Function at 0x43fd10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454803
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov ecx, 0x464f74
call fcn.0043c790
movzx eax, al
test eax, eax
je 0x43fdb7
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x188]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x188]
mov edx, dword [edx]
mov eax, dword [edx + 0x90]
call eax
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x18c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
mov edx, dword [edx]
mov eax, dword [edx + 0x90]
call eax
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x190]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x190]
mov edx, dword [edx]
mov eax, dword [edx + 0x90]
call eax
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x194]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x194]
mov edx, dword [edx]
mov eax, dword [edx + 0x90]
call eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x50]
jne case.default.0x44009b
cmp dword [ebp + 0x10], 5
jne 0x43fe2d
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x9e], 0
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x19c], 0
je 0x43fe12
push 0x82c9
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x19c]
call fcn.00427760
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x50]
push ecx
call fcn.00428060
add esp, 4
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x19c]
call fcn.00427de0
mov ecx, 0x464f74
call fcn.0043c790
movzx eax, al
test eax, eax
jne 0x43fe2d
push 0xfffffffffffffffe
mov ecx, dword [ebp - 0x24]
call fcn.0043e640
cmp dword [ebp + 0x10], 0x1c
jne 0x43fe74
mov ecx, 0x464f74
call fcn.0043c790
movzx ecx, al
test ecx, ecx
je 0x43fe50
push 5
mov ecx, dword [ebp - 0x24]
call fcn.0043e640
jmp 0x43fe74
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00420f10
mov ecx, dword [0x464b74]
mov edx, dword [ecx]
mov ecx, dword [0x464b74]
mov eax, dword [edx + 8]
call eax
cmp dword [ebp + 0x10], 0xf
jne 0x43fe98
push 0
mov ecx, dword [0x464afc]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.00420f10
push 1
mov ecx, dword [0x464eb8]
call fcn.00445590
cmp dword [ebp + 0x10], 3
jne 0x43fec8
push 6
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x50]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x464f74
call fcn.0043c790
movzx ecx, al
test ecx, ecx
jne 0x43fec8
push 0xfffffffffffffffe
mov ecx, dword [ebp - 0x24]
call fcn.0043e640
cmp dword [ebp + 0x10], 0x1b
jne 0x440055
mov ecx, 0x464f74
call fcn.0043c790
movzx edx, al
test edx, edx
je 0x43ff15
push 0xa
push 0
push 0x17
mov ecx, dword [0x464e9c]
call fcn.0043a670
push eax
push 5
mov ecx, dword [0x464e9c]
call fcn.0043a670
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x440055
push 0x178
call fcn.00409db0
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x43ff65
push 0x8c
push 0x15e
push 0x30
push 0x4586f3
push 0x13
mov ecx, dword [0x464e9c]
call fcn.0043a670
push eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x50]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.0042aff0
mov dword [ebp - 0x28], eax
jmp 0x43ff6c
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x440055
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x16c]
mov dword [edx + 0x10a], 0x10
push 8
mov ecx, dword [0x464e9c]
call fcn.0043a670
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x16c]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x16c]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x84]
call eax
push 0x32
push 0xe6
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x16c]
call fcn.0041ff40
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x16c]
call fcn.00401e10
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x16c]
call fcn.00401df0
add eax, 0x28
push eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x16c]
call fcn.0041ff80
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x16c]
mov dword [eax + 0x106], 0x10
push 1
mov ecx, dword [ebp - 0x10]
call fcn.004014b0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
je 0x44004e
push 1
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x2c], eax
jmp 0x440055
mov dword [ebp - 0x2c], 0
cmp dword [ebp + 0x10], 0x1d
jne 0x44007f
mov ecx, 0x464f74
call fcn.0043c790
movzx ecx, al
test ecx, ecx
jne 0x44007f
mov edx, dword [0x464b6c]
mov eax, dword [edx]
mov ecx, dword [0x464b6c]
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x14
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 4
ja case.default.0x44009b
mov edx, dword [ebp - 0x30]
jmp dword [edx*4 + 0x4402d8]
push 0
mov ecx, dword [0x464b54]
call fcn.0044d6d0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 0
push 1
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.00420220
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.00420220
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.00420220
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.00420220
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.00420220
jmp case.default.0x44009b
push 1
mov ecx, dword [0x464b54]
call fcn.0044d6d0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 1
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.00420220
push 1
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.00420220
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.00420220
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.00420220
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.00420220
jmp case.default.0x44009b
push 2
mov ecx, dword [0x464b54]
call fcn.0044d6d0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 2
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.00420220
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.00420220
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.00420220
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.00420220
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.00420220
jmp case.default.0x44009b
push 3
mov ecx, dword [0x464b54]
call fcn.0044d6d0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 3
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.00420220
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.00420220
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.00420220
push 1
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.00420220
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.00420220
jmp case.default.0x44009b
push 4
mov ecx, dword [0x464b54]
call fcn.0044d6d0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x160], 4
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x184]
call fcn.00420220
push 0
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x188]
call fcn.00420220
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18c]
call fcn.00420220
push 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x190]
call fcn.00420220
push 1
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x194]
call fcn.00420220
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc