Function at 0x464830
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xec
mov esi, dword [0x490b20]
mov ebx, dword [esp + 0x110]
mov eax, dword [esp + 0x114]
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
and ebx, 0x10
mov dword [esp + 0x98], 0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x58], 0xffffffff
mov dword [esp + 0x5c], 0xffffffff
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x68], 0xffffffff
mov dword [esp + 0x80], 0xffffffff
mov dword [esp + 0x84], 0xffffffff
mov dword [esp + 0x88], 0xffffffff
test eax, eax
je 0x4648df
mov eax, dword [esp + 0x114]
mov dword [eax], 0
mov eax, dword [esp + 0x118]
test eax, eax
je 0x4648f7
mov eax, dword [esp + 0x118]
mov dword [eax], 0
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x46490f
mov eax, dword [esp + 0x11c]
mov dword [eax], 0
mov eax, dword [esp + 0x120]
mov dword [eax], 0xffffffff
mov eax, dword [esp + 0x114]
test eax, eax
je 0x464cd0
mov edx, 1
lea eax, [esp + 0x54]
call fcn.00463e20
test eax, eax
jne 0x464c90
mov eax, dword [esp + 0x58]
test ebx, ebx
mov edx, 0x48a49b
mov dword [esp + 0x6c], 4
mov dword [esp + 0x70], eax
mov eax, str.w_nonblock
cmove eax, edx
mov dword [esp + 4], eax
lea eax, [esp + 0x6c]
mov dword [esp], eax
call sub.libgpg_error_0.dll_gpgrt_sysopen
mov dword [esp + 0x3c], eax
test eax, eax
je 0x464f60
mov ebp, dword [esp + 0x118]
test ebp, ebp
je 0x464ce7
mov edx, 2
lea eax, [esp + 0x5c]
call fcn.00463e20
test eax, eax
jne 0x464c90
mov eax, dword [esp + 0x5c]
test ebx, ebx
mov edx, 0x48a43f
mov dword [esp + 0x6c], 4
mov dword [esp + 0x70], eax
mov eax, str.r_nonblock
cmove eax, edx
mov dword [esp + 4], eax
lea eax, [esp + 0x6c]
mov dword [esp], eax
call sub.libgpg_error_0.dll_gpgrt_sysopen
mov dword [esp + 0x40], eax
test eax, eax
je 0x465080
mov edi, dword [esp + 0x11c]
test edi, edi
je 0x464cfe
mov edx, 2
lea eax, [esp + 0x64]
call fcn.00463e20
test eax, eax
jne 0x464c90
mov eax, dword [esp + 0x64]
test ebx, ebx
mov edx, 0x48a43f
mov dword [esp + 0x6c], 4
mov dword [esp + 0x70], eax
mov eax, str.r_nonblock
cmove eax, edx
mov dword [esp + 4], eax
lea eax, [esp + 0x6c]
mov dword [esp], eax
call sub.libgpg_error_0.dll_gpgrt_sysopen
mov dword [esp + 0x44], eax
test eax, eax
je 0x464fc0
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0x100]
lea ecx, [esp + 0x50]
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x74], 0xc
call fcn.00463f30
mov ebx, eax
test eax, eax
jne 0x464cc0
cmp dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x4c], 0xffffffff
je 0x464ea0
cmp dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
je 0x464e40
mov edx, dword [esp + 0x68]
mov ebp, 0xffffffff
cmp edx, 0xffffffff
je 0x464de0
xor eax, eax
mov ecx, 0xd
lea edi, [esp + 0xa0]
mov dword [esp + 0x9c], 0x44
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc8], 0x101
cmp eax, 0xffffffff
cmove eax, dword [esp + 0x4c]
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0x60]
cmp eax, 0xffffffff
cmove eax, dword [esp + 0x48]
cmp edx, 0xffffffff
cmove edx, ebp
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
sub esp, 4
lea edx, [esp + 0x9c]
lea ebp, [esp + 0x8c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x110]
mov dword [esp + 0x24], ebp
shr edx, 4
mov dword [esp + 0x18], 0
and edx, 8
mov dword [esp + 0x10], 1
or edx, eax
lea eax, [esp + 0x74]
mov dword [esp + 0xc], eax
or edx, 0x4000004
