Function at 0x43d900
Capabilities:
Accept command line arguments
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3fc
mov eax, dword [0x4d1644]
xor eax, esp
mov dword [esp + 0x3f8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0xffffffffffffffff
mov dword [esp + 0x20], eax
call sub.IMM32.dll_ImmDisableIME
call fcn.00432cc0
xor esi, esi
push 0x206
mov eax, 7
lea ecx, [esp + 0x1fe]
push esi
push ecx
mov dword [esp + 0x1f8], eax
mov dword [esp + 0x1f4], esi
mov word [esp + 0x1e4], si
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x1bc], esi
mov word [esp + 0x1ac], si
mov word [esp + 0x204], si
call fcn.0047a360
add esp, 0xc
push 0x104
lea edx, [esp + 0x1fc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x1f8]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x43d9a0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1fc]
push eax
lea ecx, [esp + 0x1a4]
call fcn.00402467
mov eax, dword [esp + 0x1b0]
lea edi, [eax - 1]
cmp edi, eax
jbe 0x43d9d7
call fcn.0047a2b7
mov eax, dword [esp + 0x1a0]
mov ebx, 8
cmp dword [esp + 0x1b4], ebx
jae 0x43d9f3
lea eax, [esp + 0x1a0]
cmp word [eax + edi*2], 0x5c
je 0x43da57
push 1
push 0x4b775c
lea ecx, [esp + 0x188]
mov dword [esp + 0x1a0], 7
mov dword [esp + 0x19c], esi
mov word [esp + 0x18c], si
call fcn.00402467
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x188]
push ecx
lea ecx, [esp + 0x1a8]
call fcn.0040c510
cmp dword [esp + 0x198], ebx
jb 0x43da57
mov edx, dword [esp + 0x184]
push edx
call fcn.00479e49
add esp, 4
push str.Kernel32.dll
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0x16c]
push ecx
call fcn.0040cbf0
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [esp + 0x1e0]
call fcn.00402186
cmp dword [esp + 0x17c], ebx
jb 0x43da9d
mov edx, dword [esp + 0x168]
push edx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0x1ec], ebx
mov eax, dword [esp + 0x1d8]
jae 0x43dab4
lea eax, [esp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
je 0x43dadf
push str.SetDllDirectoryA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x43dad8
push 0x4be61e
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4b8c7c]
mov cx, word [0x4b8c80]
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x1f0]
push edx
push edi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x2c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x1d8], 7
mov dword [esp + 0x1d4], esi
mov word [esp + 0x1c4], si
mov dword [esp + 0x1f8], eax
mov word [esp + 0x1fc], cx
call fcn.004328d0
add esp, 8
cmp eax, esi
mov dword [esp + 0x1c], eax
je 0x43dfb6
mov esi, eax
push str.RegServer
push esi
call fcn.00432920
add esp, 8
test eax, eax
jne 0x43db63
mov dword [esp + 0x14], 1
jmp 0x43dfb6
push str.UnregServer
push esi
call fcn.00432920
add esp, 8
test eax, eax
jne 0x43db82
mov dword [esp + 0x14], 2
jmp 0x43dfb6
push str.Embedding
push esi
call fcn.00432920
add esp, 8
test eax, eax
jne 0x43dba1
mov dword [esp + 0x14], 3
jmp 0x43dfb6
push str.Install
push esi
call fcn.00432920
add esp, 8
test eax, eax
jne 0x43dfb6
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x1c], 4
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
mov dword [esp + 0x28], eax
je 0x43dd72
xor ebx, ebx
cmp dword [esp + 0x10], ebx
jle 0x43dd72
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + ebx*4]
push edx
lea ecx, [esp + 0x114]
call fcn.004042bd
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x114]
call fcn.00434aa0
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x114]
mov esi, eax
call fcn.004247b0
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x114]
mov edi, eax
call fcn.00434aa0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push fcn.0047c4fc
push ecx
mov ecx, dword [edi + 4]
push edx
mov edx, dword [edi]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x54]
push eax
call fcn.00434e00
add esp, 0x20
push str.pid
lea ecx, [esp + 0x184]
call fcn.004042bd
push str.dir
lea ecx, [esp + 0x168]
call fcn.004042bd
push 0
