Function at 0x43f940
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf1e0
mov eax, dword fs:[0]
push eax
sub esp, 0x9e0
mov eax, dword [0x4e880c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
lea edx, [ebp - 0x88]
push ebx
push edx
mov dword [ebp - 0x964], eax
mov dword [ebp - 0x960], ecx
call fcn.004463c0
add esp, 8
cmp dword [ebp - 0x74], ebx
mov dword [ebp - 4], ebx
jne 0x43f9b8
cmp dword [ebp - 0x70], 8
jb 0x440211
mov eax, dword [ebp - 0x84]
push eax
call fcn.0048c049
add esp, 4
jmp 0x440211
lea ecx, [ebp - 0x50]
push ebx
push ecx
call fcn.00446310
add esp, 8
cmp dword [ebp - 0x3c], ebx
mov byte [ebp - 4], 1
jne 0x43f9f7
mov esi, 8
cmp dword [ebp - 0x38], esi
jb 0x43f9e4
mov edx, dword [ebp - 0x4c]
push edx
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x70], esi
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], bx
jmp 0x43f99e
mov dword [ebp - 0x958], ebx
mov dword [ebp - 0x954], ebx
mov dword [ebp - 0x950], ebx
push 0x4cbd68
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x34]
push ecx
mov esi, 7
lea ecx, [ebp - 0x94c]
mov byte [ebp - 4], 3
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
call fcn.0040216a
mov byte [ebp - 0x930], 1
lea edx, [ebp - 0x94c]
push edx
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 4
call fcn.0043f8c0
mov edi, 8
cmp dword [ebp - 0x934], edi
jb 0x43fa81
mov eax, dword [ebp - 0x948]
push eax
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
mov byte [ebp - 4], 2
jb 0x43faa9
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0048c049
add esp, 4
push 0x4cd1dc
lea ecx, [ebp - 0x34]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x94c]
mov byte [ebp - 4], 5
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
call fcn.0040216a
mov byte [ebp - 0x930], 1
lea eax, [ebp - 0x94c]
push eax
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 6
call fcn.0043f8c0
cmp dword [ebp - 0x934], edi
jb 0x43fb13
mov ecx, dword [ebp - 0x948]
push ecx
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
mov byte [ebp - 4], 2
jb 0x43fb3b
mov edx, dword [ebp - 0x30]
push edx
call fcn.0048c049
add esp, 4
push str.tnproxy.dll
lea ecx, [ebp - 0x34]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x94c]
mov byte [ebp - 4], 7
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
call fcn.0040216a
mov byte [ebp - 0x930], bl
lea ecx, [ebp - 0x94c]
push ecx
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 8
call fcn.0043f8c0
cmp dword [ebp - 0x934], edi
jb 0x43fba4
mov edx, dword [ebp - 0x948]
push edx
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
mov byte [ebp - 4], 2
jb 0x43fbcc
mov eax, dword [ebp - 0x30]
push eax
call fcn.0048c049
add esp, 4
push 0x4cd470
lea ecx, [ebp - 0x34]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x94c]
mov byte [ebp - 4], 9
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
call fcn.0040216a
mov byte [ebp - 0x930], bl
lea edx, [ebp - 0x94c]
push edx
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 0xa
call fcn.0043f8c0
cmp dword [ebp - 0x934], edi
jb 0x43fc35
mov eax, dword [ebp - 0x948]
push eax
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
mov byte [ebp - 4], 2
jb 0x43fc5d
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0048c049
add esp, 4
push 0x4cd448
lea ecx, [ebp - 0x34]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x94c]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
call fcn.0040216a
mov byte [ebp - 0x930], 1
lea eax, [ebp - 0x94c]
push eax
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 0xc
call fcn.0043f8c0
cmp dword [ebp - 0x934], edi
jb 0x43fcc7
mov ecx, dword [ebp - 0x948]
push ecx
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
mov byte [ebp - 4], 2
jb 0x43fcef
mov edx, dword [ebp - 0x30]
push edx
call fcn.0048c049
add esp, 4
push str.tinyxml.dll
lea ecx, [ebp - 0x34]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x94c]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
call fcn.0040216a
mov byte [ebp - 0x930], bl
lea ecx, [ebp - 0x94c]
push ecx
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 0xe
call fcn.0043f8c0
cmp dword [ebp - 0x934], edi
jb 0x43fd58
mov edx, dword [ebp - 0x948]
push edx
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
mov byte [ebp - 4], 2
jb 0x43fd80
mov eax, dword [ebp - 0x30]
push eax
call fcn.0048c049
add esp, 4
push str.bugreport_xf.exe
lea ecx, [ebp - 0x34]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x94c]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
call fcn.0040216a
mov byte [ebp - 0x930], bl
lea edx, [ebp - 0x94c]
push edx
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 0x10
call fcn.0043f8c0
cmp dword [ebp - 0x934], edi
jb 0x43fde9
mov eax, dword [ebp - 0x948]
push eax
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
mov byte [ebp - 4], 2
jb 0x43fe11
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0048c049
add esp, 4
push str.MiniDownload.dll
lea ecx, [ebp - 0x34]
