Function at 0x46be50
Capabilities:
Create process on windows
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486adf
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x4a4100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [ebp - 0x4ec]
push eax
call fcn.0046d040
add esp, 4
call fcn.0046bd40
mov edi, eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x4d4], edi
cmp edi, esi
je 0x46c61b
mov ecx, 1
mov edx, 0x4a8180
lock cmpxchg dword [edx], ecx
cmp byte [edi + 0x127c], 0
jne 0x46becc
cmp eax, esi
je 0x46bee2
jmp 0x46c619
cmp eax, esi
je 0x46bee2
push 0xbaad0101
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x410
lea ecx, [ebp - 0x4a2]
xor eax, eax
push esi
push ecx
mov dword [ebp - 0x4c4], esi
mov word [ebp - 0x4a4], ax
call fcn.00474b70
xor edx, edx
mov dword [ebp - 0x4a8], 7
mov dword [ebp - 0x4ac], esi
mov word [ebp - 0x4bc], dx
xor eax, eax
xor ecx, ecx
push 0x40
mov word [ebp - 0x30], cx
lea ecx, [ebp - 0x52c]
push esi
push ecx
mov dword [ebp - 4], esi
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4e], eax
mov dword [ebp - 0x4a], eax
mov dword [ebp - 0x46], eax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov word [ebp - 0x32], ax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
mov word [ebp - 0x90], dx
mov dword [ebp - 0x8e], eax
mov dword [ebp - 0x8a], eax
mov dword [ebp - 0x86], eax
mov dword [ebp - 0x82], eax
mov dword [ebp - 0x7e], eax
mov dword [ebp - 0x7a], eax
mov dword [ebp - 0x76], eax
mov word [ebp - 0x72], ax
mov word [ebp - 0x70], ax
mov dword [ebp - 0x6e], eax
mov dword [ebp - 0x6a], eax
mov dword [ebp - 0x66], eax
mov dword [ebp - 0x62], eax
mov dword [ebp - 0x5e], eax
mov dword [ebp - 0x5a], eax
mov dword [ebp - 0x56], eax
mov word [ebp - 0x52], ax
mov dword [ebp - 0x530], esi
call fcn.00474b70
mov dword [ebp - 0x4e4], esi
xor eax, eax
lea esi, [edi + 0x228]
push 1
push esi
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x4d8], eax
call fcn.0046d800
push str.CrashReport.exe
push esi
call fcn.0046f9ec
add esp, 0x28
test eax, eax
jne 0x46c019
push str.CrashReport.exe
call fcn.0046da70
add esp, 4
cmp eax, 2
jb 0x46c019
push 0xbaad0103
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, dword [edi + 4]
push 0x1780
push 0
push ebx
call fcn.00474b70
mov dword [ebx], 0xc
mov dword [ebx + 8], 0x1780
mov dword [ebx + 4], 0x90909090
mov edx, dword [edi + 0x1280]
add esp, 0xc
mov dword [ebx + 0x1700], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov dword [ebp - 0x4c8], ecx
push eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x4c8], eax
pop eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebx + 0x28], eax
mov dword [ebp - 0x4cc], ecx
push eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x4cc], eax
pop eax
mov eax, dword [ebx + 0x28]
mov edx, dword [ebp - 0x4cc]
mov dword [ebx + 0x30], edx
cmp eax, ecx
je 0x46c0ad
mov ecx, dword [eax + 8]
mov dword [ebx + 0x14], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx], 0x88888888
jne 0x46c0c3
mov byte [ebx + 0x16f9], 0
jmp 0x46c0cf
mov dl, byte [edi + 0x127b]
mov byte [ebx + 0x16f9], dl
movzx ecx, byte [edi + 0x1278]
mov byte [ebx + 0x16fb], cl
mov dl, byte [edi + 0x1279]
push 0x104
mov byte [ebx + 0x16fa], dl
movzx ecx, byte [edi + 0x127c]
push esi
lea edx, [ebx + 0x7e6]
push 0x105
push edx
mov byte [ebx + 0x16f8], cl
mov dword [ebx + 0x354], eax
call fcn.0046fbcf
push 0x104
lea eax, [edi + 0x63c]
push eax
lea ecx, [ebx + 0xe04]
push 0x105
push ecx
call fcn.0046fbcf
push 0x104
lea edx, [edi + 0x846]
push edx
lea eax, [ebx + 0x9f0]
push 0x105
push eax
call fcn.0046fbcf
push 0x104
lea ecx, [edi + 0xa50]
push ecx
lea edx, [ebx + 0xbfa]
push 0x105
push edx
call fcn.0046fbcf
add esp, 0x40
push 0x104
lea eax, [edi + 0x432]
push eax
lea ecx, [ebx + 0x100e]
push 0x105
push ecx
call fcn.0046fbcf
push 0x104
lea edx, [edi + 0xe64]
push edx
lea eax, [ebx + 0x1256]
push 0x105
push eax
call fcn.0046fbcf
push 0x104
lea ecx, [edi + 0x106e]
push ecx
lea edx, [ebx + 0x1460]
push 0x105
push edx
call fcn.0046fbcf
push 0x1e
lea eax, [edi + 0xc5a]
push eax
lea ecx, [ebx + 0x1218]
push 0x1f
push ecx
call fcn.0046fbcf
add esp, 0x40
push 0x1e
push 0x4a80b0
lea edx, [ebx + 0x166a]
push 0x1f
push edx
call fcn.0046fbcf
push 0x1e
push 0x4a8070
lea eax, [ebx + 0x16a8]
push 0x1f
push eax
call fcn.0046fbcf
push 0x1e
push 0x4a8130
push 0x1f
lea ecx, [ebx + 0x1704]
push ecx
call fcn.0046fbcf
push 0x1e
push 0x4a80f0
lea edx, [ebx + 0x1742]
push 0x1f
push edx
call fcn.0046fbcf
mov eax, dword [0x4a8064]
add esp, 0x40
mov dword [ebx + 0x16f4], eax
mov ecx, dword [0x4a8170]
mov dword [ebx + 0x16f0], ecx
mov edx, dword [0x4a8174]
push 0x104
add edi, 0x1e
push edi
mov dword [ebx + 0x16e8], edx
mov eax, dword [0x4a8178]
lea ecx, [ebx + 0x5dc]
push 0x105
push ecx
mov dword [ebx + 0x16ec], eax
call fcn.0046fbcf
mov edx, dword [ebp + 8]
mov esi, dword [edx + 4]
mov eax, edx
lea edi, [ebx + 0x88]
mov ecx, 0xb3
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax]
lea edi, [ebx + 0x38]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x4d0]
push ecx
lea edx, [ebp - 0x4a4]
mov edi, 0x208
push edx
mov dword [ebp - 0x4d0], edi
call fcn.0046cd70
add esp, 0x18
test eax, eax
je 0x46c2d4
push str.CrashReport.exe
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [ebp - 0x4a4], 0
je 0x46c59a
push 0x10
push 0x10
lea ecx, [ebp - 0x50]
push ecx
push ebx
call fcn.004710d2
mov esi, dword [ebp - 0x4d4]
mov eax, dword [esi + 0x1284]
push 0xa
push 0x10
lea edx, [ebp - 0x30]
push edx
push eax
call fcn.004710d2
mov edx, dword [ebx + 0x18]
push 0xa
push 0x10
lea ecx, [ebp - 0x90]
push ecx
push edx
call fcn.004710d2
mov ecx, dword [ebx + 0x1c]
push 0xa
push 0x10
lea eax, [ebp - 0x70]
push eax
push ecx
call fcn.004710d2
add esp, 0x40
push 0x48e940
lea edx, [ebp - 0x4c0]
push edx
lea eax, [ebp - 0x5f4]
push eax
call fcn.0044a430
lea ecx, [ebp - 0x4a4]
push ecx
push eax
lea edx, [ebp - 0x62c]
push edx
mov byte [ebp - 4], 1
call fcn.0044a430
push 0x48e938
push eax
lea eax, [ebp - 0x5bc]
push eax
mov byte [ebp - 4], 2
call fcn.0044a430
push 0x48e924
push eax
