Function at 0x43c730
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x441004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x441180]
push ebx
push esi
mov dword [ebp - 0x1b4], ecx
xor ebx, ebx
mov esi, dword [eax + 0xc]
mov ecx, esi
push edi
mov edi, dword [ebp + 8]
call dword [0x4422c4]
mov ecx, 0x441180
call esi
add eax, 0x10
mov dword [ebp - 0x1b0], eax
cmp dword [0x441604], ebx
je 0x43c78d
push edi
push 0x42ee1c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
push 0x1a0
lea eax, [ebp - 0x1ac]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp - 0x1b4]
add esp, 0xc
mov dword [ebp - 0x198], 0x10000000
mov dword [ebp - 0x1c], 0x43ccf0
mov dword [ebp - 0x14], ecx
test edi, edi
jne 0x43c7c5
xor ecx, ecx
jmp 0x43c7df
mov ecx, edi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43c7d0
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x1b0]
call fcn.00435250
mov esi, dword [ebp - 0x1b0]
cmp dword [esi - 4], 1
jle 0x43c80c
push dword [esi - 0xc]
lea ecx, [ebp - 0x1b0]
call fcn.004350f0
mov esi, dword [ebp - 0x1b0]
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x1ac], esi
push eax
call dword [sym.imp.api_ms_win_eventing_consumer_l1_1_0.dll_OpenTraceW]
mov edi, eax
mov dword [ebp - 0x1b0], edx
cmp edi, 0xffffffff
jne 0x43c8fa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x43c847
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x43c8fa
lea edx, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], 0
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], 0
je 0x43c8ae
push 0x42ee58
push dword [ebp - 0x1b4]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43c8ae
push 0xcc
push 0x42ed48
push 0x42b77c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x14
mov eax, dword [ebp - 0x1b0]
cmp edi, 0xffffffff
je 0x43c8c1
push eax
push edi
call dword [sym.imp.api_ms_win_eventing_consumer_l1_1_0.dll_CloseTrace]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43c8e5
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x4422c4]
mov ecx, edi
call esi
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ffc0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x1b0]
push 0
push 0
push eax
push 0x43cc10
push 0
push 0
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov ecx, dword [ebp - 0x1b4]
mov dword [ecx + 0x60], eax
test eax, eax
jne 0x43c99a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x43c942
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], 0
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], 0
je 0x43c8ae
push 0x42ee80
push dword [ebp - 0x1b4]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43c8ae
push 0xd2
jmp 0x43c898
or edi, 0xffffffff
xor eax, eax
jmp 0x43c8b4