Function at 0x46d1b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x46d1c1
mov eax, dword [ebp - 4]
add esp, 0xfffffecc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0x10]
lea esi, [ebp - 0x48]
push 0x3c
push 0
push esi
call fcn.0049fc54
add esp, 0xc
mov dword [esi], 0x3c
mov dword [esi + 4], 0x500
test bl, bl
jne 0x46d207
or dword [esi + 4], 0x40
mov dword [esi + 0x10], edi
cmp dword [ebp + 8], 0
je 0x46d218
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
jmp 0x46d23c
lea edx, [ebp - 0x98]
mov ecx, 0x50
mov eax, dword [esi + 0x10]
call fcn.0046bc38
test al, al
je 0x46d237
lea edx, [ebp - 0x98]
jmp 0x46d239
xor edx, edx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x14], ecx
call fcn.0040c4d0
cmp edi, eax
jne 0x46d271
push edi
push str.._s
lea edx, [ebp - 0x898]
push edx
call fcn.004a2e18
add esp, 0xc
lea ecx, [ebp - 0x898]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], 1
call fcn.0041113c
test eax, eax
je 0x46d369
mov eax, dword [ebp - 4]
call fcn.0040fd70
cmp word [eax], 0
jne 0x46d29d
cmp dword [ebp + 0x14], 0
je 0x46d369
xor edx, edx
mov dword [ebp - 0xc], edx
push 0x4b3abd
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x46d2be
push str.ShellExecuteExW
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46d2cb
xor eax, eax
jmp 0x46d435
lea ecx, [ebp - 0x1098]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0040dd30
mov dword [esi + 0x10], eax
cmp dword [esi + 0xc], 0
je 0x46d300
lea edx, [ebp - 0x1138]
mov ecx, 0x1000000
mov eax, dword [esi + 0xc]
call fcn.004111c4
lea edx, [ebp - 0x1138]
mov dword [esi + 0xc], edx
cmp dword [ebp - 8], 0
je 0x46d322
lea edx, [ebp - 0x1938]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.004111c4
lea eax, [ebp - 0x1938]
mov dword [esi + 0x18], eax
cmp dword [ebp + 0x18], 0
jne 0x46d32e
cmp dword [ebp + 0x14], 0
je 0x46d342
lea ecx, [ebp - 0x2138]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
call fcn.0040dd30
mov dword [esi + 0x14], eax
mov byte [0x4d27e0], 1
push esi
call dword [ebp - 0xc]
test eax, eax
jne 0x46d360
cmp dword [esi + 0xc], 0
je 0x46d360
xor edx, edx
mov dword [esi + 0xc], edx
push esi
call dword [ebp - 0xc]
mov byte [0x4d27e0], 0
jmp 0x46d392
mov byte [0x4d27e0], 1
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
jne 0x46d38b
cmp dword [esi + 0xc], 0
je 0x46d38b
xor ecx, ecx
mov dword [esi + 0xc], ecx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
mov byte [0x4d27e0], 0
test eax, eax
je 0x46d3a2
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x483
jne 0x46d3a9
xor eax, eax
jmp 0x46d435
test bl, bl
jne 0x46d433
cmp dword [esi + 0x38], 0
je 0x46d3f2
mov edx, dword [0x4b3a8c]
mov ecx, dword [esi + 0x38]
mov dword [edx*4 + 0x4d66e0], ecx
mov eax, dword [0x4b3a8c]
mov edx, dword [esi + 0x20]
mov dword [eax*4 + 0x4d6720], edx
mov ecx, dword [0x4b3a8c]
inc ecx
and ecx, 0x8000000f
jns 0x46d3ea
dec ecx
or ecx, 0xfffffff0
inc ecx
mov dword [0x4b3a8c], ecx
jmp 0x46d425
xor ebx, ebx
mov eax, dword [ebx*4 + 0x4d6720]
cmp eax, dword [esi + 0x20]
jne 0x46d41f
push 0
push dword [ebx*4 + 0x4d66e0]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x46d41f
mov edx, dword [ebx*4 + 0x4d66e0]
mov dword [esi + 0x38], edx
inc ebx
cmp ebx, 0x10
jl 0x46d3f4
cmp dword [ebp + 0xc], 0
je 0x46d433
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x38]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14