Function at 0x4046bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, 0x404684
call fcn.00403b80
xor eax, eax
push ebp
push 0x404b10
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403e78
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00403e00
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040408c
mov eax, dword [ebp - 0x10]
call fcn.00402554
call fcn.00402518
mov eax, 0x4064cc
mov edx, 0x404b28
call fcn.00402dac
mov eax, 0x4064c8
mov edx, 0x404b38
call fcn.00402dac
mov edx, dword [0x4064cc]
mov eax, 0x404b48
call fcn.00403108
test eax, eax
jle 0x40474f
mov eax, 0x4064cc
mov edx, 0x404b48
call fcn.00402dac
jmp 0x4047b7
mov edx, dword [0x4064cc]
mov eax, 0x404b54
call fcn.00403108
test eax, eax
jle 0x404774
mov eax, 0x4064cc
mov edx, 0x404b28
call fcn.00402dac
jmp 0x4047b7
mov edx, dword [0x4064cc]
mov eax, 0x404b64
call fcn.00403108
test eax, eax
jle 0x4047a8
mov eax, 0x4064cc
mov edx, 0x404b64
call fcn.00402dac
mov eax, 0x4064c8
mov edx, 0x404b74
call fcn.00402dac
jmp 0x4047b7
mov eax, 0x4064cc
mov edx, 0x404b48
call fcn.00402dac
call fcn.00403da0
test eax, eax
je 0x4047d5
mov eax, dword [0x4064cc]
mov edx, 0x404b28
call fcn.00402f8c
jne 0x4047d5
xor ebx, ebx
jmp 0x4047d7
mov bl, 1
test bl, bl
je 0x404800
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, dword [0x4064c8]
mov eax, dword [0x4064cc]
call fcn.00404138
mov edx, dword [ebp - 0x10]
mov eax, 0x4064d0
call fcn.00402dac
jmp 0x404825
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00403e00
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004043f0
mov edx, dword [ebp - 0x10]
mov eax, 0x4064d0
call fcn.00402dac
cmp dword [0x4064d0], 0
je 0x404ae2
call fcn.00404260
mov esi, eax
mov eax, dword [0x4064cc]
mov edx, 0x404b28
call fcn.00402f8c
jne 0x4048f3
test bl, bl
je 0x404876
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x404b88
mov eax, dword [0x4064cc]
call fcn.00404138
mov edx, dword [ebp - 0x10]
mov eax, 0x4064d4
call fcn.00402dac
jmp 0x40489b
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.00403e00
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004043f0
mov edx, dword [ebp - 0x10]
mov eax, 0x4064d4
call fcn.00402dac
cmp dword [0x4064d4], 0
je 0x4048c4
push dword [0x4064d0]
push 0x404b98
push dword [0x4064d4]
mov eax, 0x4064d0
mov edx, 3
call fcn.00402f3c
push 1
push 0
push 0
lea eax, [ebp - 0x10]
mov ecx, dword [0x4064d0]
mov edx, 0x404bac
call fcn.00402ec8
mov eax, dword [ebp - 0x10]
call fcn.00403040
push eax
push 0
push esi
call sub.shell32.dll_ShellExecuteA
jmp 0x4049bf
mov eax, dword [0x4064cc]
mov edx, 0x404b64
call fcn.00402f8c
jne 0x404975
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x404bbc
mov eax, dword [0x4064cc]
call fcn.00404138
mov edx, dword [ebp - 0x10]
mov eax, 0x4064d8
call fcn.00402dac
cmp dword [0x4064d8], 0
jne 0x404951
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x404bd0
mov eax, dword [0x4064cc]
call fcn.00404138
mov edx, dword [ebp - 0x10]
mov eax, 0x4064d8
call fcn.00402dac
push 1
push 0
mov eax, dword [0x4064d8]
call fcn.00403040
push eax
mov eax, dword [0x4064d0]
call fcn.00403040
push eax
push 0
push esi
call sub.shell32.dll_ShellExecuteA
jmp 0x4049bf
mov edx, dword [0x4064d0]
mov eax, 0x404be0
call fcn.00403108
test eax, eax
jne 0x404af5
mov edx, dword [0x4064d0]
mov eax, 0x404bec
call fcn.00403108
cmp eax, 2
je 0x404af5
push 1
push 0
push 0
mov eax, dword [0x4064d0]
call fcn.00403040
push eax
push 0
push esi
call sub.shell32.dll_ShellExecuteA
test eax, eax
jl 0x404ad6
cmp eax, 0x20
jg 0x404ad6
mov eax, 0x4064dc
call fcn.00402d58
test bl, bl
jne 0x404a5d
call fcn.00403da0
mov edi, eax
sub edi, 2
jl 0x404a7f
inc edi
mov ebx, 2
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00403e00
mov edx, dword [ebp - 0x10]
mov eax, 0x404bf8
call fcn.00403108
dec eax
jne 0x404a57
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00403e00
mov eax, dword [ebp - 0x14]
call fcn.00402e7c
push eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00403e00
mov eax, dword [ebp - 0x10]
mov edx, 8
pop ecx
call fcn.00403080
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004043f0
mov edx, dword [ebp - 0x10]
mov eax, 0x4064dc
call fcn.00402dac
jmp 0x404a7f
inc ebx
dec edi
jne 0x4049f4
jmp 0x404a7f
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x404c08
mov eax, dword [0x4064cc]
call fcn.00404138
mov edx, dword [ebp - 0x10]
mov eax, 0x4064dc
call fcn.00402dac
cmp dword [0x4064dc], 0
jne 0x404a97
mov eax, 0x4064dc
mov edx, 0x404c18
call fcn.00402dac
push 0
push 0x404c28
lea edx, [ebp - 0x14]
mov eax, dword [0x4064dc]
call fcn.004044c0
push dword [ebp - 0x14]
push 0x404c34
push dword [0x4064d0]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00402f3c
mov eax, dword [ebp - 0x10]
call fcn.00403040
push eax
push 0
call sub.user32.dll_MessageBoxA_1
test esi, esi
je 0x404af5
push esi
call sub.user32.dll_DestroyWindow
jmp 0x404af5
push 0
push 0x404c28
push 0x404c38
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b17
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00402d7c
ret