Function at 0x46aa13
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x46aefe
cmp dword [ebx + 0x444], 0
jne 0x46aefe
mov dword [ebx + 0x444], 1
push ebx
call fcn.0046a88f
cmp dword [0x536414], 0
je 0x46aa64
mov dword [ebx + 0x434], 0xffffffff
push dword [ebx]
call fcn.004f9c59
push eax
call fcn.004e6fbd
xor esi, esi
xor edi, edi
mov eax, dword [ebx + 0x420]
test eax, eax
je 0x46aa7e
cmp eax, dword [ebx + 0x414]
ja 0x46abf6
mov dword [ebx + 0x404], 9
cmp dword [ebx + 0x420], 0
jbe 0x46aaba
push 0
call fcn.00526bc8
pop ecx
mov ecx, eax
sub ecx, dword [ebx + 0x448]
test ecx, ecx
jg 0x46aaaa
mov ecx, 1
mov eax, dword [ebx + 0x420]
xor edx, edx
div ecx
mov dword [ebx + 0x42c], eax
cmp dword [0x528300], 0
je 0x46aacb
push 0x1e
push ebx
call fcn.00469284
cmp dword [0x534d3c], 0
je 0x46ab23
mov eax, dword [ebx + 0x400]
test eax, eax
jl 0x46aae5
push eax
call fcn.0051b824
pop ecx
mov dword [ebx + 0x400], 0xffffffff
mov dword [0x52e83c], ebx
xor edx, edx
mov dword [0x53506c], edx
push 0
push 0x16
push 0x52e96c
push 0
call fcn.004d67d1
xor ecx, ecx
mov dword [0x52e83c], ecx
push ebx
call fcn.004691e4
test eax, eax
je 0x46aefe
push 0
push 1
push 0x54deda
lea eax, [ebx + 0x234]
push eax
call fcn.0046171f
cmp byte [0x54deda], 0
je 0x46abf6
push 0x54deda
call fcn.005183dc
pop ecx
add eax, 4
push eax
call fcn.00524378
pop ecx
mov esi, eax
test esi, esi
je 0x46abf6
push esi
mov edi, 0x54deda
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
lea eax, [ebx + 0x234]
push eax
lea edx, [ebx + 0x130]
push edx
push 0x52e976
push 0x54deda
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0x54deda
call fcn.005183dc
pop ecx
add eax, 4
push eax
call fcn.00524378
pop ecx
mov edi, eax
test edi, edi
je 0x46abed
push esi
push edi
mov esi, edi
mov edi, 0x54deda
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x46abf6
push esi
call fcn.00524270
pop ecx
xor esi, esi
cmp dword [0x52c448], 0
je 0x46ae04
push ebx
call fcn.0046a81c
push dword [0x52a380]
push dword [0x537430]
call fcn.004c7b7f
mov eax, dword [ebx + 0x420]
test eax, eax
je 0x46ac30
cmp eax, dword [ebx + 0x414]
ja 0x46ad5d
lea edx, [ebx + 4]
push edx
lea ecx, [ebx + 0x234]
push ecx
push 0
push 0xb6b
call fcn.00415c87
push eax
push 0x54deda
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov dword [ebp - 4], 1
mov eax, dword [ebx + 0x448]
test eax, eax
jle 0x46acb7
mov edx, dword [ebx + 0x44c]
sub edx, eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 1
jae 0x46ac7e
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
jbe 0x46aca3
push 1
push dword [ebp - 4]
push 0x52e97c
call fcn.00495e39
push eax
push 0x54deda
call fcn.00518300
add esp, 8
jmp 0x46acd1
push 0x52e980
push 0x54deda
call fcn.00518300
add esp, 8
jmp 0x46acd1
push 0
push 0xb66
call fcn.00415c87
push eax
push 0x54deda
call fcn.00518300
add esp, 8
push 0x52e98a
push 0x54deda
call fcn.00518300
add esp, 8
cmp dword [ebp - 4], 0
jbe 0x46ad2f
mov eax, dword [ebx + 0x414]
mov edx, dword [ebx + 0x424]
cmp eax, edx
jae 0x46acfd
mov ecx, eax
jmp 0x46ad01
mov ecx, eax
sub ecx, edx
mov eax, ecx
xor edx, edx
div dword [ebp - 4]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x52e98d
push 0x54deda
call fcn.005183dc
pop ecx
add eax, 0x54deda
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x46ad49
push 0
push 0xb66
call fcn.00415c87
push eax
push 0x54deda
call fcn.00518300
add esp, 8
push 0x52e995
push 0x54deda
call fcn.00518300
add esp, 8
jmp 0x46adc6
push ebx
call fcn.00469bb5
push ebx
call fcn.004691e4
test eax, eax
je 0x46aefe
cmp dword [ebx + 0x404], 4
jne 0x46ada1
lea eax, [ebx + 4]
push eax
lea edx, [ebx + 0x234]
push edx
push 0
push 0xb68
call fcn.00415c87
push eax
push 0x54deda
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x46adc6
lea ecx, [ebx + 4]
push ecx
lea eax, [ebx + 0x234]
push eax
push 0
push 0xb69
call fcn.00415c87
push eax
push 0x54deda
call sub.USER32.dll_wsprintfA
add esp, 0x10
xor edx, edx
mov dword [0x534c34], edx
push dword [0x52a378]
push 0x54deda
push dword [0x537430]
call fcn.004c7cd0
push dword [0x52a380]
push dword [0x537430]
call fcn.004c7b7f
push 0
push 0
push 0x10
push dword [ebx]
call sub.USER32.dll_SendMessageA
jmp 0x46ae62
mov eax, dword [ebx + 0x420]
test eax, eax
je 0x46ae16
cmp eax, dword [ebx + 0x414]
ja 0x46ae2d
push 1
push ebx
push 0
push 0xb6a
call fcn.00415c87
push eax
call fcn.00469c75
jmp 0x46ae62
cmp dword [ebx + 0x404], 4
jne 0x46ae4d
push 1
push ebx
push 0
push 0xb67
call fcn.00415c87
push eax
call fcn.00469c75
jmp 0x46ae62
push 1
push ebx
push 0
push 0xb60
call fcn.00415c87
push eax
call fcn.00469c75
test esi, esi
je 0x46aefe
cmp byte [esi], 0x2f
jne 0x46ae84
push 0
push 0
push 1
push edi
push esi
push dword [0x537430]
call fcn.00489ea4
jmp 0x46aeec
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 5
push 0x52feac
push edi
push esi
push 0x52e998
push dword [0x537420]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x46aee5
xor edx, edx
mov dword [0x534c34], edx
push esi
push 0
push 0xb6c
call fcn.00415c87
push eax
push 0x54deda
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x52a380]
push 0x54deda
push dword [0x537430]
call fcn.004c8c63
push 0
call sub.KERNEL32.dll_SetErrorMode
push esi
call fcn.00524270
pop ecx
test edi, edi
je 0x46aefe
push edi
call fcn.00524270
pop ecx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4