Function at 0x4046c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x90
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov dword [esp + 4], 1
lea eax, [ebp - 0x18]
mov dword [esp], eax
call dbg.pipe_create
test eax, eax
je 0x4046f2
mov eax, 0xffffffff
jmp 0x4048e2
mov dword [esp + 4], 0
lea eax, [ebp - 0x20]
mov dword [esp], eax
call dbg.pipe_create
test eax, eax
je 0x40471e
lea eax, [ebp - 0x18]
mov dword [esp], eax
call dbg.pipe_close
mov eax, 0xffffffff
jmp 0x4048e2
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov ebx, eax
mov esi, dword [ebp - 0x1c]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
je 0x4048bb
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x64]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x100
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x64]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404886
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov eax, 0
jmp 0x4048e2
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
sub eax, 2
cmp eax, 1
ja 0x40489d
mov eax, dword [ebp + 0x14]
mov byte [eax], 7
jmp 0x4048a9
mov dword [esp], str.CreateProcess
call dbg.syserror
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
jmp 0x4048c7
mov dword [esp], str.DuplicateHandle
call dbg.syserror
lea eax, [ebp - 0x20]
mov dword [esp], eax
call dbg.pipe_close
lea eax, [ebp - 0x18]
mov dword [esp], eax
call dbg.pipe_close
mov eax, 0xffffffff
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret