Function at 0x46fbb8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x27
push 0
push 0
dec ecx
jne 0x46fbc0
push ebx
xor eax, eax
push ebp
push 0x470077
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
movzx eax, word [0x47607c]
cmp eax, 0x1e
jg 0x46fc0f
je 0x46fee7
dec eax
je 0x46fc3a
sub eax, 9
je 0x46fdd6
sub eax, 0xa
je 0x46fea8
sub eax, 2
je 0x46fec0
jmp 0x47004c
sub eax, 0x28
je 0x46ff26
sub eax, 2
je 0x46ff3e
sub eax, 0x1c
je 0x46ff65
sub eax, 0x33e
je 0x470048
jmp 0x47004c
mov word [0x47607c], 0x384
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x470090
mov edx, 0x4700a0
mov eax, dword [0x47605c]
mov ebx, dword [eax]
call dword [ebx]
cmp dword [ebp - 8], 0
je 0x47004c
mov eax, 0x476074
mov ecx, 0x4700b0
mov edx, dword [ebp - 8]
call fcn.004048b8
mov eax, dword [0x476074]
call fcn.00409178
test al, al
je 0x47004c
xor eax, eax
push ebp
push 0x46fdcf
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x476074]
mov eax, 0x476080
call fcn.00402dac
mov eax, 0x476080
call fcn.00402b48
call fcn.00402884
lea edx, [ebp - 0xc]
mov eax, 0x476080
call fcn.00403160
mov eax, 0x476080
call fcn.004031cc
call fcn.00402884
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 0xc]
call fcn.00408758
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0xc]
call fcn.00404644
mov edx, dword [ebp - 0xc]
mov eax, 0x4700c4
call fcn.00404bb0
test eax, eax
jle 0x46fd21
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4700c4
call fcn.00404bb0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404acc
push 0
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x4700d0
mov edx, 0x4700e0
mov eax, dword [0x47605c]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x114]
mov eax, 0x47606c
call fcn.00404600
mov eax, dword [0x47606c]
mov edx, dword [ebp - 0xc]
call fcn.004049b8
je 0x46fdb2
call fcn.0040a72c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x118]
mov eax, 0x4700f0
call fcn.0040b3a8
mov edx, dword [ebp - 0x118]
mov eax, 0x475fec
mov ecx, 0x470108
call fcn.004048b8
mov eax, dword [0x475fe8]
mov eax, dword [eax + 0x308]
mov eax, dword [eax + 0x220]
mov edx, dword [0x475fec]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov word [0x47607c], 0xa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47004c
mov eax, 0x476080
call fcn.00402e68
call fcn.00402884
ret
call fcn.0040a72c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x11c]
mov eax, 0x4700f0
call fcn.0040b3a8
mov edx, dword [ebp - 0x11c]
mov eax, 0x475fec
mov ecx, 0x470120
call fcn.004048b8
mov eax, dword [0x475fe8]
mov eax, dword [eax + 0x308]
mov eax, dword [eax + 0x220]
mov edx, dword [0x475fec]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x120]
xor edx, edx
mov eax, dword [0x476074]
call fcn.0046f834
mov edx, dword [ebp - 0x120]
mov eax, 0x476078
call fcn.00404600
push 0
lea eax, [ebp - 0x124]
push eax
mov ecx, 0x470138
mov edx, 0x4700a0
mov eax, dword [0x47605c]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x124]
mov eax, 0x476070
call fcn.00404600
push 1
mov eax, dword [0x476070]
call fcn.00404a6c
push eax
push 0
push 0x470144
push 0x470150
mov eax, dword [0x473ff0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov word [0x47607c], 0x14
jmp 0x47004c
call sub.kernel32.dll_GetTickCount
mov dword [0x47624c], eax
mov word [0x47607c], 0x16
jmp 0x47004c
call sub.kernel32.dll_GetTickCount
mov edx, dword [0x47624c]
add edx, 0x7d0
cmp eax, edx
jb 0x47004c
mov word [0x47607c], 0x1e
jmp 0x47004c
mov word [0x47607c], 0x14
lea ecx, [ebp - 0x128]
xor edx, edx
mov eax, dword [0x476074]
call fcn.0046f834
mov edx, dword [ebp - 0x128]
mov eax, dword [0x476078]
call fcn.004049b8
je 0x47004c
mov word [0x47607c], 0x28
jmp 0x47004c
call sub.kernel32.dll_GetTickCount
mov dword [0x47624c], eax
mov word [0x47607c], 0x2a
jmp 0x47004c
call sub.kernel32.dll_GetTickCount
mov edx, dword [0x47624c]
add edx, 0x2ee0
cmp eax, edx
jb 0x47004c
mov word [0x47607c], 0x46
jmp 0x47004c
push 0
mov eax, dword [0x473ff0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x46fff0
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.0040481c
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.00408578
mov eax, dword [ebp - 0x12c]
push eax
lea edx, [ebp - 0x134]
mov eax, 0x470160
call fcn.00408578
mov edx, dword [ebp - 0x134]
pop eax
call fcn.004049b8
jne 0x46ffe2
mov eax, ebx
call fcn.00470a48
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x46ff7d
call fcn.0040a72c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x138]
mov eax, 0x4700f0
call fcn.0040b3a8
mov edx, dword [ebp - 0x138]
mov eax, 0x475fec
mov ecx, 0x470184
call fcn.004048b8
mov eax, dword [0x475fe8]
mov eax, dword [eax + 0x308]
mov eax, dword [eax + 0x220]
mov edx, dword [0x475fec]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov word [0x47607c], 0x384
jmp 0x47004c
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47007e
lea eax, [ebp - 0x138]
mov edx, 0xb
call fcn.004045d0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004045d0
ret