Function at 0x46cc67
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc8
lea eax, [ebp - 0xc0]
lea ebx, [ebp - 0x1c]
mov edi, dword [ebp + 0x18]
push 0
push ebx
push eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 1
push eax
call sub.KERNEL32.DLL_CreatePipe
mov esi, 0x200
xor edx, edx
test eax, eax
je 0x46cec4
lea eax, [ebp - 0xc8]
push 0
push ebx
push eax
lea eax, [ebp - 0xcc]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x46cce3
push dword [ebp - 0xc4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
jmp 0x46ce77
lea eax, [ebp - 0xd0]
push 0
push ebx
push eax
lea eax, [ebp - 0xd4]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x46cd29
push dword [ebp - 0xc4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xcc]
jmp 0x46ce77
push 0x10
push 1
call sub.msvcrt.dll_calloc
cmp dword [0x6cde70], 0
mov ebx, eax
pop eax
pop edx
je 0x46cdb4
lea eax, [ebp - 0x6c]
push 0x44
push 0x4ce150
push eax
call fcn.00478620
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x30], eax
add esp, 0xc
mov eax, dword [ebp - 0xd0]
and edi, 1
mov dword [ebp - 0x40], 0x100
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x2c], eax
je 0x46cd88
mov dword [ebp - 0x40], 0x101
jmp 0x46cd8d
mov esi, 0x208
lea eax, [ebp - 0x6c]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push dword [ebp + 8]
call fcn.0047191b
mov dword [esp], eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
jmp 0x46ce36
lea eax, [ebp - 0xbc]
push 0x44
push 0x4ce194
push eax
call fcn.00478620
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x80], eax
add esp, 0xc
mov eax, dword [ebp - 0xd0]
and edi, 1
mov dword [ebp - 0x90], 0x100
mov word [ebp - 0x8c], 0
mov dword [ebp - 0x7c], eax
je 0x46ce0c
mov dword [ebp - 0x90], 0x101
jmp 0x46ce11
mov esi, 0x208
lea eax, [ebp - 0xbc]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push dword [ebp + 8]
call fcn.00471901
mov dword [esp], eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x46ce80
push dword [ebp - 0xc4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xd4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xcc]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xd0]
call sub.KERNEL32.DLL_CloseHandle
xor edx, edx
jmp 0x46cec4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc4]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc8]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xd4]
mov dword [eax], edx
push dword [ebp - 0xcc]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xd0]
call sub.KERNEL32.DLL_CloseHandle
mov edx, ebx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret