Function at 0x460d40
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
mov esi, edx
and eax, 8
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x20
mov dword [ebp - 0x18], eax
je 0x460d80
mov al, byte [0x49d261]
mov cl, al
and ecx, 1
or al, 1
mov dword [ebp - 0x1c], ecx
mov byte [0x49d261], al
lea edx, [ebp - 8]
push edi
lea eax, [ebp - 0x34]
push edx
push eax
call fcn.0041a000
add esp, 0xc
test eax, eax
jne 0x460da9
mov eax, 0x69
lea esp, [ebp - 0x188]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test edi, 0x8000
je 0x460db8
mov dword [ebp - 0x10], 0x22
mov eax, 0x104
call fcn.0048d710
mov al, byte [esi]
mov edi, esp
cmp al, 0x22
je 0x460df6
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push esi
call fcn.00452400
add esp, 0x10
test eax, eax
jne 0x460df0
mov eax, 0x69
lea esp, [ebp - 0x188]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov byte [eax + edi], 0
mov esi, edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x272a
repne scasb al, byte es:[edi]
mov edi, dword [ebp + 8]
push eax
not ecx
dec ecx
push eax
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x20], ecx
lea edi, [ecx + edx + 3]
xor edx, edx
mov ecx, edi
call fcn.00452a70
mov ebx, eax
test ebx, ebx
jne 0x460e43
mov eax, 0x69
lea esp, [ebp - 0x188]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp - 0xc]
mov edi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ecx, eax
mov al, byte [esi]
lea edi, [ebx + ecx]
cmp al, 0x20
je 0x460e7c
mov byte [edi], 0x20
inc edi
mov ecx, dword [ebp - 0x20]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041a4d0
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [0x4b790c]
mov eax, dword [0x4b78f8]
and ch, 0xf7
or ch, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [0x4b78fc]
lea edx, [ebp - 0x17c]
push 0x104
push edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x17c]
and eax, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x6c], eax
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x78]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x10]
push ecx
push edx
push eax
push 1
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x460f5b
call esi
test eax, eax
je 0x460f5b
cmp eax, 1
jbe 0x460f4a
cmp eax, 3
ja 0x460f4a
call fcn.0041a930
mov dword [ebp - 4], 0xad
jmp 0x460fde
call fcn.0041a930
mov dword [ebp - 4], 0x69
jmp 0x460fde
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
call fcn.0041a290
call fcn.0041a930
test byte [ebp + 0xc], 1
je 0x460fc3
mov ecx, dword [ebp - 0x30]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x460fa1
cmp eax, 0xffffffff
jne 0x460fb5
call esi
sub eax, 0x42b
neg eax
sbb eax, eax
and eax, 0x55
add eax, 0x73
mov dword [ebp - 4], eax
call fcn.00458280
jmp 0x460fd2
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 4], 0x20
jne 0x460fbc
mov dword [ebp - 4], 0xc8
call fcn.00458280
jmp 0x460fd2
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [edx], ecx
mov eax, dword [ebp - 0x30]
push eax
call edi
mov ecx, dword [ebp - 0x2c]
push ecx
call edi
push 1
xor edx, edx
mov ecx, ebx
call fcn.004533c0
test byte [ebp + 0xc], 2
jne 0x461006
mov eax, dword [ebp - 8]
test eax, eax
je 0x461006
mov esi, dword [eax - 4]
add eax, 0xfffffffc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call edi
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x461024
mov eax, dword [ebp - 0x1c]
test eax, eax
mov al, byte [0x49d261]
je 0x46101d
or al, 1
jmp 0x46101f
and al, 0xfe
mov byte [0x49d261], al
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x188]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14