Function at 0x46d770
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x44], ecx
call fcn.00466d50
movzx eax, al
test eax, eax
je 0x46d79b
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov ecx, dword [ebp + 8]
call fcn.00402700
jmp 0x46da13
mov ecx, dword [ebp - 0x44]
call fcn.0046d1f0
movzx edx, al
test edx, edx
jne 0x46d7e2
mov ecx, dword [ebp - 0x44]
call fcn.0046ce50
movzx eax, al
test eax, eax
jne 0x46d7e2
mov ecx, dword [ebp - 0x44]
call fcn.00468670
push eax
push 0x49414c
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.0046bec0
mov ecx, eax
call fcn.00403130
jmp 0x46da13
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x4440
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], str.open
mov ecx, dword [ebp - 0x44]
call fcn.00468640
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jg 0x46d9d6
mov ecx, dword [ebp - 0x44]
call fcn.00468670
push eax
push 0x494718
mov ecx, dword [ebp - 4]
push ecx
push 0x494708
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.0046bf00
mov ecx, eax
call fcn.0046bec0
mov ecx, eax
call fcn.0046bec0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 0x20
ja case.0x46d889.1
mov eax, dword [ebp - 0x48]
movzx ecx, byte [eax + 0x46da54]
jmp dword [ecx*4 + 0x46da1c]
push str.The_operating_system_is_out_of_memory_or_resources.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.The_specified_file_was_not_found.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.The_specified_path_was_not_found.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.The_.exe_file_is_invalid__non_Microsoft_Win32_.exe_or_error_in_.exe_image_.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.The_operating_system_denied_access_to_the_specified_file.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.The_file_name_association_is_incomplete_or_invalid.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.The_Dynamic_Data_Exchange__DDE__transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.The_DDE_transaction_failed.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.The_specified_dynamic_link_library__DLL__was_not_found.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.There_is_no_application_associated_with_the_given_file_name_extension._This_error_will_also_be_returned_if_you_attempt_to_print_a_file_that_is_not_printable.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.There_was_not_enough_memory_to_complete_the_operation.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
push str.A_sharing_violation_occurred.
mov ecx, dword [ebp + 8]
call fcn.00402710
mov ecx, eax
call fcn.00403130
jmp 0x46da13
mov ecx, dword [ebp + 8]
call fcn.00403130
jmp 0x46da13
cmp dword [ebp - 8], 0
jne 0x46d9e7
mov edx, dword [ebp + 0xc]
mov dword [edx], 0xffffffff
jmp 0x46da0b
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
call fcn.00402700
mov esp, ebp
pop ebp
ret 0x18