Function at 0x433bf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0c
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 0x2c], eax
call fcn.00424e10
call fcn.0042a8c0
push 0x434050
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x28], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00435030
add esp, 4
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, 0x48de64
call fcn.00434f30
mov dword [ebp - 0x28], eax
call fcn.0041a590
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.00433990
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 8]
push eax
call sub.gdiplus.dll_GdiplusStartup
lea ecx, [ebp - 0x14]
push ecx
call dword [ebp - 0x10]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3d8]
call fcn.0042d930
cmp dword [ebp + 0x10], 0
je 0x433f4f
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x3e0]
call fcn.004052f0
lea ecx, [ebp - 0x3e8]
call fcn.004052d0
lea ecx, [ebp - 0x3dc]
call fcn.004052d0
lea eax, [ebp - 0x3dc]
push eax
lea ecx, [ebp - 0x3e8]
push ecx
lea edx, [ebp - 0x3e0]
push edx
call fcn.00433a40
add esp, 0xc
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0
je 0x433f2e
push 0x476ac4
lea eax, [ebp - 0x3e8]
push eax
call fcn.00407be0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x433d39
lea ecx, [ebp - 0x3dc]
call fcn.00405880
test eax, eax
jle 0x433d34
lea ecx, [ebp - 0x3dc]
call fcn.00419850
push eax
lea ecx, [ebp - 0x3d8]
call fcn.00430e10
jmp 0x433f06
push 0x476acc
lea edx, [ebp - 0x3e8]
push edx
call fcn.00407be0
add esp, 8
movzx eax, al
test eax, eax
je 0x433dbe
push 0x40
push 0x476ad8
push 0x476b30
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x48de64
call fcn.00434e30
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0xa04], 0
lea ecx, [ebp - 0x3dc]
call fcn.00443840
lea ecx, [ebp - 0x3e8]
call fcn.00443840
lea ecx, [ebp - 0x3e0]
call fcn.00443840
lea ecx, [ebp - 0x3d8]
call fcn.0042db00
mov eax, dword [ebp - 0xa04]
jmp 0x434037
push 0x476b88
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00407be0
add esp, 8
movzx edx, al
test edx, edx
je 0x433e43
push 0x40
push 0x476b24
push str.It_isnt_support_run_in_virtual_machine_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x48de64
call fcn.00434e30
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0xa08], 0
lea ecx, [ebp - 0x3dc]
call fcn.00443840
lea ecx, [ebp - 0x3e8]
call fcn.00443840
lea ecx, [ebp - 0x3e0]
call fcn.00443840
lea ecx, [ebp - 0x3d8]
call fcn.0042db00
mov eax, dword [ebp - 0xa08]
jmp 0x434037
push 0x476be4
lea eax, [ebp - 0x3e8]
push eax
call fcn.00407be0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x433ec5
push 0x40
push 0x476bec
push str.It_isnt_support_run_at_remote_desktop_session
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x48de64
call fcn.00434e30
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0xa0c], 0
lea ecx, [ebp - 0x3dc]
call fcn.00443840
lea ecx, [ebp - 0x3e8]
call fcn.00443840
lea ecx, [ebp - 0x3e0]
call fcn.00443840
lea ecx, [ebp - 0x3d8]
call fcn.0042db00
mov eax, dword [ebp - 0xa0c]
jmp 0x434037
push 0x476c58
lea edx, [ebp - 0x3e8]
push edx
call fcn.00407be0
add esp, 8
movzx eax, al
test eax, eax
je 0x433f06
lea ecx, [ebp - 0x3dc]
call fcn.00405880
test eax, eax
jle 0x433f06
lea ecx, [ebp - 0x3dc]
call fcn.00419850
push eax
lea ecx, [ebp - 0x3d8]
call fcn.004312f0
lea ecx, [ebp - 0x3dc]
push ecx
lea edx, [ebp - 0x3e8]
push edx
lea eax, [ebp - 0x3e0]
push eax
call fcn.00433a40
add esp, 0xc
mov dword [ebp - 0x3e4], eax
jmp 0x433ce6
lea ecx, [ebp - 0x3dc]
call fcn.00443840
lea ecx, [ebp - 0x3e8]
call fcn.00443840
lea ecx, [ebp - 0x3e0]
call fcn.00443840
call fcn.004348f0
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x3d8]
call fcn.00434af0
mov dword [ebp - 4], eax
call fcn.00434a50
cmp dword [ebp - 0x3c], 0
je 0x433fa9
push 0x104
lea ecx, [ebp - 0x5f0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 5
push 0
push 0x476c60
lea edx, [ebp - 0x5f0]
push edx
push 0x476c68
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x434019
cmp dword [ebp - 0x38], 0
je 0x433fe2
push 0x104
lea eax, [ebp - 0x7f8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 5
push 0
push 0x476c74
lea ecx, [ebp - 0x7f8]
push ecx
push 0x476c7c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x434019
cmp dword [ebp - 0x34], 0
je 0x434019
push 0x104
lea edx, [ebp - 0xa00]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 5
push 0
push 0x476c88
lea eax, [ebp - 0xa00]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x3d8]
call fcn.0042db00
mov ecx, 0x48de64
call fcn.00434e30
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0045670b
mov esp, ebp
pop ebp
ret 0x10