Function at 0x46a8f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff6d0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
lea esi, [ebp - 0x40]
push 0x3c
push 0
push esi
call fcn.00498cfc
add esp, 0xc
mov dword [esi], 0x3c
mov dword [esi + 4], 0x500
cmp byte [ebp + 0x10], 0
jne 0x46a931
or dword [esi + 4], 0x40
mov dword [esi + 0x10], ebx
cmp dword [ebp + 8], 0
je 0x46a942
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
jmp 0x46a966
lea edx, [ebp - 0x90]
mov ecx, 0x50
mov eax, dword [esi + 0x10]
call fcn.00469364
test al, al
je 0x46a961
lea edx, [ebp - 0x90]
jmp 0x46a963
xor edx, edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x18], edi
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
mov eax, ebx
call fcn.0040be48
cmp ebx, eax
jne 0x46a998
push ebx
push str.._s
lea edx, [ebp - 0x890]
push edx
call fcn.0049bdcc
add esp, 0xc
lea ecx, [ebp - 0x890]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], 1
call fcn.004107bc
test eax, eax
je 0x46aa74
mov eax, dword [ebp - 4]
call fcn.0040f50c
cmp word [eax], 0
je 0x46aa74
xor ebx, ebx
push 0x4ac4a5
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x46a9db
push str.ShellExecuteExW
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
test ebx, ebx
jne 0x46a9e6
xor eax, eax
jmp 0x46ab42
mov edx, dword [ebp - 4]
mov dword [esi + 0x10], edx
cmp dword [esi + 0xc], 0
je 0x46aa0e
lea edx, [ebp - 0x930]
mov ecx, 0x1000000
mov eax, dword [esi + 0xc]
call fcn.00410844
lea eax, [ebp - 0x930]
mov dword [esi + 0xc], eax
test edi, edi
je 0x46aa2d
lea edx, [ebp - 0x1130]
mov ecx, 0x1000000
mov eax, edi
call fcn.00410844
lea edx, [ebp - 0x1130]
mov dword [esi + 0x18], edx
cmp dword [ebp + 0x14], 0
je 0x46aa4f
lea edx, [ebp - 0x1930]
mov ecx, 0x1000000
mov eax, dword [ebp + 0x14]
call fcn.00410844
lea eax, [ebp - 0x1930]
mov dword [esi + 0x14], eax
mov byte [0x4c9898], 1
push esi
call ebx
test eax, eax
jne 0x46aa6b
cmp dword [esi + 0xc], 0
je 0x46aa6b
xor edx, edx
mov dword [esi + 0xc], edx
push esi
call ebx
mov byte [0x4c9898], 0
jmp 0x46aa9d
mov byte [0x4c9898], 1
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
jne 0x46aa96
cmp dword [esi + 0xc], 0
je 0x46aa96
xor ecx, ecx
mov dword [esi + 0xc], ecx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
mov byte [0x4c9898], 0
test eax, eax
je 0x46aaad
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x483
jne 0x46aab4
xor eax, eax
jmp 0x46ab42
cmp byte [ebp + 0x10], 0
jne 0x46ab40
cmp dword [esi + 0x38], 0
je 0x46aaff
mov edx, dword [0x4ac474]
mov ecx, dword [esi + 0x38]
mov dword [edx*4 + 0x4cd6fc], ecx
mov eax, dword [0x4ac474]
mov edx, dword [esi + 0x20]
mov dword [eax*4 + 0x4cd73c], edx
mov ecx, dword [0x4ac474]
inc ecx
and ecx, 0x8000000f
jns 0x46aaf7
dec ecx
or ecx, 0xfffffff0
inc ecx
mov dword [0x4ac474], ecx
jmp 0x46ab32
xor ebx, ebx
mov eax, dword [ebx*4 + 0x4cd73c]
cmp eax, dword [esi + 0x20]
jne 0x46ab2c
push 0
push dword [ebx*4 + 0x4cd6fc]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x46ab2c
mov edx, dword [ebx*4 + 0x4cd6fc]
mov dword [esi + 0x38], edx
inc ebx
cmp ebx, 0x10
jl 0x46ab01
cmp dword [ebp + 0xc], 0
je 0x46ab40
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x38]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10