lea ecx, [ebp - 0x664]
push ecx
mov byte [ebp - 4], 3
call fcn.0044a430
lea edx, [ebp - 0x50]
push edx
push eax
lea eax, [ebp - 0x584]
push eax
mov byte [ebp - 4], 4
call fcn.0044a430
push 0x48e920
push eax
lea ecx, [ebp - 0x680]
push ecx
mov byte [ebp - 4], 5
call fcn.0044a430
add esp, 0x48
lea edx, [ebp - 0x90]
push edx
push eax
lea eax, [ebp - 0x648]
push eax
mov byte [ebp - 4], 6
call fcn.0044a430
push 0x48e920
push eax
lea ecx, [ebp - 0x54c]
push ecx
mov byte [ebp - 4], 7
call fcn.0044a430
lea edx, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x5d8]
push eax
mov byte [ebp - 4], 8
call fcn.0044a430
push 0x48e920
push eax
lea ecx, [ebp - 0x5a0]
push ecx
mov byte [ebp - 4], 9
call fcn.0044a430
lea edx, [ebp - 0x30]
push edx
push eax
lea eax, [ebp - 0x568]
push eax
mov byte [ebp - 4], 0xa
call fcn.0044a430
push 0x48e91c
push eax
lea ecx, [ebp - 0x610]
push ecx
mov byte [ebp - 4], 0xb
call fcn.0044a430
add esp, 0x48
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 4], 0xc
call fcn.00405c00
lea ecx, [ebp - 0x610]
call fcn.00406360
lea ecx, [ebp - 0x568]
call fcn.00406360
lea ecx, [ebp - 0x5a0]
call fcn.00406360
lea ecx, [ebp - 0x5d8]
call fcn.00406360
lea ecx, [ebp - 0x54c]
call fcn.00406360
lea ecx, [ebp - 0x648]
call fcn.00406360
lea ecx, [ebp - 0x680]
call fcn.00406360
lea ecx, [ebp - 0x584]
call fcn.00406360
lea ecx, [ebp - 0x664]
call fcn.00406360
lea ecx, [ebp - 0x5bc]
call fcn.00406360
lea ecx, [ebp - 0x62c]
call fcn.00406360
lea ecx, [ebp - 0x5f4]
call fcn.00406360
cmp dword [ebp - 0x4ac], edi
jae 0x46c5a0
cmp dword [ebp - 0x4a8], 8
mov eax, dword [ebp - 0x4bc]
jae 0x46c4fc
lea eax, [ebp - 0x4bc]
push 0x207
push eax
lea edx, [ebp - 0x4a4]
push edi
push edx
call fcn.0046fbcf
lea eax, [ebp - 0x4c4]
push eax
mov dword [ebp - 0x4c4], 0
call fcn.0046ba40
add esp, 0x14
test eax, eax
jne 0x46c535
movzx eax, byte [esi + 0x1279]
jmp 0x46c53b
mov eax, dword [ebp - 0x4c4]
lea ecx, [ebp - 0x4a4]
test eax, eax
je 0x46c552
push 0
push ecx
call fcn.0046b410
add esp, 8
jmp 0x46c57f
lea edx, [ebp - 0x4e4]
push edx
lea eax, [ebp - 0x530]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push ecx
push 0
mov dword [ebp - 0x530], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x4c4], eax
test eax, eax
je 0x46c5a0
mov edx, dword [esi + 0x1284]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x46c5a0
mov esi, dword [ebp - 0x4d4]
mov eax, dword [ebp - 0x4e4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x46c5b3
push eax
call edi
mov eax, dword [ebp - 0x4e0]
test eax, eax
je 0x46c5c0
push eax
call edi
cmp dword [ebp - 0x4c4], 0
je 0x46c601
cmp byte [esi + 0x127a], 0
je 0x46c601
cmp byte [esi + 0x127c], 0
je 0x46c601
push 0xbaad0102
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
call edi
push 0xbaad0102
push 0xffffffffffffffff
call edi
push 0
mov ecx, esi
call fcn.0046b9a0
cmp dword [ebp - 0x4a8], 8
jb 0x46c619
mov eax, dword [ebp - 0x4bc]
push eax
call fcn.0046f011
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f01c
mov esp, ebp
pop ebp
ret 4