mov dword [esp + 8], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x100]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
je 0x464d21
mov eax, dword [esp + 0x50]
lea edi, [esp + 0x80]
mov dword [esp], eax
call sub.libgcrypt_20.dll_gcry_free
mov dword [esp + 0x50], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x464bbe
mov dword [esp], eax
call esi
sub esp, 4
add edi, 4
cmp edi, ebp
jne 0x464baf
mov eax, dword [esp + 0x54]
cmp eax, 0xffffffff
je 0x464bd6
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x60]
cmp eax, 0xffffffff
je 0x464be7
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x68]
cmp eax, 0xffffffff
je 0x464bf8
mov dword [esp], eax
call esi
sub esp, 4
test byte [esp + 0x110], 0x40
jne 0x464d10
mov eax, dword [esp + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
mov eax, dword [esp + 0x90]
mov dword [esp], eax
call esi
sub esp, 4
mov ecx, dword [esp + 0x114]
test ecx, ecx
je 0x464c40
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x3c]
mov dword [eax], ecx
mov edx, dword [esp + 0x118]
test edx, edx
je 0x464c58
mov eax, dword [esp + 0x118]
mov edi, dword [esp + 0x40]
mov dword [eax], edi
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x464c70
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x44]
mov dword [eax], ecx
mov eax, dword [esp + 0x8c]
mov edi, dword [esp + 0x120]
mov dword [edi], eax
add esp, 0xec
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
shl esi, 0x18
mov ebx, esi
and ebx, 0x7f000000
or ebx, 1
mov dword [esp], ebx
call sub.libgpg_error_0.dll_gpg_strerror
mov dword [esp], str.error_creating_a_pipe:__s_n
mov esi, eax
call sub.libgpg_error_0.dll__gpg_w32_gettext
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0044dbb0
add esp, 0xec
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x118]
mov dword [esp + 0x3c], 0
test ebp, ebp
jne 0x46498b
mov edi, dword [esp + 0x11c]
mov dword [esp + 0x40], 0
test edi, edi
jne 0x4649eb
mov dword [esp + 0x44], 0
jmp 0x464a3c
mov dword [esp], 0xffffffff
call fcn.00450090
jmp 0x464c06
mov dword [esp], 0xffffffff
call fcn.004471f0
mov dword [esp], str.CreateProcess_failed:__s_n
mov dword [esp + 4], eax
call fcn.0044dbb0
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sub.libgcrypt_20.dll_gcry_free
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x464f20
mov dword [esp], eax
call sub.libgpg_error_0.dll_gpgrt_fclose
mov eax, dword [esp + 0x54]
cmp eax, 0xffffffff
je 0x464d72
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x40]
test eax, eax
je 0x464f00
mov dword [esp], eax
call sub.libgpg_error_0.dll_gpgrt_fclose
mov eax, dword [esp + 0x60]
cmp eax, 0xffffffff
je 0x464d9b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x44]
test eax, eax
je 0x464f40
mov dword [esp], eax
call sub.libgpg_error_0.dll_gpgrt_fclose
mov eax, dword [esp + 0x68]
cmp eax, 0xffffffff
je 0x464dc4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
shl esi, 0x18
add esp, 0xec
mov ebx, esi
and ebx, 0x7f000000
or ebx, 1
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x48a4b8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov ebp, eax
cmp eax, 0xffffffff
je 0x465130
mov dword [esp + 0x88], ebp
mov edx, dword [esp + 0x68]
jmp 0x464aad
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x40000000
mov dword [esp], 0x48a4b8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov dword [esp + 0x48], eax
cmp eax, 0xffffffff
je 0x465172
mov eax, dword [esp + 0x48]
mov dword [esp + 0x84], eax
jmp 0x464a9b
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x48a4b8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov dword [esp + 0x4c], eax
cmp eax, 0xffffffff
je 0x465151
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x80], eax
jmp 0x464a88
mov eax, dword [esp + 0x5c]
cmp eax, 0xffffffff
je 0x464d86
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x464d86
cmp dword [esp + 0x58], 0xffffffff
je 0x464d5d
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x464d5d
mov eax, dword [esp + 0x64]
cmp eax, 0xffffffff
je 0x464daf
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x464daf
call sub.libgpg_error_0.dll_gpg_err_code_from_syserror
mov ebx, eax
test eax, eax
je 0x464f7a
mov eax, esi
movzx ebx, bx
shl eax, 0x18
and eax, 0x7f000000
or ebx, eax
mov dword [esp], ebx
call sub.libgpg_error_0.dll_gpg_strerror
mov dword [esp], str.error_creating_a_stream_for_a_pipe:__s_n
mov esi, eax
call sub.libgpg_error_0.dll__gpg_w32_gettext
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0044dbb0
mov eax, dword [esp + 0x54]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call esi
sub esp, 4
jmp 0x464cc0
call sub.libgpg_error_0.dll_gpg_err_code_from_syserror
mov ebx, eax
test eax, eax
je 0x464fda
mov eax, esi
movzx ebx, bx
shl eax, 0x18
and eax, 0x7f000000
or ebx, eax
mov dword [esp], ebx
call sub.libgpg_error_0.dll_gpg_strerror
mov dword [esp], str.error_creating_a_stream_for_a_pipe:__s_n
mov esi, eax
call sub.libgpg_error_0.dll__gpg_w32_gettext
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0044dbb0
mov eax, dword [esp + 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x40]
mov dword [esp + 0x68], 0xffffffff
mov dword [esp + 0x64], 0xffffffff
test eax, eax
je 0x465110
mov dword [esp], eax
call sub.libgpg_error_0.dll_gpgrt_fclose
mov eax, dword [esp + 0x60]
cmp eax, 0xffffffff
je 0x46504f
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4650f6
mov dword [esp], eax
call sub.libgpg_error_0.dll_gpgrt_fclose
mov eax, dword [esp + 0x54]
cmp eax, 0xffffffff
je 0x464cc0
mov dword [esp], eax
call esi
sub esp, 4
jmp 0x464cc0
call sub.libgpg_error_0.dll_gpg_err_code_from_syserror
mov ebx, eax
test eax, eax
je 0x46509a
mov eax, esi
movzx ebx, bx
shl eax, 0x18
and eax, 0x7f000000
or ebx, eax
mov dword [esp], ebx
call sub.libgpg_error_0.dll_gpg_strerror
mov dword [esp], str.error_creating_a_stream_for_a_pipe:__s_n
mov esi, eax
call sub.libgpg_error_0.dll__gpg_w32_gettext
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0044dbb0
mov eax, dword [esp + 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x5c], 0xffffffff
test eax, eax
jne 0x46505b
mov eax, dword [esp + 0x58]
cmp eax, 0xffffffff
je 0x465063
mov dword [esp], eax
call esi
sub esp, 4
jmp 0x465063
mov eax, dword [esp + 0x5c]
cmp eax, 0xffffffff
je 0x46503e
mov dword [esp], eax
call esi
sub esp, 4
jmp 0x46503e
mov dword [esp], 0xffffffff
call fcn.004471f0
mov dword [esp], str.cant_open_nul:__s_n
mov dword [esp + 4], eax
call fcn.0044ddd0
jmp 0x464e2b
mov dword [esp], 0xffffffff
call fcn.004471f0
mov dword [esp], str.cant_open_nul:__s_n
mov dword [esp + 4], eax
call fcn.0044ddd0
jmp 0x464eed
mov dword [esp], 0xffffffff
call fcn.004471f0
mov dword [esp], str.cant_open_nul:__s_n
mov dword [esp + 4], eax
call fcn.0044ddd0
jmp 0x464e8d