Function at 0x46684c
Capabilities:
Create process on windows
Create process suspended
Resume thread
Suspend thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x465348
call fcn.00406a8c
mov ebx, 0x46dde0
mov esi, 0x46ddf0
mov edi, 0x468818
xor eax, eax
push ebp
push 0x466ac5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x468b0c]
mov eax, dword [eax]
call fcn.00446d4c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409118
mov edx, dword [ebp - 0x14]
mov eax, 0x46ddf8
call fcn.00404a74
lea eax, [ebp - 0x1c]
mov ecx, 0x466adc
mov edx, dword [0x46ddf8]
call fcn.00404d38
mov eax, dword [ebp - 0x1c]
call fcn.0040906c
test al, al
jne 0x4668dc
mov eax, 0x466af0
call fcn.004311a4
jmp 0x466aaa
mov eax, ebx
xor ecx, ecx
mov edx, 0x10
call fcn.00403528
mov eax, 0x46dd9c
xor ecx, ecx
mov edx, 0x44
call fcn.00403528
mov dword [0x46dd9c], 0x44
push ebx
push 0x46dd9c
push 0
push 0
push 4
push 0
push 0
push 0
push 0x466b14
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x46693c
mov eax, 0x466b28
call fcn.004311a4
jmp 0x466aaa
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_SuspendThread
push esi
push 2
push 0x46ddf4
push 0x5cb832
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_ReadProcessMemory
cmp byte [0x46ddf4], 0xe8
jne 0x46693c
cmp byte [0x46ddf5], 0xe2
jne 0x46693c
push esi
push 6
push edi
push 0x55604a
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x5564ce
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x556be8
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x55e500
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x55fc72
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x55ff17
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x5600e2
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x560a30
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x56977c
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x55fb03
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x56a1f5
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x5a2ead
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x5a2f7e
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x5ace8f
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push edi
push 0x5acfcb
mov eax, dword [ebx]
push eax
call main
push esi
push 6
push 0x468820
push 0x56779c
mov eax, dword [ebx]
push eax
call main
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466acc
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404a44
ret