Function at 0x43ed78
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x34], edi
mov edx, ecx
mov dword [esp + 0x30], edx
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
mov ebp, ebx
mov dword [esp + 0x10], eax
lea ecx, [edi + 0x10]
mov dword [edi + 4], edx
mov dword [edi + 0x2c], 8
push 0xa
pop eax
mov dword [edi + 8], eax
lea eax, [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 0xc]
mov dword [edi + 0x14], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebx
mov dword [eax], ecx
mov dword [edx + 0xc], ecx
or dword [edi + 0x18], 0xffffffff
or dword [edi + 0x7c], 0xffffffff
or dword [edi + 0x80], 0xffffffff
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x74], ebx
mov byte [edi + 0x84], bl
mov dword [edi + 0x58], ebx
mov ebx, dword [esp + 0x90]
mov dword [edi + 0x3c], 0xe
mov dword [edi + 0x38], edi
mov eax, dword [ebx]
mov dword [edi + 0x30], eax
test byte [ebx + 0x14], 3
mov dword [esp + 0x14], ebp
je 0x43ee1e
mov eax, 0xfffff02f
jmp 0x43f21f
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x43f21a
cmp dword [ebx + 8], ebp
je 0x43f21a
lea edx, [esp + 0x20]
call fcn.0043e277
mov esi, eax
test esi, esi
jne 0x43f1c6
mov edx, dword [ebx + 0x14]
lea eax, [esp + 0x28]
mov ecx, dword [ebx + 8]
push eax
push 4
pop eax
and edx, eax
call fcn.0043e75e
mov esi, eax
pop ecx
test esi, esi
jne 0x43f1c6
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x43ee87
lea edx, [esp + 0x18]
call fcn.0043e977
mov esi, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
test esi, esi
jne 0x43f1c6
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x43eeaa
lea edx, [esp + 0x1c]
call fcn.0043e277
mov esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
test esi, esi
je 0x43eeec
jmp 0x43f1c6
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
push 0
call ebp
mov esi, eax
test esi, esi
je 0x43f1be
lea ecx, [esi + esi]
call fcn.004396f2
mov dword [esp + 0x10], eax
test eax, eax
jne 0x43eed8
push 0xe
pop esi
jmp 0x43f1c6
push eax
push esi
call ebp
test eax, eax
je 0x43f1be
cmp eax, esi
jae 0x43f1be
mov esi, dword [esp + 0x14]
test esi, esi
je 0x43ef4f
movzx eax, word [esi]
test ax, ax
je 0x43ef4f
cmp eax, 0x50
je 0x43ef06
cmp eax, 0x70
jne 0x43ef37
movzx eax, word [esi + 2]
cmp eax, 0x41
je 0x43ef14
cmp eax, 0x61
jne 0x43ef37
movzx eax, word [esi + 4]
cmp eax, 0x54
je 0x43ef22
cmp eax, 0x74
jne 0x43ef37
movzx eax, word [esi + 6]
cmp eax, 0x48
je 0x43ef30
cmp eax, 0x68
jne 0x43ef37
cmp word [esi + 8], 0x3d
je 0x43ef48
push esi
call fcn.0052fd64
pop ecx
lea esi, [esi + eax*2]
add esi, 2
jne 0x43eef4
jmp 0x43ef4f
lea ebp, [esi + 0xa]
test ebp, ebp
jne 0x43ef9b
push 0
push 0
push 0x58994c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x43f1be
lea ecx, [esi + esi]
call fcn.004396f2
mov dword [esp + 0x2c], eax
test eax, eax
je 0x43eed0
push esi
push eax
push 0x58994c
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x43f1be
cmp eax, esi
jae 0x43f1be
mov ecx, dword [esp + 0x30]
lea eax, [edi + 0x74]
push eax
mov edx, ebx
call fcn.0043b250
mov esi, eax
pop ecx
test esi, esi
jne 0x43f1c6
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x14]
mov edx, ebp
call fcn.0043e4e4
mov dword [esp + 0x28], eax
pop ecx
test eax, eax
jne 0x43efd5
push 2
jmp 0x43eed2
mov ecx, dword [edi + 0x74]
xor eax, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x74], 0x101
movzx eax, word [ecx]
imul eax, eax, 5
push 4
mov dword [esp + 0x80], ecx
pop edx
add ax, dx
mov edx, dword [ebx + 0x14]
mov word [esp + 0x7a], ax
mov eax, dword [ecx]
mov eax, dword [eax + ecx + 4]
mov dword [esp + 0x80], eax
mov eax, dword [ecx]
mov eax, dword [eax + ecx + 8]
mov dword [esp + 0x84], eax
mov eax, dword [ecx]
mov eax, dword [ecx + eax + 0xc]
mov ecx, 0x400
mov dword [esp + 0x88], eax
test dl, 0x30
je 0x43f096
and dword [esp + 0x1c], 0
mov eax, dword [ebx + 0x18]
test eax, eax
jle 0x43f096
mov ebp, dword [ebx + 0x1c]
mov edi, ecx
mov ebx, eax
test byte [ebp], 2
jne 0x43f07f
mov ecx, edi
lea eax, [ebx - 1]
or ecx, 0x8000000
cmp dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmovne ecx, edi
inc eax
add ebp, 8
mov dword [esp + 0x1c], eax
mov edi, ecx
cmp eax, ebx
jl 0x43f055
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
test dl, 0x50
jne 0x43f0a0
push 0xa
pop eax
jmp 0x43f0a2
xor eax, eax
mov word [esp + 0x78], ax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x4c]
push eax
push ebp
push dword [esp + 0x20]
mov eax, ecx
or eax, 0x208
test dl, 8
cmove eax, ecx
push eax
push 1
push 0
push 0
push dword [esp + 0x48]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x43f1be
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov dword [edi + 0x80], ecx
mov dword [edi + 0x34], eax
test byte [ebx + 0x14], 8
jne 0x43f133
cmp byte [0x8934e8], 0
jne 0x43f113
mov edx, 0x43e1d5
mov ecx, 0x8934e8
call fcn.0043f2dc
mov ecx, dword [esp + 0x38]
push ecx
push dword [0x8934f0]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x43f133
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x43f227
xor ebp, ebp
cmp dword [ebx + 0x18], ebp
jle 0x43f16b
xor edx, edx
mov eax, dword [ebx + 0x1c]
test byte [eax + edx], 1
je 0x43f162
mov ecx, dword [eax + edx + 4]
cmp dword [ecx + 8], 7
jne 0x43f162
cmp dword [ecx + 0x90], 0
je 0x43f162
mov eax, dword [esp + 0x40]
mov dword [ecx + 0x100], eax
inc ebp
add edx, 8
cmp ebp, dword [ebx + 0x18]
jl 0x43f13c
push 0xc
push 0xffffffffffffffff
push edi
push 0x43ec3a
push dword [edi + 0x80]
lea eax, [edi + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x43f199
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x589b2c
jmp 0x43f22c
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x2c]
test al, 4
jne 0x43f1c6
push 4
pop ecx
or eax, ecx
mov dword [edi + 0x2c], eax
test al, 8
je 0x43f1c6
mov eax, dword [edi + 4]
inc dword [eax + 4]
jmp 0x43f1c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [esp + 0x20]
call fcn.00439702
mov ecx, dword [esp + 0x24]
call fcn.00439702
mov ecx, dword [esp + 0x28]
call fcn.00439702
mov ecx, dword [esp + 0x10]
call fcn.00439702
mov ecx, dword [esp + 0x14]
call fcn.00439702
mov ecx, dword [esp + 0x2c]
call fcn.00439702
mov ecx, dword [edi + 0x74]
test ecx, ecx
je 0x43f20c
call fcn.0043b526
and dword [edi + 0x74], 0
pop edi
mov ecx, esi
pop esi
pop ebp
pop ebx
add esp, 0x7c
jmp fcn.00449d08
mov eax, 0xfffff019
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
mov edx, 0x589b10
mov ecx, eax
call fcn.00449c84
int3