Function at 0x43a5f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 5
mov eax, dword [esi + 4]
push ebx
push esi
mov dword [ebp - 0x10], eax
call sub.ifdig60.dll_Ordinal_123_2
xor edi, edi
add esp, 0xc
cmp ebx, edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
je 0x43ab81
push 3
push ebx
push esi
call sub.ifdig60.dll_Ordinal_122_2
add esp, 0xc
cmp ax, 0x67
jne 0x43ab81
lea ecx, [ebp - 0x2ec]
push ecx
call sub.ifcom60.dll_Ordinal_932
add esp, 4
lea edx, [ebp - 0x2ec]
push 0x4bd430
push edx
call sub.ifcom60.dll_Ordinal_921
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x43a672
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 1
push 0x1fd
push eax
push esi
call sub.ifdig60.dll_Ordinal_193_1
add esp, 0x10
test eax, eax
je 0x43a6bf
mov ecx, dword [ebp + 0xc]
push 1
push 0x1fd
push ecx
push esi
call sub.ifdig60.dll_Ordinal_193_1
mov edx, dword [ebp - 4]
add esp, 0x10
push eax
push 1
push 0x1a
push edx
push esi
call sub.ifdig60.dll_Ordinal_190_2
add esp, 0x10
push eax
push esi
call sub.ifdig60.dll_Ordinal_121_2
add esp, 0xc
mov dword [ebp - 8], eax
mov edi, eax
mov eax, dword [ebp - 0x10]
test byte [eax + 0x1f4], 2
je 0x43a723
mov edx, dword [eax + 0x1ec]
test edx, edx
jne 0x43a6e5
push str.USERID__n
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 8
jmp 0x43a723
mov ecx, dword [eax + 0x244]
test ecx, ecx
je 0x43a70d
cmp byte [ecx], 0
je 0x43a70d
mov eax, dword [eax + 0x1e8]
push ecx
push edx
push eax
push str.USERID_s__s__s_n
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 0x14
jmp 0x43a723
mov ecx, dword [eax + 0x1e8]
push edx
push ecx
push str.USERID_s__s_n
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 0x10
mov edx, dword [ebp + 0xc]
push 1
push 0x75
push edx
push esi
call sub.ifdig60.dll_Ordinal_193_1
add esp, 0x10
test eax, eax
je 0x43a758
mov eax, dword [ebp + 0xc]
push 1
push 0x75
push eax
push esi
call sub.ifdig60.dll_Ordinal_193_1
add esp, 0x10
push eax
push str.REPORT_s_n
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
mov eax, 0x4bd474
jne 0x43a769
mov eax, 0x4bd478
push eax
push str.NEWREPORT_s_n
push ebx
call sub.ifcom60.dll_Ordinal_940
mov eax, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
mov eax, str.WIZARD
jne 0x43a789
mov eax, str.DEFAULT
push eax
push str.SHOWWINDOW_s_n
push ebx
call sub.ifcom60.dll_Ordinal_940
mov eax, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
je 0x43aa09
test edi, edi
je 0x43a967
push 1
push 0x211
push edi
push esi
call sub.ifdig60.dll_Ordinal_189_2
add esp, 0x10
cmp al, 1
jne 0x43a967
push 1
push 0x20a
push edi
push esi
call sub.ifdig60.dll_Ordinal_193_1
add esp, 0x10
test eax, eax
je 0x43a967
push 2
push edi
push esi
call sub.ifdig60.dll_Ordinal_123_2
add esp, 0xc
push eax
push 0x4bd4ac
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 0xc
push 1
push 0x20a
push edi
push esi
call sub.ifdig60.dll_Ordinal_193_1
add esp, 0x10
push eax
push str.QUERYSQL_select
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 0xc
push 1
push 0x300
push edi
push esi
call sub.ifdig60.dll_Ordinal_193_1
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x88
push edi
push esi
call sub.ifdig60.dll_Ordinal_190_2
mov edi, eax
add esp, 0x10
test edi, edi
mov dword [ebp + 0xc], 1
je 0x43a903
push 1
push 0x14
push edi
push esi
call sub.ifdig60.dll_Ordinal_188_2
add esp, 0x10
test eax, eax
je 0x43a8ef
push 1
push 0x158
push edi
push esi
call sub.ifdig60.dll_Ordinal_193_1
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x43a88f
push 0x4bd4d0
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 8
jmp 0x43a896
mov dword [ebp + 0xc], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x43a8ba
cmp byte [eax], 0
je 0x43a8ba
push eax
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 8
push 0x4bd4d4
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 8
