Function at 0x47ac80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x6a55f4]
push edi
mov edi, dword [0x6a55f0]
call fcn.0047a080
mov eax, dword [0x526728]
mov ecx, dword [0x526800]
lea edx, [edi + 0x108]
cmp eax, edx
jl 0x47af07
lea ebx, [edi + 0x12f]
cmp eax, ebx
jg 0x47adba
lea ebx, [esi + 0x63]
cmp ecx, ebx
jl 0x47adba
lea ebx, [esi + 0x70]
cmp ecx, ebx
jg 0x47adba
mov eax, dword [0x5e9f3c]
xor ebx, ebx
cmp dword [eax + 0x410], ebx
jne 0x47ad02
mov edx, dword [0x5ec1dc]
add edx, dword [0x1a3ba10]
push edx
jmp 0x47ad36
mov eax, dword [0x5e9f40]
cmp dword [eax + 0x410], ebx
jne 0x47ad1e
mov ecx, dword [0x5ec1e0]
add ecx, dword [0x1a3ba10]
push ecx
jmp 0x47ad36
cmp dword [0x633a78], 0x96
jae 0x47ad64
mov eax, dword [0x5ec1e4]
add eax, dword [0x1a3ba10]
push eax
push 0x1a38da8
call fcn.004cce8a
push 1
mov byte [0x6a55d9], 1
call fcn.00470af0
push 4
call fcn.00470df0
add esp, 0x10
mov dword [0x526908], 0x2c
jmp 0x47ad92
push 1
mov byte [0x6a55d9], 1
call fcn.00470af0
push 6
call fcn.00470df0
add esp, 8
mov dword [0x526908], 0x2f
mov dword [0x52690c], ebx
mov dword [0x633a78], ebx
mov ecx, dword [0x5e90d8]
cmp ecx, ebx
je 0x47b06c
push ebx
push 1
push ebx
call fcn.00488d70
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
cmp eax, edx
jl 0x47af07
lea ebx, [edi + 0x12f]
cmp eax, ebx
jg 0x47ae2e
lea ebx, [esi + 0x7b]
cmp ecx, ebx
jl 0x47ae2e
lea ebx, [esi + 0x88]
cmp ecx, ebx
jg 0x47ae2e
push 1
mov byte [0x6a55d9], 2
call fcn.00470af0
mov ecx, dword [0x5e90d8]
xor ebx, ebx
add esp, 4
cmp ecx, ebx
je 0x47ae03
push ebx
push 1
push ebx
call fcn.00488d70
pop edi
pop esi
mov dword [0x1a3b3f8], ebx
mov dword [0x5256bc], 0x63
mov dword [0x526908], 0x5a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
cmp eax, edx
jl 0x47af07
lea edx, [edi + 0x12f]
cmp eax, edx
jg 0x47af07
lea edx, [esi + 0x93]
cmp ecx, edx
jl 0x47af07
lea edx, [esi + 0xa0]
cmp ecx, edx
jg 0x47af07
mov ecx, dword [0x5e90d8]
xor ebx, ebx
cmp ecx, ebx
je 0x47ae75
push ebx
push 1
push ebx
call fcn.00488d70
push 0x44
lea eax, [ebp - 0x148]
push ebx
push eax
call fcn.004cce10
push 0x640e88
lea eax, [ebp - 0x104]
push 0x4e6d90
push eax
mov dword [ebp - 0x148], 0x44
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x114], ebx
call fcn.004cce8a
add esp, 0x18
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x148]
push edx
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x104]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x7a]
cmp eax, edx
jl 0x47b06c
lea ebx, [edi + 0xea]
cmp eax, ebx
jg 0x47afb1
lea ebx, [esi + 0x6e]
cmp ecx, ebx
jl 0x47afb1
lea ebx, [esi + 0x79]
cmp ecx, ebx
jg 0x47afb1
xor ebx, ebx
push ebx
push ebx
call fcn.0040d210
mov ecx, dword [0x5e90d8]
add esp, 8
cmp ecx, ebx
je 0x47af51
push ebx
push 1
push ebx
call fcn.00488d70
cmp byte [ebp + 8], bl
je 0x47af72
mov ecx, dword [0x5e9f3c]
call fcn.0048a100
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
mov eax, dword [0x526728]
sub eax, edi
sub eax, 0x78
xor edx, edx
div dword [0x5256d8]
mov ecx, dword [0x526718]
mov dword [0x5256c0], ecx
mov ecx, dword [0x5e9f3c]
push eax
call fcn.00489e70
mov eax, dword [0x526728]
mov ecx, dword [0x5e9f3c]
sub eax, edi
sub eax, 0x78
jmp 0x47b05e
cmp eax, edx
jl 0x47b06c
lea edx, [edi + 0xea]
cmp eax, edx
jg 0x47b06c
lea eax, [esi + 0x8b]
cmp ecx, eax
jl 0x47b06c
add esi, 0x96
cmp ecx, esi
jg 0x47b06c
xor ebx, ebx
push ebx
push 1
call fcn.0040d210
mov ecx, dword [0x5e90d8]
add esp, 8
cmp ecx, ebx
je 0x47b003
push ebx
push 1
push ebx
call fcn.00488d70
cmp byte [ebp + 8], bl
je 0x47b024
mov ecx, dword [0x5e9f40]
call fcn.0048a100
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ccd49
mov esp, ebp
pop ebp
ret
mov eax, dword [0x526728]
sub eax, edi
sub eax, 0x77
xor edx, edx
div dword [0x5256d8]
mov ecx, dword [0x526718]
mov dword [0x5256c0], ecx
mov ecx, dword [0x5e9f40]
push eax
call fcn.00489e70
mov eax, dword [0x526728]
mov ecx, dword [0x5e9f40]
sub eax, edi
sub eax, 0x77
xor edx, edx
div dword [0x5256d8]
push eax
call fcn.00489f00
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ccd49
mov esp, ebp
pop ebp
ret