Function at 0x43aa2c
Capabilities:
Create process on windows
Delete file
Find taskbar
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x43b615
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040e608
mov eax, 0x44ac84
mov edx, 0x43b62c
call fcn.00403b60
mov eax, 0x44ac88
mov edx, 0x43b64c
call fcn.00403b60
mov eax, dword [esi + 0x38]
mov edx, 0x43b670
call fcn.0040b7d0
mov eax, dword [esi + 0x44]
mov edx, 0x43b688
call fcn.0040b7d0
mov eax, dword [esi + 0x40]
mov edx, 0x43b6a0
call fcn.0040b7d0
mov eax, dword [esi + 0x3c]
mov edx, 0x43b6b4
call fcn.0040b7d0
mov eax, dword [esi + 0x30]
mov edx, 0x43b6c4
call fcn.0040b7d0
mov eax, dword [esi + 0x30]
mov edx, dword [eax + 0x24]
or edx, 0x1000
call fcn.0040b6fc
mov eax, dword [esi + 0x34]
mov edx, 0x43b6dc
call fcn.0040b7d0
mov eax, dword [esi + 0x20]
mov ecx, 0x43b6f0
xor edx, edx
call fcn.00407c14
mov eax, dword [esi + 0x20]
mov ecx, 0x43b700
mov edx, 2
call fcn.00407c14
mov eax, dword [esi + 0x20]
mov ecx, 0x43b714
mov edx, 3
call fcn.00407c14
mov eax, dword [esi + 0x20]
mov ecx, 0x43b724
mov edx, 4
call fcn.00407c14
mov eax, dword [esi + 0x20]
mov ecx, 0x43b738
mov edx, 5
call fcn.00407c14
mov eax, dword [esi + 0x20]
mov ecx, 0x43b74c
mov edx, 6
call fcn.00407c14
mov eax, dword [esi + 0x20]
mov ecx, 0x43b760
mov edx, 8
call fcn.00407c14
cmp byte [0x44a920], 7
jae 0x43ab90
push 0x50010
mov eax, dword [0x44ac84]
call fcn.00403fa8
push eax
push 0x43b768
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
call fcn.00403a14
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x43abcc
push 0x50010
mov eax, dword [0x44ac84]
call fcn.00403fa8
push eax
push 0x43b7b4
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
call fcn.00403a14
push ebx
call sub.advapi32.dll_CloseServiceHandle
call fcn.00427670
cmp byte [0x44ab7c], 0
jne 0x43ac39
lea edx, [ebp - 0x4c]
mov eax, 1
call fcn.004064c8
mov eax, dword [ebp - 0x4c]
mov edx, 0x43b7e8
call fcn.00403ef4
jne 0x43ac12
push 1
mov ecx, 0x43b7fc
mov edx, 0x43b810
mov eax, 0x43b810
call fcn.0040f7b4
lea edx, [ebp - 0x50]
xor eax, eax
call fcn.004064c8
mov eax, dword [ebp - 0x50]
mov edx, 0x44a9f4
call fcn.0040e6dc
mov eax, esi
xor ecx, ecx
xor edx, edx
call fcn.004338f8
jmp 0x43b5ec
mov dword [0x44aa04], fcn.0043a270
mov dword [0x44aa08], 0x43a328
push 1
push 0x43b810
mov eax, 0x43b810
mov ecx, 0x43b7fc
pop edx
call fcn.0040f7b4
mov edx, 0x43b824
mov eax, dword [0x44a9f0]
call fcn.00406934
test al, al
je 0x43ad06
mov edx, 0x43b838
mov eax, dword [0x44a9f0]
call fcn.00406934
test al, al
je 0x43ad06
mov edx, 0x43b854
mov eax, dword [0x44a9f0]
call fcn.00406934
test al, al
je 0x43ad06
mov edx, 0x43b86c
mov eax, dword [0x44a9f0]
call fcn.00406934
test al, al
je 0x43ad06
mov edx, 0x43b824
mov eax, dword [0x44a9f0]
call fcn.00406798
mov byte [0x44ac30], al
mov edx, 0x43b838
mov eax, dword [0x44a9f0]
call fcn.00406798
mov byte [0x44ac31], al
mov edx, 0x43b854
mov eax, dword [0x44a9f0]
call fcn.00406798
mov byte [0x44ac32], al
mov edx, 0x43b86c
mov eax, dword [0x44a9f0]
call fcn.00406798
mov byte [0x44ac33], al
jmp 0x43ad0d
mov al, 1
call fcn.0043a668
lea ecx, [ebp - 0x54]
mov edx, 0x43b880
mov eax, dword [0x44a9f0]
call fcn.00406828
mov edx, dword [ebp - 0x54]
mov eax, 0x44ac8c
call fcn.00403b60
cmp dword [0x44ac8c], 0
je 0x43ae58
lea eax, [ebp - 0x58]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [0x44ac8c]
call fcn.00404008