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x43a8cd
push 2
push edi
push esi
call sub.ifdig60.dll_Ordinal_123_2
add esp, 0xc
push 2
push edi
push esi
mov dword [ebp + 0x10], eax
call sub.ifdig60.dll_Ordinal_123_2
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push eax
push ecx
push str._s__s
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 0x10
push edi
push esi
call sub.ifdig60.dll_Ordinal_125_2
mov edi, eax
add esp, 8
test edi, edi
jne 0x43a84e
push str._from
push ebx
call sub.ifcom60.dll_Ordinal_940
mov edx, dword [ebp - 8]
add esp, 8
push 1
push 0x20a
push edx
push esi
call sub.ifdig60.dll_Ordinal_193_1
add esp, 0x10
push eax
push 0x4bd4e8
push ebx
call sub.ifcom60.dll_Ordinal_940
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x43a94f
cmp byte [eax], 0
je 0x43a94f
push eax
push 0x4bd4ec
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 0xc
push 0x4bd4f0
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 8
push 0x4bd4f4
jmp 0x43aa00
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x43aa09
test edi, edi
je 0x43aa09
push 1
push 0x211
push edi
push esi
call sub.ifdig60.dll_Ordinal_189_2
add esp, 0x10
cmp al, 4
jne 0x43aa09
push 1
push 0x20a
push edi
push esi
call sub.ifdig60.dll_Ordinal_193_1
add esp, 0x10
test eax, eax
je 0x43aa09
push 2
push edi
push esi
call sub.ifdig60.dll_Ordinal_123_2
add esp, 0xc
push eax
push str.QUERYNAME_s_n
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 0xc
push str.QUERYSQL_
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 8
push 1
push 0x20a
push edi
push esi
call sub.ifdig60.dll_Ordinal_193_1
add esp, 0x10
push eax
push 0x4bd524
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 0xc
push 0x4bd528
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 8
push str.SHOWQUERYTABNO_n
push ebx
call sub.ifcom60.dll_Ordinal_940
add esp, 8
push ebx
call sub.ifcom60.dll_Ordinal_902
add esp, 4
lea eax, [ebp - 0x2ec]
lea ecx, [ebp - 0xec]
push eax
push str.CMDFILE_s
push ecx
call sub.MSVCRT.dll_sprintf
mov ebx, dword [ebp - 0x10]
add esp, 0xc
xor edi, edi
lea edx, [ebp - 0xec]
push edi
push edi
lea eax, [ebp + 8]
push edx
push eax
push ebx
mov dword [ebp + 8], edi
call sub.ifcom60.dll_Ordinal_215_3
mov eax, dword [ebx + 0x1c]
add esp, 0x14
cmp eax, 3
jne 0x43ab1a
mov edx, 0x14
lea esi, [ebp + 8]
mov ebx, 1
mov edi, dword [esi]
or ecx, 0xffffffff
xor eax, eax
add esi, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
dec ebx
lea edx, [edx + ecx + 1]
jne 0x43aa64
mov esi, dword [ebp - 0x10]
push edx
push esi
call sub.ifcom60.dll_Ordinal_945
mov ecx, dword [esi + 0x2bc]
mov edx, dword [esi + 0x2b0]
add esp, 8
mov edi, eax
push ecx
push edx
push str.rwbld60
push edi
call sub.NLSRTL33.dll_Ordinal_279
add esp, 0x10
lea ebx, [ebp + 8]
mov dword [ebp + 0xc], 1
mov eax, dword [esi + 0x2bc]
mov ecx, dword [esi + 0x2b0]
push eax
push ecx
push 0x4bd554
push edi
call sub.NLSRTL33.dll_Ordinal_276
mov edx, dword [esi + 0x2bc]
mov eax, dword [esi + 0x2b0]
mov ecx, dword [ebx]
add esp, 0x10
push edx
push eax
push ecx
push edi
call sub.NLSRTL33.dll_Ordinal_276
mov eax, dword [ebp + 0xc]
add esp, 0x10
add ebx, 4
dec eax
mov dword [ebp + 0xc], eax
jne 0x43aaaf
push 5
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x43ab06
mov dword [ebp - 0xc], 1
push edi
push esi
call sub.ifcom60.dll_Ordinal_942
mov eax, dword [ebp - 0xc]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0xe4]
mov eax, 1
lea edx, [ebp + 8]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x10]
lea edx, [ebp - 0x54]
push edx
push eax
mov dword [ebp - 0x54], 0x177
mov dword [ebp - 0x50], 0x12c
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x43ab90
mov dword [ebp - 0x14], edi
call sub.ifcom60.dll_Ordinal_488
add esp, 8
mov dword [ebp - 0xc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret