Function at 0x43f1f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c021d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4deb90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
push ecx
mov ecx, 0x50bf048
call fcn.00475a40
movzx edx, al
test edx, edx
je case.default.0x43f02c
push 0xffffffffffffffff
mov ecx, 0x50bf048
call fcn.004751a0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x100
jg 0x43f033
cmp dword [ebp - 0x14], 0x100
je 0x43f24d
cmp dword [ebp - 0x14], 7
ja case.default.0x43f02c
mov edx, dword [ebp - 0x14]
jmp dword [edx*4 + 0x43f28c]
cmp dword [ebp - 0x14], 0x101
je 0x43f257
jmp case.default.0x43f02c
mov ecx, 0x51cad30
call fcn.00467ef0
mov ecx, 0x51ca6a0
call fcn.0041cf10
push 1
mov ecx, 0x51ca6a0
call fcn.004642f0
push 0x65
mov ecx, 0x5252170
call fcn.00445e80
push 0x64
mov ecx, 0x5252170
call fcn.00445e80
push 0x6e
mov ecx, 0x5252170
call fcn.00445e80
push 0x66
mov ecx, 0x5252170
call fcn.00445e80
push 0x67
mov ecx, 0x5252170
call fcn.00445e80
push 0x68
mov ecx, 0x5252170
call fcn.00445e80
push 0x70
mov ecx, 0x5252170
call fcn.00445e80
mov ecx, 0x606bd90
call fcn.00448af0
mov ecx, 0x50bf034
call fcn.0046c220
mov ecx, 0x51ca6a0
call fcn.00462ea0
mov ecx, 0x51ca6a0
call fcn.00465210
push 0
mov ecx, 0x7547800
call fcn.00478170
mov ecx, 0x7547800
call fcn.0048fbb0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 3
push 0
push 1
push 8
mov ecx, 0x51ca6a0
call fcn.00460800
push 8
mov ecx, 0x51ca6a0
call fcn.00411440
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, 0x4e0c40
call fcn.0046ca00
mov ecx, 0x606bef8
call fcn.0045df90
mov ecx, dword [ebp - 0x10]
call fcn.0043f500
jmp case.default.0x43f02c
mov ecx, 0x51ca6a0
call fcn.0041cf10
push 1
mov ecx, 0x51ca6a0
call fcn.004642f0
mov ecx, dword [ebp - 0x10]
call fcn.0043f570
jmp case.default.0x43f02c
mov ecx, 0x51ca6a0
call fcn.0041cf10
push 1
mov ecx, 0x51ca6a0
call fcn.004642f0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], 3
push 0
push 1
push 7
mov ecx, 0x51ca6a0
call fcn.00460800
mov ecx, dword [ebp - 0x10]
call fcn.0043f500
jmp case.default.0x43f02c
mov ecx, dword [ebp - 0x10]
call fcn.0043f5a0
jmp case.default.0x43f02c
mov ecx, dword [ebp - 0x10]
call fcn.0043f5d0
jmp case.default.0x43f02c
push 2
push 2
mov ecx, dword [ebp - 0x10]
call fcn.00419f90
movzx edx, al
test edx, edx
jne 0x43f1e5
mov ecx, dword [ebp - 0x10]
call fcn.0043f530
jmp case.default.0x43f02c
mov ecx, dword [ebp - 0x10]
call fcn.0043f600
jmp case.default.0x43f02c
lea ecx, [ebp - 0x28]
call fcn.00497650
mov dword [ebp - 4], 0
mov ecx, 0x51ca6a0
call fcn.00411420
push eax
lea ecx, [ebp - 0x28]
call fcn.00497710
push 0x4d173c
lea ecx, [ebp - 0x28]
call fcn.00497760
push 1
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00411240
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00497690
jmp case.default.0x43f02c
mov ecx, dword [ebp - 0x10]
call fcn.0043f530
jmp case.default.0x43f02c
mov ecx, 0x51cad24
call fcn.00416150
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 1
mov ecx, dword [ebp - 0x10]
call fcn.00415f30
mov ecx, 0x59ca610
call fcn.004597e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret