Function at 0x46d0f7
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc8
lea eax, [ebp - 0xc0]
lea ebx, [ebp - 0x1c]
mov edi, dword [ebp + 0x18]
push 0
push ebx
push eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 1
push eax
call sub.KERNEL32.DLL_CreatePipe
mov esi, 0x200
xor edx, edx
test eax, eax
je 0x46d354
lea eax, [ebp - 0xc8]
push 0
push ebx
push eax
lea eax, [ebp - 0xcc]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x46d173
push dword [ebp - 0xc4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
jmp 0x46d307
lea eax, [ebp - 0xd0]
push 0
push ebx
push eax
lea eax, [ebp - 0xd4]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x46d1b9
push dword [ebp - 0xc4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xcc]
jmp 0x46d307
push 0x10
push 1
call sub.msvcrt.dll_calloc
cmp dword [0x54f800], 0
mov ebx, eax
pop eax
pop edx
je 0x46d244
lea eax, [ebp - 0x6c]
push 0x44
push 0x4d2150
push eax
call fcn.0047d340
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x30], eax
add esp, 0xc
mov eax, dword [ebp - 0xd0]
and edi, 1
mov dword [ebp - 0x40], 0x100
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x2c], eax
je 0x46d218
mov dword [ebp - 0x40], 0x101
jmp 0x46d21d
mov esi, 0x208
lea eax, [ebp - 0x6c]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push dword [ebp + 8]
call fcn.00471dab
mov dword [esp], eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
jmp 0x46d2c6
lea eax, [ebp - 0xbc]
push 0x44
push 0x4d2194
push eax
call fcn.0047d340
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x80], eax
add esp, 0xc
mov eax, dword [ebp - 0xd0]
and edi, 1
mov dword [ebp - 0x90], 0x100
mov word [ebp - 0x8c], 0
mov dword [ebp - 0x7c], eax
je 0x46d29c
mov dword [ebp - 0x90], 0x101
jmp 0x46d2a1
mov esi, 0x208
lea eax, [ebp - 0xbc]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push dword [ebp + 8]
call fcn.00471d91
mov dword [esp], eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x46d310
push dword [ebp - 0xc4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xd4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xcc]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xd0]
call sub.KERNEL32.DLL_CloseHandle
xor edx, edx
jmp 0x46d354
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc4]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc8]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xd4]
mov dword [eax], edx
push dword [ebp - 0xcc]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xd0]
call sub.KERNEL32.DLL_CloseHandle
mov edx, ebx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret