Function at 0x472628
Capabilities:
Create process on windows

Disassembly:
call [edi]
add byte [eax], al
add byte [edx], bh
sub bh, byte [edx]
outsb dx, byte gs:[esi]
popal
bound ebp, qword [ebp + 0x64]
cmp al, byte [eax + 0x78]
jo 0x47268a
jo 0x47264b
jb 0x472680
jae 0x47264b
insb byte es:[edi], dx
insb byte es:[edi], dx
sub al, 0x2d
xor dh, byte [edx]
xor byte [eax], dh
xor byte [eax], al
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x472630
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov ebx, 0x477f20
mov esi, 0x477f00
xor eax, eax
push ebp
push 0x47293b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x476a54]
mov eax, dword [eax]
call fcn.0044d9d0
push 0
mov eax, dword [0x476a54]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call fcn.00407384
mov eax, dword [0x476a54]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
mov dword [ebx], 1
add eax, dword [ecx]
add byte [eax], al
add byte [ebp + 0x54ba0c46], cl
lea eax, [esi + 0xc]
mov edx, 0x472954
sub dword [edi], eax
call fcn.00404c48
inc dword [ebx]
cmp dword [ebx], 0x1f
jne 0x472685
lea eax, [ebp - 8]
call fcn.00471e08
push dword [ebp - 8]
push 0x47299c
push 0x4729c8
mov eax, 0x477f14
mov edx, 3
call fcn.00404d00
mov byte [0x477f28], 0
mov eax, 0x477f10
call fcn.00404980
call fcn.00472460
lea edx, [ebp - 0xc]
mov eax, 1
call fcn.00402a44
mov eax, dword [ebp - 0xc]
mov edx, 0x4729dc
call fcn.00404d8c
jne 0x472773
push 0x2710
call fcn.0040d7c8
xor eax, eax
push ebp
push 0x472764
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [0x477f14]
call fcn.00404e40
push eax
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402a44
mov eax, dword [ebp - 0x10]
call fcn.00404e40
push eax
call sub.user32.dll_GetForegroundWindow
push 0x2710
call fcn.0040d7c8
push 5
push 0
push 0x4729e4
mov eax, dword [0x477f14]
call fcn.00404e40
push eax
push 0x4729ec
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47276e
call fcn.0040480c
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00402a44
mov eax, dword [ebp - 0x14]
mov edx, 0x4729fc
call fcn.00404d8c
jne 0x4727d8
push 0x2710
call fcn.0040d7c8
xor eax, eax
push ebp
push 0x4727ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
call fcn.00471e08
lea eax, [ebp - 0x18]
mov edx, 0x472a0c
call fcn.00404c48
mov eax, dword [ebp - 0x18]
call fcn.004090f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4727d8
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402a44
mov edx, dword [ebp - 0x1c]
mov eax, 0x472a3c
call fcn.00404f84
test eax, eax
je 0x47283f
push 5
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402a44
mov edx, dword [ebp - 0x24]
mov eax, 0x472a50
call fcn.00404f84
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00402a44
mov eax, dword [ebp - 0x28]
xor edx, edx
pop ecx
call fcn.00404ea0
mov eax, dword [ebp - 0x20]
call fcn.00404e40
push eax
push 0x4729ec
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.004721ec
mov eax, 0x477efc
call fcn.00404980
push 0x472a5c
lea eax, [ebp - 0x30]
call fcn.00471ef0
push dword [ebp - 0x30]
push 0x472a5c
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404d00
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0045ed38
push 0x472a5c
lea eax, [ebp - 0x38]
call fcn.00471eb4
push dword [ebp - 0x38]
push 0x472a5c
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404d00
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0045ede8
lea eax, [ebp - 0x40]
call fcn.00471ef0
push dword [ebp - 0x40]
push 0x472a68
lea eax, [ebp - 0x44]
call fcn.00471eb4
push dword [ebp - 0x44]
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404d00
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0045eea8
push 0x472a5c
lea eax, [ebp - 0x4c]
call fcn.00471ef0
push dword [ebp - 0x4c]
push 0x472a5c
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00404d00
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0045ee48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472942
lea eax, [ebp - 0x4c]
mov edx, 0x12
call fcn.004049a4
ret