lea ecx, [esp + 0x184]
push ecx
lea ecx, [esp + 0x118]
call fcn.00423ce0
cmp eax, 0xffffffff
lea ecx, [esp + 0x110]
je 0x43dce9
mov edx, dword [esp + 0x194]
push 0xffffffffffffffff
add edx, eax
push edx
lea eax, [esp + 0x134]
push eax
call fcn.00425c90
push 1
push 1
lea ecx, [esp + 0x134]
push ecx
lea ecx, [esp + 0x94]
call fcn.0043ab80
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x8c]
call fcn.0043a930
lea ecx, [esp + 0x88]
call fcn.00433fe0
jmp 0x43dd35
push 0
lea eax, [esp + 0x168]
push eax
call fcn.00423ce0
cmp eax, 0xffffffff
je 0x43dd41
mov ecx, dword [esp + 0x178]
push 0xffffffffffffffff
add ecx, eax
push ecx
lea edx, [esp + 0x134]
push edx
lea ecx, [esp + 0x11c]
call fcn.00425c90
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x1c4]
call fcn.00402186
lea ecx, [esp + 0x12c]
call fcn.00402055
lea ecx, [esp + 0x164]
call fcn.00402055
lea ecx, [esp + 0x180]
call fcn.00402055
lea ecx, [esp + 0x110]
call fcn.00402055
add ebx, 1
cmp ebx, dword [esp + 0x10]
jl 0x43dbe3
cmp dword [esp + 0x18], 0
jne 0x43dfb6
mov ecx, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0x130]
call fcn.004042bd
push 0x4be620
lea ecx, [esp + 0x114]
call fcn.004042bd
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x130]
call fcn.00434aa0
mov esi, eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x130]
call fcn.004247b0
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x130]
mov edi, eax
call fcn.00434aa0
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push fcn.0047c4fc
push edx
mov edx, dword [edi + 4]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.00434e00
add esp, 0x20
push 0
push 0x4b8ed0
lea ecx, [esp + 0x134]
call fcn.00417130
cmp eax, 0xffffffff
je 0x43df9e
mov edx, dword [esp + 0x140]
push edx
push 0
push 0x4b8ec8
lea ecx, [esp + 0x138]
call fcn.00417130
push eax
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x138]
call fcn.00425c90
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.00402186
lea ecx, [esp + 0x164]
call fcn.00402055
push 0
push 0x4beb1c
lea ecx, [esp + 0x118]
call fcn.00434220
cmp eax, 0xffffffff
je 0x43dec5
push 0
push 0x4beb1c
lea ecx, [esp + 0x118]
call fcn.00434220
push eax
push 0
lea ecx, [esp + 0x16c]
push ecx
lea ecx, [esp + 0x11c]
call fcn.00425c90
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.00402186
lea ecx, [esp + 0x164]
call fcn.00402055
cmp dword [esp + 0x124], 0
je 0x43df9e
push 0x4be61e
lea ecx, [esp + 0x14c]
mov byte [esp + 0x28], 1
call fcn.004040f9
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x114]
push eax
call fcn.00451be0
add esp, 8
push 3
push 0
lea ecx, [esp + 0x150]
call fcn.00402329
push 0
push 0x4b8ec4
lea ecx, [esp + 0x150]
call fcn.00434000
cmp eax, 0xffffffff
je 0x43df59
lea esp, [esp]
push 1
push eax
lea ecx, [esp + 0x150]
call fcn.00402329
push 1
push 0
push 0x4b8ec4
lea ecx, [esp + 0x154]
call fcn.004337c0
cmp eax, 0xffffffff
jne 0x43df30
lea ecx, [esp + 0x148]
push ecx
call fcn.00442e10
add esp, 4
test al, al
je 0x43df92
cmp dword [esp + 0x160], 0x10
mov eax, dword [esp + 0x14c]
jae 0x43df85
lea eax, [esp + 0x14c]
push eax
call fcn.0047a4ce
add esp, 4
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x148]
call fcn.00401fba
lea ecx, [esp + 0x110]
call fcn.00402055
lea ecx, [esp + 0x12c]
call fcn.00402055
mov esi, dword [esp + 0x14]
xor ebx, ebx
lea eax, [esi - 1]
cmp eax, 3
mov dword [esp + 0x10], ebx
ja case.default.0x43dfcc
jmp dword [eax*4 + 0x43e408]
mov edx, dword [ebp + 0x14]
push edx
mov ecx, 0x4d3cd0
call fcn.00435be0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x110]
push ebx
push eax
call fcn.00444030
lea ecx, [esp + 0x188]
push ebx
push ecx
call fcn.004440e0
push str.DownloadProxyPS.dll
lea edx, [esp + 0x194]
push edx
lea eax, [esp + 0x144]
push eax
call fcn.0040cbf0
push str._bugreport_xf.exe
lea ecx, [esp + 0x1a0]
push ecx
lea edx, [esp + 0x16c]
push edx
call fcn.0040cbf0
add esp, 0x28
cmp dword [esp + 0x124], ebx
mov edi, 8
je 0x43e1f5
