Function at 0x45c8a4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
xor ebx, ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405ae0
lea eax, [ebp - 8]
call fcn.00405ae0
mov eax, dword [ebp - 0xc]
call fcn.00405410
xor eax, eax
push ebp
push 0x45cb60
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.0046001c
fcomp dword [0x45cb70]
fnstsw ax
sahf
jae 0x45c98e
cmp byte [ebp + 0x10], 0
je 0x45c94c
push 0x45cb78
push dword [ebp - 4]
push 0x45cb80
push dword [ebp - 8]
lea eax, [ebp - 0x7c]
mov edx, 4
call fcn.00405934
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
call fcn.004051f0
mov eax, dword [ebp - 0x78]
mov cl, byte [ebp + 0x14]
mov edx, dword [ebp + 0xc]
call fcn.0045c488
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov bl, 1
jmp 0x45cb1d
lea eax, [ebp - 0x80]
mov edx, dword [ebp - 8]
call fcn.004051f0
mov eax, dword [ebp - 0x80]
push eax
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 4]
call fcn.004051f0
mov eax, dword [ebp - 0x84]
mov cl, byte [ebp + 0x14]
pop edx
call fcn.0045c7d0
mov ebx, eax
test bl, bl
je 0x45cb1d
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
jmp 0x45cb1d
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x10
call fcn.00403540
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0x44
call fcn.00403540
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], 1
cmp byte [ebp + 0x14], 0
je 0x45c9cd
mov word [ebp - 0x44], 0xa
jmp 0x45c9d3
mov word [ebp - 0x44], 0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 8
call fcn.00403540
lea eax, [ebp - 0x10]
push eax
push 0x2000000
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x45cb1d
lea eax, [ebp - 0x14]
push eax
push 1
push 2
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x45cb14
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405420
push eax
call fcn.004595c0
test eax, eax
je 0x45cb0b
mov dword [ebp - 0x1c], 0x20
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_GetLengthSid
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
push 0x19
mov eax, dword [ebp - 0x14]
push eax
call fcn.00459508
test eax, eax
je 0x45cb02
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405854
push eax
mov eax, dword [ebp - 4]
call fcn.00405854
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
je 0x45cb02
cmp byte [ebp + 0x10], 0
je 0x45caf9
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_WaitForInputIdle
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
sub eax, 1
jb 0x45cac7
sub eax, 0x101
je 0x45cad6
jmp 0x45cae5
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
jmp 0x45cae5
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x30]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x45cb00
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov bl, 1
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_LocalFree
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cb67
lea eax, [ebp - 0x84]
mov edx, 2
call fcn.00404f94
lea eax, [ebp - 0x7c]
call fcn.00405660
lea eax, [ebp - 0x78]
call fcn.00404f70
lea eax, [ebp - 0xc]
call fcn.00404f70
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405678
ret