Function at 0x46bd4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x46bd54
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46c198
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
call fcn.00460a68
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0046c418
cmp dword [ebp - 0xc], 0xffffffed
jne 0x46be0e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x300]
cmp byte [ebx + 0x32c], 0
jne 0x46bdbe
lea eax, [ebp - 0x10]
mov edx, 0x46c1b4
call fcn.00404558
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0046b59c
jmp 0x46be0e
push 1
mov eax, dword [ebp - 4]
push dword [eax + 0x308]
push 0x46c204
push dword [ebx + 0x2cc]
push 0x46c228
mov eax, dword [ebp - 4]
push dword [eax + 0x304]
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.00404838
mov eax, dword [ebp - 0x2c]
call fcn.00404970
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x46f434]
mov eax, dword [eax]
call fcn.004592fc
jmp 0x46c160
xor eax, eax
push ebp
push 0x46be37
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
call fcn.00461d60
mov dword [ebp - 0x28], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46be41
cmp dword [ebp - 0x28], 0xffffffed
jne 0x46becd
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x300]
cmp byte [ebx + 0x32c], 0
jne 0x46be7d
lea eax, [ebp - 0x10]
mov edx, 0x46c1b4
call fcn.00404558
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0046b59c
jmp 0x46c004
push 1
mov eax, dword [ebp - 4]
push dword [eax + 0x308]
push 0x46c204
push dword [ebx + 0x2cc]
push 0x46c228
mov eax, dword [ebp - 4]
push dword [eax + 0x304]
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00404838
mov eax, dword [ebp - 0x30]
call fcn.00404970
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x46f434]
mov eax, dword [eax]
call fcn.004592fc
jmp 0x46c160
cmp dword [ebp - 0x28], 0xd2
jne 0x46c004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov edx, dword [eax + 0x2c0]
lea eax, [ebp - 0x20]
mov ecx, 0x46c234
call fcn.004047c4
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x45a8ac]
call fcn.0045a95c
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x46bf4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x46f33c]
mov eax, dword [eax]
push eax
mov ecx, 0x46c24c
mov edx, 0x46c25c
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [0x46f33c]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bf55
mov eax, dword [ebp - 0x1c]
call fcn.00403754
ret
mov dl, 1
mov eax, dword [0x45b7fc]
call fcn.0045b8fc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x46c0e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x14]
call fcn.0045b99c
xor ecx, ecx
mov edx, 0x46c2d4
mov eax, dword [ebp - 0x14]
call fcn.0045ba00
lea ecx, [ebp - 0x18]
mov edx, 0x46c308
mov eax, dword [ebp - 0x14]
call fcn.0045bd18
mov eax, dword [ebp - 0x18]
mov edx, 0x46c318
call fcn.004048bc
jne 0x46c0c9
mov ax, word [0x46c31c]
push eax
push 0
mov cl, 3
mov edx, 0x46c328
mov eax, 0x46c3ec
call fcn.0045cc34
cmp eax, 6
jne 0x46c0c9
mov edx, 0x46c308
mov ecx, 0x46c404
mov eax, dword [ebp - 0x14]
call fcn.0045bcec
mov eax, dword [ebp - 0x14]
call fcn.0045b96c
lea eax, [ebp - 0x14]
call fcn.0040e00c
push 1
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0046c75c
mov eax, dword [ebp - 4]
call fcn.00455bdc
mov eax, dword [0x46f434]
mov eax, dword [eax]
call fcn.004592fc
call fcn.00403fcc
jmp 0x46c160
mov eax, dword [ebp - 0x14]
call fcn.0045b96c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c0ee
lea eax, [ebp - 0x14]
call fcn.0040e00c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c19f
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.004044e4
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004044e4
lea eax, [ebp - 0x18]
call fcn.004044c0
lea eax, [ebp - 0x10]
call fcn.004044c0
ret