cmp esi, 1
mov eax, dword [esp + 0x114]
jne 0x43e146
cmp dword [esp + 0x128], edi
jae 0x43e06a
lea eax, [esp + 0x114]
push 0x4b8d5c
push eax
call fcn.0043f800
mov eax, dword [esp + 0x154]
add esp, 8
cmp dword [esp + 0x160], edi
jae 0x43e08f
lea eax, [esp + 0x14c]
push 0x4b8e54
push eax
call fcn.0043f800
add esp, 8
push 0x4b8c84
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x74]
push str._s__
push ecx
call fcn.00435340
add esp, 0xc
push eax
lea edx, [esp + 0x16c]
push edx
call fcn.0040cbf0
add esp, 0xc
lea ecx, [esp + 0x6c]
call fcn.00402055
cmp dword [esp + 0x17c], edi
mov eax, dword [esp + 0x168]
jae 0x43e0ed
lea eax, [esp + 0x168]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x2b4
call fcn.00479e4e
add esp, 4
cmp eax, ebx
je 0x43e1e9
mov ecx, eax
call fcn.00454ac0
mov esi, eax
cmp esi, ebx
je 0x43e1e9
mov ecx, esi
call fcn.00458700
mov ecx, esi
call fcn.004591a0
mov ecx, esi
call fcn.00453170
push esi
call fcn.00479e49
add esp, 4
jmp 0x43e1e9
cmp dword [esp + 0x128], edi
jae 0x43e156
lea eax, [esp + 0x114]
push 0x4b8d5c
push eax
call fcn.0043fa60
mov eax, dword [esp + 0x154]
add esp, 8
cmp dword [esp + 0x160], edi
jae 0x43e17b
lea eax, [esp + 0x14c]
push 0x4b8e54
push eax
call fcn.0043fa60
add esp, 8
push 0x4b8c84
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x58]
push str._u__s__
push ecx
call fcn.00435340
add esp, 0xc
push eax
lea edx, [esp + 0x16c]
push edx
call fcn.0040cbf0
add esp, 0xc
lea ecx, [esp + 0x50]
call fcn.00402055
cmp dword [esp + 0x17c], edi
mov eax, dword [esp + 0x168]
jae 0x43e1d9
lea eax, [esp + 0x168]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x164]
call fcn.00402055
cmp dword [esp + 0x160], edi
jb 0x43e20e
mov eax, dword [esp + 0x14c]
push eax
call fcn.00479e49
add esp, 4
cmp dword [esp + 0x144], edi
mov esi, 7
mov dword [esp + 0x160], esi
mov dword [esp + 0x15c], ebx
mov word [esp + 0x14c], bx
jb 0x43e242
mov ecx, dword [esp + 0x130]
push ecx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0x198], edi
mov dword [esp + 0x144], esi
mov dword [esp + 0x140], ebx
mov word [esp + 0x130], bx
jb 0x43e271
mov edx, dword [esp + 0x184]
push edx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0x128], edi
mov dword [esp + 0x198], esi
mov dword [esp + 0x194], ebx
mov word [esp + 0x184], bx
jb 0x43e36c
mov eax, dword [esp + 0x114]
push eax
call fcn.00479e49
add esp, 4
jmp 0x43e36c
lea ecx, [esp + 0x28]
push ecx
call fcn.004322d0
mov ecx, dword [eax]
add esp, 4
call fcn.004323f0
lea ecx, [esp + 0x28]
call fcn.0041a9d0
mov edx, dword [ebp + 0x14]
push edx
mov ecx, 0x4d3cd0
call fcn.00435be0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
call fcn.004322d0
mov ecx, dword [eax]
add esp, 4
call fcn.0042eb90
lea ecx, [esp + 0x1c]
call fcn.0041a9d0
call fcn.0042bb30
jmp case.default.0x43dfcc
push 0x2b4
call fcn.00479e4e
add esp, 4
cmp eax, ebx
je 0x43e3fe
mov ecx, eax
call fcn.00454ac0
mov esi, eax
cmp esi, ebx
je 0x43e33d
mov ecx, esi
call fcn.00454f60
mov ecx, esi
call fcn.004559e0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
push ecx
push edx
mov ecx, esi
call fcn.00453700
lea eax, [esp + 0x1b8]
push eax
push esi
call fcn.0043cef0
add esp, 8
cmp esi, ebx
je case.default.0x43dfcc
mov ecx, esi
call fcn.00453170
push esi
call fcn.00479e49
add esp, 4
mov esi, 7
mov edi, 8
cmp dword [esp + 0x1d0], edi
jb 0x43e385
mov ecx, dword [esp + 0x1bc]
push ecx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0x1b4], edi
mov dword [esp + 0x1d0], esi
mov dword [esp + 0x1cc], ebx
mov word [esp + 0x1bc], bx
jb 0x43e3b4
mov edx, dword [esp + 0x1a0]
push edx
call fcn.00479e49
add esp, 4
cmp dword [esp + 0x1ec], edi
mov dword [esp + 0x1b4], esi
mov dword [esp + 0x1b0], ebx
mov word [esp + 0x1a0], bx
jb 0x43e3e3
mov eax, dword [esp + 0x1d8]
push eax
call fcn.00479e49
add esp, 4
mov ecx, dword [esp + 0x404]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00479e10
mov esp, ebp
pop ebp
ret 0x10
xor esi, esi
jmp 0x43e33d