call fcn.004042bd
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x94c]
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
call fcn.0040216a
mov byte [ebp - 0x930], 1
lea eax, [ebp - 0x94c]
push eax
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 0x12
call fcn.0043f8c0
cmp dword [ebp - 0x934], edi
jb 0x43fe7b
mov ecx, dword [ebp - 0x948]
push ecx
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x934], esi
mov dword [ebp - 0x938], ebx
mov word [ebp - 0x948], bx
mov byte [ebp - 4], 2
jb 0x43fea3
mov edx, dword [ebp - 0x30]
push edx
call fcn.0048c049
add esp, 4
mov eax, dword [ebp - 0x960]
cmp dword [eax + 0x14], ebx
je 0x43fefa
push eax
call fcn.004455f0
add esp, 4
test al, al
je 0x43fefa
mov eax, dword [ebp - 0x960]
push 0x4cd3f4
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.0040dae0
lea edx, [ebp - 0x95c]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov byte [ebp - 4], 0x13
call fcn.0043b960
add esp, 0x18
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00402039
push 0x4d39d0
lea ecx, [ebp - 0x34]
call fcn.004042bd
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 0x14
call fcn.00445c10
add esp, 8
cmp dword [ebp - 0x1c], edi
mov byte [ebp - 4], 0x16
jb 0x43ff30
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x58], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], bx
jne 0x43ff9d
cmp dword [ebp - 0x54], edi
jb 0x43ff50
mov edx, dword [ebp - 0x68]
push edx
call fcn.0048c049
add esp, 4
lea ecx, [ebp - 0x95c]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], ebx
mov word [ebp - 0x68], bx
call fcn.0043e060
cmp dword [ebp - 0x38], edi
jb 0x43ff76
mov eax, dword [ebp - 0x4c]
push eax
call fcn.0048c049
add esp, 4
cmp dword [ebp - 0x70], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], bx
jb 0x440211
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.0048c049
add esp, 4
jmp 0x440211
cmp dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x4c]
jae 0x43ffa8
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x92c]
call fcn.00441fd0
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x92c]
mov byte [ebp - 4], 0x17
mov word [ebp - 0x18], bx
mov dword [ebp - 0x16], ebx
mov word [ebp - 0x12], bx
call fcn.00441be0
movzx esi, word [ebp - 0x14]
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.0043f520
add esp, 8
cmp al, bl
je 0x4401dc
push 1
push 3
lea ecx, [ebp - 0x9ec]
call fcn.0043e0b0
push esi
push 0x4caa50
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x9e4]
push edx
mov byte [ebp - 4], 0x18
call fcn.0043dad0
add esp, 8
push eax
call fcn.00432190
add esp, 8
mov ecx, eax
call fcn.0043dd90
lea eax, [ebp - 0x948]
push eax
lea ecx, [ebp - 0x9ec]
call fcn.0043b170
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x19
call fcn.0040216a
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], 0x18
call fcn.00402039
lea ecx, [ebp - 0x95c]
push ecx
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x6c]
push eax
call fcn.0043b960
add esp, 0xc
test al, al
je 0x4401cd
mov ecx, dword [ebp - 0x964]
cmp ecx, ebx
je 0x440089
call fcn.00468520
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0043af50
push 0x4cd388
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0xa4]
push eax
mov byte [ebp - 4], 0x1a
call fcn.0040dae0
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x948]
push edx
mov byte [ebp - 4], 0x1b
call fcn.004450a0
add esp, 0x18
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x1c
call fcn.0040216a
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], 0x1b
call fcn.00402039
cmp dword [ebp - 0xac], ebx
je 0x44014f
cmp dword [ebp - 0xa8], edi
mov eax, dword [ebp - 0xbc]
jae 0x440106
lea eax, [ebp - 0xbc]
push eax
call fcn.00418f20
add esp, 4
test al, al
je 0x44014f
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.004269f0
add esp, 8
test al, al
je 0x44014f
cmp dword [ebp - 0xa8], edi
mov eax, dword [ebp - 0xbc]
jae 0x440141
lea eax, [ebp - 0xbc]
push 0x4cd3e0
push eax
call fcn.00442300
add esp, 8
cmp dword [ebp - 0x8c], edi
mov eax, dword [ebp - 0xa0]
jae 0x440163
lea eax, [ebp - 0xa0]
push eax
call fcn.00418f20
add esp, 4
test al, al
je 0x440194
cmp dword [ebp - 0x8c], edi
mov eax, dword [ebp - 0xa0]
jae 0x440184
lea eax, [ebp - 0xa0]
push ebx
push ebx
push str.__RegServer
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.Installlog.txt
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0xdc]
push eax
call fcn.0040dae0
add esp, 0xc
lea ecx, [ebp - 0xdc]
call fcn.00402039
lea ecx, [ebp - 0xa4]
call fcn.00402039
lea ecx, [ebp - 0xc0]
call fcn.00402039
lea ecx, [ebp - 0x9ec]
mov byte [ebp - 4], 0x17
call fcn.0043a950
lea ecx, [ebp - 0x92c]
mov byte [ebp - 4], 0x16
call fcn.00441c50
lea ecx, [ebp - 0x6c]
call fcn.00402039
lea ecx, [ebp - 0x95c]
call fcn.0043e060
lea ecx, [ebp - 0x50]
call fcn.00402039
lea ecx, [ebp - 0x88]
call fcn.00402039
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048c010
mov esp, ebp
pop ebp
ret