Function at 0x43a6b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
xor eax, eax
push ebx
mov dword [ebp - 0x18], eax
push esi
mov dword [ebp - 0x14], eax
push edi
mov dword [ebp - 0x10], eax
mov ecx, 0x11
lea edi, [ebp - 0x5c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, str.Ati2evxx.exe__CFPnP
mov dword [ebp - 4], 0
mov dword [ebp - 0x5c], 0x44
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a6e7
mov ecx, dword [ebp + 8]
sub eax, edx
mov edi, eax
mov eax, dword [ecx + 4]
add edi, 0xa
xor esi, esi
test al, 0x10
je 0x43a717
movzx eax, byte [ecx + 0x11]
mov ecx, dword [ecx + 0x10]
and ecx, 0xff
mov esi, 0x10
add eax, ecx
jmp 0x43a734
test al, 2
je 0x43a728
mov edx, dword [ecx + 0x10]
mov esi, 2
mov dword [ebp - 4], edx
jmp 0x43a737
test al, 1
je 0x43a737
mov eax, dword [ecx + 0x10]
mov esi, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x43a744
lea ecx, [eax + eax*2]
lea edi, [edi + ecx*4]
push edi
call fcn.00460f8e
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x43a767
push str.CeateRestartProcess:_failed_to_create_memory_n
call fcn.0040acd0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, str.Ati2evxx.exe__CFPnP
mov edx, ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43a784
mov eax, str.Ati2evxx.exe__CFPnP
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a796
sub eax, edx
push esi
add eax, ebx
push 0x48c43c
push eax
call fcn.00460f01
mov eax, ebx
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a7b5
sub eax, esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x10]
push ecx
add eax, ebx
push 0x48c43c
push eax
call fcn.00460f01
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a7e0
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x43a879
mov edx, eax
add esi, 0x18
mov dword [ebp + 8], edx
mov edi, edi
mov edx, dword [esi - 4]
xor ecx, ecx
mov eax, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
mov ch, byte [esi + 4]
and edx, 0xff
and eax, 0xff000000
mov cl, byte [esi]
shl ecx, 8
or ecx, edx
or ecx, eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x43a830
or ecx, 0x1000000
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
and eax, 1
shl eax, 4
and edx, 0xf
or eax, edx
shl eax, 0x19
and ecx, 0xc1ffffff
or eax, ecx
push eax
push 0x48c43c
add edi, ebx
push edi
call fcn.00460f01
mov eax, ebx
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a862
sub eax, edi
mov edi, eax
mov eax, dword [ebp + 8]
add esi, 0x18
dec eax
mov dword [ebp + 8], eax
jne 0x43a800
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x43a8c9
push str.CreateRestartProcess:_create_restart_process_n
call fcn.0040acd0
mov edx, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push edx
call esi
mov eax, dword [ebp - 0x18]
push eax
call esi
push ebx
call fcn.00460851
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.CeateRestartProcess:_failed_to_create_process_n
call fcn.0040acd0
add esp, 4
push ebx
call fcn.00460851
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret