Function at 0x43ee20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x18], 0xda703
mov dword [ebp - 0x38], 0xdbefe
mov dword [ebp - 0x14], 0xdbb79
mov dword [ebp - 0xc], 0xa5028
mov dword [ebp - 0x4c], 0x508dc
mov dword [ebp - 0x34], 0xc9cf4
mov dword [ebp - 0x20], 0x88e60
mov dword [ebp - 0x24], 0x89117
mov dword [ebp - 0x30], 0x65132
mov dword [ebp - 0x28], 0xbda24
mov dword [ebp - 0x58], 0x73e4d
mov dword [ebp - 4], 0x8ef08
mov dword [ebp - 0x50], 0xb3f4f
mov dword [ebp - 0x5c], 0xa96ba
mov dword [ebp - 0x1c], 0x8825a
mov dword [ebp - 0x48], 0xdb5f4
mov dword [ebp - 0x60], 0xaadd0
mov dword [ebp - 0x2c], 0x2c923
mov dword [ebp - 0x44], 0x84d7f
mov dword [ebp - 0x6c], 0x98e2f
mov dword [ebp - 0x10], 0x3ba9a
mov dword [ebp - 8], 0xff28
mov dword [ebp - 0x54], 0xa4768
mov dword [ebp - 0x3c], 0x73c53
mov dword [ebp - 0x40], 0x743c0
mov eax, dword [ebp + 0xc]
or eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x24]
and ecx, 0xd8c16
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x10], 0x7e997
jge 0x43ef49
mov edx, dword [ebp - 0x28]
add edx, 0x86c4d
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0xc]
or eax, 0x1fa13
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x6c]
sub ecx, 0x71f43
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
xor ecx, 0xef12a
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0xdcbe3
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x426b6
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp + 0x1c]
xor edx, 0x40dce
mov dword [ebp + 0x1c], edx
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 4]
sub edx, 0x2a769
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x82286
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
and ecx, 0x7f9fa
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
or edx, 0xaff8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x60135
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 0x10], 0xe295b
jge 0x43f07d
mov edx, dword [ebp + 0x20]
sub edx, 0x97545
mov dword [ebp + 0x20], edx
mov eax, dword [ebp - 0xc]
or eax, 0x7b92f
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x50]
or ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x66b4a
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x28]
add eax, 0x4a488
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x50]
and edx, 0x7426f
mov dword [ebp - 0x50], edx
cmp dword [ebp + 0x28], 0x739fa
jle 0x43f07d
mov eax, dword [ebp - 0xc]
xor eax, 0x568fc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x20]
sub edx, dword [ebp - 0x50]
mov dword [ebp + 0x20], edx
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0x1c]
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp - 0x1c]
or ecx, 0x26308
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
and edx, 0x6c147
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x1c], 0xd8b34
jge 0x43f07d
mov eax, dword [ebp - 0xc]
and eax, 0x82936
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
and ecx, dword [ebp - 0x28]
mov dword [ebp + 0x14], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp + 0x18]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x34], 0xc9cf5
jl 0x43ef49
mov eax, dword [ebp - 4]
xor eax, 0x6516
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x38]
and ecx, 0xba2b6
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x4c]
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
xor eax, dword [ebp - 0x24]
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
xor ecx, 0x6b624
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 0x24]
sub edx, 0x9f282
mov dword [ebp + 0x24], edx
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
and ecx, 0x63561
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0x79356
je 0x43f113
mov edx, dword [ebp + 0x28]
sub edx, dword [ebp - 0x34]
mov dword [ebp + 0x28], edx
mov eax, dword [ebp - 0x48]
or eax, dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0xacd00
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x28]
or edx, 0x89ee1
mov dword [ebp + 0x28], edx
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x2c]
xor ecx, 0xa8ba6
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0x24]
xor edx, dword [ebp - 0x18]
mov dword [ebp + 0x24], edx
mov eax, dword [ebp + 0x14]
and eax, 0x84de9
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x1c], 0x1e96d
jne 0x43f3d3
mov ecx, dword [ebp + 0x24]
and ecx, dword [ebp - 0x44]
mov dword [ebp + 0x24], ecx
mov edx, dword [ebp - 0x38]
xor edx, dword [ebp - 0x54]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp + 0x28]
sub ecx, 0xa3463
mov dword [ebp + 0x28], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0xafb89
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x40], 0x6330b
jne 0x43f3d3
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x40]
and ecx, 0x9ac0f
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp + 0x24]
mov dword [ebp - 0x20], edx
cmp dword [ebp + 0x10], 0x5cf20
jle 0x43f3d3
mov eax, dword [ebp - 8]
or eax, 0x72703
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x4c]
xor ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 8]
and edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x30]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x44], 0xd3ac9
jge 0x43f3d3
mov ecx, dword [ebp - 0x10]
and ecx, 0x6bf71
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
or edx, 0xaa8d9
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x20]
xor eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x8dcc
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x24], 0x67b9
jle 0x43f3cc
mov eax, dword [ebp - 0x48]
xor eax, 0xc0f5c
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x14]
or ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x24]
and edx, 0x74376
mov dword [ebp + 0x24], edx
cmp dword [ebp - 0x28], 0xd9f32
jne 0x43f3cc
mov eax, dword [ebp - 0x2c]
or eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0xc]
xor ecx, 0x55cb3
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x5c], 0x75b30
jge 0x43f3cc
mov edx, dword [ebp + 0x1c]
xor edx, 0xa8599
mov dword [ebp + 0x1c], edx
mov eax, dword [ebp - 0x30]
xor eax, 0x2698
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0x2e41d
mov dword [ebp - 0x44], ecx
cmp dword [ebp + 0x18], 0x462a0
je 0x43f3cc
mov edx, dword [ebp - 0x18]
xor edx, 0x91e75
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x40]
or eax, 0xf0876
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 0xc]
xor ecx, 0xe3a94
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x805e4
mov dword [ebp - 0x18], edx
cmp dword [ebp + 0x1c], 0x21db
jne 0x43f3cc
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x54]
sub ecx, 0xcad94
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x58]
or edx, dword [ebp - 0x20]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp + 0x1c]
or eax, dword [ebp - 0x1c]
mov dword [ebp + 0x1c], eax
cmp dword [ebp - 0x14], 0x39f4a
je 0x43f3cc
mov ecx, dword [ebp - 8]
and ecx, dword [ebp - 0x60]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x54]
or edx, 0xed918
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 4]
and eax, 0x9a605
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
xor ecx, 0x80706
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
xor edx, dword [ebp - 0x24]
mov dword [ebp - 0x24], edx
cmp dword [ebp + 0x24], 0xc6ae
jne 0x43f3cc
mov eax, dword [ebp - 0x58]
sub eax, 0x1be62
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x4c]
and ecx, dword [ebp + 0x18]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x40], edx
cmp dword [ebp + 0x18], 0x733e1
jle 0x43f3cc
mov eax, dword [ebp - 8]
and eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x1c]
or ecx, dword [ebp - 0x20]
mov dword [ebp + 0x1c], ecx
mov edx, dword [ebp + 0x1c]
and edx, dword [ebp + 0x28]
mov dword [ebp + 0x1c], edx
mov eax, dword [ebp - 4]
add eax, 0x1c8b0
mov dword [ebp - 4], eax
cmp dword [ebp - 0x28], 0xc5262
je 0x43f3cc
mov ecx, dword [ebp - 0x5c]
xor ecx, dword [ebp + 0xc]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp + 0x18]
xor edx, 0xeb993
mov dword [ebp + 0x18], edx
mov eax, dword [ebp + 0xc]
sub eax, 0x39ab8
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
nop
cmp dword [ebp + 8], 0x6e2df
jl 0x43f08a
mov dword [ebp - 0x64], 0
jmp 0x43f3f2
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x4cc5e
cmp dword [ebp - 0x64], edx
jge 0x43f440
mov eax, dword [ebp - 0x10]
add eax, 0x1cdb5
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x44]
xor ecx, 0x486fb
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 4]
and edx, 0xb9242
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x60]
and ecx, dword [ebp - 0x44]
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x60]
mov dword [ebp - 4], edx
jmp 0x43f3e9
mov dword [ebp - 0x68], 0
jmp 0x43f452
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x136510
cmp dword [ebp - 0x68], ecx
jge 0x43f4e4
mov edx, dword [ebp - 0x18]
xor edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x34]
xor eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
xor ecx, dword [ebp - 8]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x48]
or edx, 0x5e960
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 8]
or eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x30]
and eax, 0xb3e0c
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x34], 0x92c5a
jle 0x43f4df
mov ecx, dword [ebp + 8]
xor ecx, dword [ebp - 0x38]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 0x4c]
and edx, 0x1d90a
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x10]
and eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
jmp 0x43f449
mov esp, ebp
pop ebp
ret