mov eax, dword [ebp - 0x58]
call fcn.0040ccec
mov ebx, eax
cmp bx, 0x3fb
jbe 0x43ad84
push 0x50010
push 0x43b88c
push 0x43b898
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
jmp 0x43ae58
call fcn.0042ea04
mov dword [0x44ac4c], eax
mov eax, dword [0x44ac4c]
call fcn.004315e0
mov eax, dword [0x44ac4c]
mov edx, dword [0x44ac8c]
call fcn.0042ea14
mov edx, 0x44ac50
mov eax, dword [0x44ac4c]
call fcn.004316e0
mov eax, dword [0x44ac4c]
call fcn.0040a308
movzx eax, bx
mov edi, eax
shl edi, 2
lea edx, [edi*8 + 0x4416e0]
mov eax, 0x44ac50
mov ecx, 0x20
call fcn.00406328
test al, al
je 0x43ae0a
mov byte [0x44ac78], 1
mov eax, dword [esi + 0x20]
xor ecx, ecx
mov edx, 4
call fcn.00407c58
mov eax, dword [esi + 0x20]
xor ecx, ecx
mov edx, 5
call fcn.00407c58
jmp 0x43ae58
lea eax, [edi*8 + 0x4416e0]
cmp dword [eax + 4], 0
jne 0x43ae3b
cmp dword [eax], 0
jne 0x43ae3b
push 0x50030
push 0x43b88c
push 0x43b8b4
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
jmp 0x43ae58
push 0x50010
push 0x43b88c
push 0x43b898
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0x43b990
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x43ae87
push 0x43b9a0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x44ac98], eax
cmp dword [0x44ac98], 0
jne 0x43ae87
push ebx
call sub.kernel32.dll_FreeLibrary_1
mov al, byte [0x44ab7c]
dec eax
test al, al
jb 0x43b2bd
inc eax
mov byte [ebp - 0x15], al
mov edi, 0x44ab80
mov eax, dword [edi]
mov ebx, eax
push dword [ebx + 0x4c]
push 0x43b9bc
push dword [ebx + 0x40]
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00403e68
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x44a9f0]
call fcn.00406758
mov dword [ebx + 0x24], eax
mov edx, 0x43b9c8
mov eax, dword [ebx + 0x24]
call fcn.00406934
test al, al
jne 0x43af09
lea eax, [ebp - 0x26]
push eax
call sub.kernel32.dll_GetSystemTime
push 0x10
mov edx, 0x43b9c8
lea ecx, [ebp - 0x26]
mov eax, dword [ebx + 0x24]
call fcn.004069d8
push esi
push edi
lea esi, [ebp - 0x26]
lea edi, [ebx + 0x94]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
jmp 0x43af1e
push 0x10
mov edx, 0x43b9c8
lea ecx, [ebx + 0x94]
mov eax, dword [ebx + 0x24]
call fcn.00406998
cmp byte [ebx + 0x705], 0
jne 0x43af43
cmp byte [ebx + 0x6be], 0
je 0x43af43
mov edx, 0x43b9e4
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov dword [ebx + 0x6c0], eax
mov edx, 0x43ba04
mov eax, dword [ebx + 0x24]
call fcn.00406798
xor edx, edx
mov dl, byte [ebx + 0x8f]
cmp eax, edx
jbe 0x43af6f
mov edx, 0x43ba04
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebx + 0x8f], al
mov al, byte [ebx + 0x8e]
cmp al, byte [ebx + 0x8f]
jbe 0x43af83
mov byte [ebx + 0x8f], al
mov edx, 0x43ba1c
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebx + 0xa6], al
mov edx, 0x43ba38
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebx + 0xa9], al
mov edx, 0x43ba50
mov eax, dword [ebx + 0x24]
call fcn.00406934
test al, al
je 0x43b0d6
mov edx, 0x43ba6c
mov eax, dword [ebx + 0x24]
call fcn.00406934
test al, al
je 0x43b0d6
mov edx, 0x43ba8c
mov eax, dword [ebx + 0x24]
call fcn.00406934
test al, al
je 0x43b0d6
mov edx, 0x43baa8
mov eax, dword [ebx + 0x24]
call fcn.00406934
test al, al
je 0x43b0d6
mov edx, 0x43bac4
mov eax, dword [ebx + 0x24]
call fcn.00406934
test al, al
je 0x43b0d6
mov edx, 0x43badc
mov eax, dword [ebx + 0x24]
call fcn.00406934
test al, al
je 0x43b0d6
mov edx, 0x43baf8
mov eax, dword [ebx + 0x24]
call fcn.00406934
