Function at 0x47a684
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x39
push 0
push 0
dec ecx
jne 0x47a68c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x150], eax
lea esi, [ebp - 0x160]
xor eax, eax
push ebp
push 0x47ac71
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x1f
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045bee4
push 0x32
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0x47a6b6
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045bee4
push 0
push 0x47ac80
push 0x47ac80
lea edx, [ebp - 0x1a0]
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045c668
mov eax, dword [ebp - 0x1a0]
lea edx, [ebp - 0x19c]
call fcn.00408da0
lea eax, [ebp - 0x19c]
mov edx, 0x47ac8c
call fcn.00404790
mov eax, dword [ebp - 0x19c]
call fcn.00404980
push eax
push 0x47ac80
mov eax, dword [ebp - 0x150]
call fcn.00442d98
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, 0xd
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045bee4
push 0x32
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0x47a73e
xor edx, edx
push ebp
push 0x47a7b6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x150]
mov edx, dword [eax + 0x314]
lea eax, [ebp - 0x1a4]
mov ecx, 0x47acb4
call fcn.004047d4
mov ecx, dword [ebp - 0x1a4]
mov dl, 1
mov eax, dword [0x45dd08]
call fcn.0045ddb8
mov edx, dword [ebp - 0x150]
mov edx, dword [edx + 0x32c]
push edx
mov ecx, 0x47acc4
mov edx, 0x47acd4
mov ebx, dword [eax]
call dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47a7d6
xor edx, edx
push ebp
push 0x47ab99
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x47acdc
mov dword [ebp - 0x195], eax
push 0x47acfc
mov eax, dword [ebp - 0x150]
push dword [eax + 0x314]
push 0x47ad1c
lea eax, [ebp - 0x1a8]
mov edx, 3
call fcn.00404848
mov eax, dword [ebp - 0x1a8]
call fcn.00404980
mov dword [ebp - 0x18d], eax
mov eax, 0x47ad2c
mov dword [ebp - 0x185], eax
mov eax, dword [ebp - 0x150]
mov edx, dword [eax + 0x314]
lea eax, [ebp - 0x1ac]
mov ecx, 0x47ad44
call fcn.004047d4
mov edx, dword [ebp - 0x1ac]
lea eax, [ebp - 0x17d]
call fcn.0045d814
mov dword [ebp - 0x17d], 0x10004
lea eax, [ebp - 0x195]
mov dword [ebp - 0x175], eax
mov dword [ebp - 0x179], 3
mov byte [ebp - 0x171], 1
mov eax, dword [ebp - 0x150]
mov edx, dword [eax + 0x314]
lea eax, [ebp - 0x1b0]
mov ecx, 0x47ad44
call fcn.004047d4
mov eax, dword [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x17d]
lea edx, [ebp - 0x170]
lea eax, [ebp - 0x16c]
call fcn.0045d7d4
inc eax
jne 0x47a8ec
push 0
push 0x47ad5c
push 0x47ad60
mov eax, dword [ebp - 0x150]
call fcn.00442d98
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ac3d
mov ecx, dword [ebp - 0x170]
mov dl, 1
mov eax, dword [0x45d5e4]
call fcn.0045d848
mov dword [esi], eax
mov edx, 0x47ad6c
mov eax, dword [esi]
call fcn.0045d954
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x47a945
push 0
push 0x47ad5c
push 0x47ad74
mov eax, dword [ebp - 0x150]
call fcn.00442d98
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ac3d
push 0x47ad84
mov ecx, 0x47ad88
mov edx, dword [ebp - 0x168]
mov eax, dword [esi]
call fcn.0045d960
mov ebx, eax
push 0
mov ecx, ebx
mov edx, dword [ebp - 0x168]
mov eax, dword [esi]
call fcn.0045d9ac
mov edi, eax
push 0x47ad90
mov ecx, 0x47ada4
mov edx, dword [ebp - 0x168]
mov eax, dword [esi]
call fcn.0045d960
mov ebx, eax
push 0
mov ecx, ebx
mov edx, edi
mov eax, dword [esi]
call fcn.0045d8e8
mov edi, eax
mov edx, edi
mov eax, dword [esi]
call fcn.0045d980
push 0x47adb0
mov ecx, 0x47adcc
mov edx, eax
mov eax, dword [esi]
call fcn.0045d960
mov ebx, eax
push 0
mov ecx, ebx
mov edx, edi
mov eax, dword [esi]
call fcn.0045d8e8
mov dword [ebp - 0x164], eax
push ebp
mov eax, dword [ebp - 0x150]
mov edx, dword [eax + 0x314]
lea eax, [ebp - 0x1b4]
mov ecx, 0x47ade4
call fcn.004047d4
mov eax, dword [ebp - 0x1b4]
call fcn.0047a078
pop ecx
lea edx, [ebp - 0x1b8]
mov eax, 1
call fcn.004088a0
mov edx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x2f8]
call fcn.0043c744
mov edx, 0x47adf4
mov eax, dword [esi]
call fcn.0045d954
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x47aa5f
push 0
push 0x47ad5c
push 0x47adf8
mov eax, dword [ebp - 0x150]
call fcn.00442d98
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ac3d
lea edx, [ebp - 0x1bc]
mov eax, 2
call fcn.004088a0
mov edx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x2f8]
call fcn.0043c744
push 0x47ae08
mov ecx, 0x47ae20
mov edx, dword [ebp - 0x168]
mov eax, dword [esi]
call fcn.0045d98c
mov ebx, eax
mov eax, dword [esi]
call fcn.0045d948
test eax, eax
je 0x47aad4
push 0
push 0x47ad5c
push 0x47ae28
mov eax, dword [ebp - 0x150]
call fcn.00442d98
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ac3d
lea edx, [ebp - 0x1c0]
mov eax, 3
call fcn.004088a0
mov edx, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x2f8]
call fcn.0043c744
mov eax, dword [ebp - 0x150]
call fcn.00458bfc
push 0x47ac80
mov ecx, ebx
mov edx, dword [ebp - 0x168]
mov eax, dword [esi]
call fcn.0045d908
mov eax, dword [esi]
call fcn.0045d948
test eax, eax
je 0x47ab4f
push 0
push 0x47ad5c
push 0x47ae38
mov eax, dword [ebp - 0x150]
call fcn.00442d98
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ac3d
mov eax, dword [esi]
call fcn.004036c0
mov eax, dword [ebp - 0x16c]
push eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
call dword [eax + 0xc]
lea edx, [ebp - 0x1c4]
mov eax, 4
call fcn.004088a0
mov edx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x2f8]
call fcn.0043c744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47aba3
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 0x2f8]
call fcn.0043c714
mov eax, dword [ebp - 0x1c8]
push eax
lea edx, [ebp - 0x1cc]
mov eax, 4
call fcn.004088a0
mov edx, dword [ebp - 0x1cc]
pop eax
call fcn.004048cc
je 0x47ac31
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045bee4
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045bee4
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045bee4
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045bee4
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045bee4
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045bee4
mov eax, dword [0x47e2a0]
mov eax, dword [eax]
call fcn.0045c17c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ac78
lea eax, [ebp - 0x1cc]
call fcn.004044d0
lea eax, [ebp - 0x1c8]
call fcn.004044d0
lea eax, [ebp - 0x1c4]
mov edx, 0xb
call fcn.004044f4
ret