx
call fcn.00402f20
add al, 0xbf
sub al, 0x1a
jae 0x470db1
cmp byte [ebp - 0x311], 0x3a
je 0x470db6
cmp bl, 0x5c
jne 0x470dcc
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x108]
call fcn.00403484
jmp 0x470e84
xor eax, eax
mov al, byte [ebp - 0x308]
cmp byte [ebp + eax - 0x308], 0x5c
jne 0x470e2b
lea eax, [ebp - 0x928]
lea edx, [ebp - 0x308]
call fcn.00405344
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x92c]
lea edx, [ebp - 0x108]
call fcn.00405344
mov edx, dword [ebp - 0x92c]
pop eax
call fcn.004053a8
mov edx, dword [ebp - 0x928]
lea eax, [ebp - 0x208]
mov ecx, 0xff
call fcn.0040537c
jmp 0x470e84
lea eax, [ebp - 0x934]
lea edx, [ebp - 0x308]
call fcn.00405344
push dword [ebp - 0x934]
push 0x471060
lea eax, [ebp - 0x938]
lea edx, [ebp - 0x108]
call fcn.00405344
push dword [ebp - 0x938]
lea eax, [ebp - 0x930]
mov edx, 3
call fcn.00405460
mov edx, dword [ebp - 0x930]
lea eax, [ebp - 0x208]
mov ecx, 0xff
call fcn.0040537c
mov byte [ebp - 0x108], 0
jmp 0x470f15
mov edx, 0x471064
lea eax, [ebp - 0x94c]
call fcn.00403484
lea edx, [ebp - 8]
lea eax, [ebp - 0x94c]
mov cl, 8
call fcn.00403454
lea edx, [ebp - 0x94c]
lea eax, [ebp - 0x940]
call fcn.00405344
mov edx, dword [ebp - 0x940]
lea ecx, [ebp - 0x93c]
mov eax, 0x471038
call fcn.0046f958
mov edx, dword [ebp - 0x93c]
lea eax, [ebp - 0x208]
mov ecx, 0xff
call fcn.0040537c
cmp byte [ebp - 0x208], 0
jne 0x470f15
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x108]
call fcn.00403484
mov byte [ebp - 0x108], 0
jmp 0x470f15
call sub.user32.dll_WaitMessage
call fcn.0046fc28
test al, al
jne 0x470f10
lea eax, [ebp - 0x950]
lea edx, [ebp - 0x208]
call fcn.00405344
mov edx, dword [ebp - 0x950]
lea eax, [ebp - 0x513]
call fcn.00409f28
lea eax, [ebp - 0x954]
lea edx, [ebp - 0x108]
call fcn.00405344
mov edx, dword [ebp - 0x954]
lea eax, [ebp - 0x413]
call fcn.00409f28
lea eax, [ebp - 0x958]
lea edx, [ebp - 0x308]
call fcn.00405344
mov edx, dword [ebp - 0x958]
lea eax, [ebp - 0x613]
call fcn.00409f28
push 1
lea eax, [ebp - 0x613]
push eax
lea eax, [ebp - 0x413]
push eax
lea eax, [ebp - 0x513]
push eax
push 0x47106c
mov eax, dword [0x48341c]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x470fb4
call sub.user32.dll_WaitMessage
call fcn.0046fc28
test al, al
jne 0x470faf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470ffa
lea eax, [ebp - 0x958]
mov edx, 3
call fcn.00405104
lea eax, [ebp - 0x940]
mov edx, 0xb
call fcn.00405104
lea eax, [ebp - 4]
call fcn.004050e0
ret