test al, al
je 0x43b0d6
mov edx, 0x43ba8c
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov word [ebx + 0x6b2], ax
mov edx, 0x43baa8
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov word [ebx + 0x6b4], ax
mov edx, 0x43bac4
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov word [ebx + 0x6b6], ax
mov edx, 0x43badc
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov word [ebx + 0x6b8], ax
mov edx, 0x43baf8
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov word [ebx + 0x6bc], ax
mov edx, 0x43ba50
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebx + 0x6b0], al
mov edx, 0x43ba6c
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebx + 0x6b1], al
mov byte [ebx + 0x6e6], 0
mov byte [ebx + 0x6e7], 0
jmp 0x43b0e4
mov byte [ebx + 0x6e6], 1
mov byte [ebx + 0x6e7], 1
mov edx, 0x43bb10
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebx + 0x6e5], al
mov edx, 0x43bb34
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebx + 0x6d8], al
mov edx, 0x43bb50
mov eax, dword [ebx + 0x24]
call fcn.00406934
test al, al
je 0x43b2b1
mov edx, 0x43bb50
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
cmp al, byte [ebx + 0x7b]
je 0x43b19d
test al, al
je 0x43b173
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 0x42
mov edx, 0x43bb5c
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebp - 0xc], al
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.00423244
mov byte [ebx + 0x7b], al
jmp 0x43b1e8
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 0xc2
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.00423244
xor al, 1
mov byte [ebx + 0x7b], al
jmp 0x43b1e8
mov edx, 0x43bb5c
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
cmp al, byte [ebx + 0x7c]
je 0x43b1e8
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 0x42
mov al, byte [ebp - 5]
mov byte [ebp - 0xc], al
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.00423244
test al, al
je 0x43b1e8
mov al, byte [ebp - 5]
mov byte [ebx + 0x7c], al
mov edx, 0x43bb70
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
cmp al, byte [ebx + 0x78]
je 0x43b266
test al, al
je 0x43b23c
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 5
mov edx, 0x43bb7c
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebp - 0xc], al
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.00423244
mov byte [ebx + 0x78], al
jmp 0x43b2b1
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 0x85
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.00423244
xor al, 1
mov byte [ebx + 0x78], al
jmp 0x43b2b1
mov edx, 0x43bb7c
mov eax, dword [ebx + 0x24]
call fcn.00406798
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
cmp al, byte [ebx + 0x79]
je 0x43b2b1
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 5
mov al, byte [ebp - 5]
mov byte [ebp - 0xc], al
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.00423244
test al, al
je 0x43b2b1
mov al, byte [ebp - 5]
mov byte [ebx + 0x79], al
add edi, 4
dec byte [ebp - 0x15]
jne 0x43ae9e
cmp byte [0x44ab7c], 0
je 0x43b2cb
call fcn.00438344
mov eax, dword [esi + 0x18]
mov edx, dword [eax + 0x24]
and edx, 0xfffeffff
and edx, 0xfffbffff
call fcn.0040b6fc
call fcn.00437ec4
cmp byte [0x44ac32], 0
je 0x43b2f5
call fcn.0043a574
mov edx, 0x43bb90
mov eax, dword [0x44a9f0]
call fcn.00406934
test al, al
jne 0x43b552
mov edx, 0x43bb90
mov ecx, 1
mov eax, dword [0x44a9f0]
call fcn.0040688c
call fcn.0043a7b4
test al, al
jne 0x43b500
mov dl, 1
mov eax, 0x43bbac
call fcn.0040d838
test al, al
je 0x43b500
push 0
push 0x43bbc0
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x43b500
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x14]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x14], eax
push 0x50030
mov eax, dword [0x44ac84]
call fcn.00403fa8
push eax
push 0x43bbd0
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
push 0
push 0x5b4
push ebx
call sub.user32.dll_PostMessageA
push 0x2710
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x43b500
mov edx, 0x43bc18
mov eax, 0x80000001
call fcn.00406728
mov ebx, eax
mov edx, 0x43bc78
mov eax, ebx
call fcn.0040696c
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x43aa0c]
call fcn.004048a4
add esp, 4
mov eax, dword [ebp - 4]
call fcn.004046d0
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x43bc78
mov eax, ebx
call fcn.00406998
mov eax, 0x4496c8
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00404048
test eax, eax
je 0x43b452
mov edx, dword [ebp - 4]
cmp byte [edx + eax + 0x20f], 2
je 0x43b433
mov edx, dword [ebp - 4]
mov byte [edx + eax + 0x20f], 2
mov eax, dword [ebp - 4]
call fcn.004046d0
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x43bc78
mov eax, ebx
call fcn.004069d8
mov eax, ebx
call fcn.00406904
push 0
push 0
push 0x43bc84
lea edx, [ebp - 0x60]
mov eax, 0x43bc90
call fcn.0040e62c
lea eax, [ebp - 0x60]
mov edx, 0x43bca0
call fcn.00403db0
mov eax, dword [ebp - 0x60]
call fcn.00403fa8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov al, byte [0x44ab7c]
dec eax
test al, al
jb 0x43b4af
inc eax
mov byte [ebp - 0x15], al
mov bl, 0
xor eax, eax
mov al, bl
mov edx, dword [0x44ac94]
mov eax, dword [edx + eax*4]
call fcn.0040a308
inc ebx
dec byte [ebp - 0x15]
jne 0x43b497
call fcn.00437ec4
cmp byte [0x44ac32], 0
je 0x43b500
mov eax, dword [0x44acb8]
call fcn.00406c34
mov eax, dword [0x44acb0]
call fcn.0040a308
mov eax, dword [0x44acb4]
call fcn.0040908c
mov edx, eax
mov eax, dword [0x44a8a8]
call fcn.0040c2b4
mov dword [0x44acb0], eax
mov eax, dword [0x44acb0]
call fcn.00437c80
mov eax, dword [0x44acb8]
call fcn.00406c08
push 0x50044
mov eax, dword [0x44ac84]
call fcn.00403fa8
push eax
push 0x43bcb0
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
cmp eax, 6
jne 0x43b53c
push 5
push 0
push 0
push 0x43bd64
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
mov ecx, 1
mov edx, 0x43bd94
mov eax, 0x43b62c
call fcn.0043a6e4
mov dword [ebp - 0x48], 0x20
mov dword [ebp - 0x44], 5
push esi
mov esi, 0x43e3b4
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_RegisterDeviceNotificationA_1
mov eax, dword [esi + 0x18]
xor edx, edx
mov dword [eax + 0xf2], edx
lea eax, [ebp - 0x68]
call fcn.0040ce78
push dword [ebp - 0x68]
push 0x43b810
push 0x43bdbc
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x64]
call fcn.00403fa8
push eax
call sub.kernel32.dll_DeleteFileA
push 0xffffffffffffffff
push 0xffffffffffffffff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetProcessWorkingSetSize
mov eax, dword [esi + 0x24]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 8]
push pe_nt_image_headers32
push 0
push 0x513
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_SendMessageA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b61c
lea eax, [ebp - 0x68]
mov edx, 8
call fcn.00403b30
lea eax, [ebp - 4]
mov edx, dword [0x43aa0c]
call fcn.004048b0
ret