Function at 0x43a750
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push ebx
xor eax, eax
push ebp
mov dword [esp + 0x10], eax
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x20], eax
mov ecx, 0x11
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], eax
mov eax, str.Ati2evxx.exe__CFPnP
mov dword [esp + 0x10], 0
mov dword [esp + 0x28], 0x44
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a790
mov ebp, dword [esp + 0x70]
sub eax, edx
mov edi, eax
mov eax, dword [ebp + 4]
add edi, 0xa
xor esi, esi
test al, 0x10
je 0x43a7c1
movzx eax, byte [ebp + 0x11]
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
mov esi, 0x10
add eax, ecx
jmp 0x43a7df
test al, 2
je 0x43a7d3
mov edx, dword [ebp + 0x10]
mov esi, 2
mov dword [esp + 0x10], edx
jmp 0x43a7e3
test al, 1
je 0x43a7e3
mov eax, dword [ebp + 0x10]
mov esi, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x43a7f1
lea ecx, [eax + eax*2]
lea edi, [edi + ecx*4]
push edi
call fcn.0045f1c6
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x43a815
push str.CeateRestartProcess:_failed_to_create_memory_n
call fcn.0040a4a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, str.Ati2evxx.exe__CFPnP
mov edx, ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43a832
mov eax, str.Ati2evxx.exe__CFPnP
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a844
sub eax, edx
push esi
add eax, ebx
push 0x484124
push eax
call fcn.0045f139
mov eax, ebx
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a863
mov ecx, dword [ebp + 0x10]
push ecx
sub eax, esi
add eax, ebx
push 0x484124
push eax
call fcn.0045f139
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a885
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x43a914
lea esi, [ebp + 0x18]
mov ebp, eax
lea ecx, [ecx]
xor ecx, ecx
mov ch, byte [esi + 4]
xor edx, edx
mov eax, edx
mov dword [esp + 0x14], edx
mov edx, dword [esi - 4]
and edx, 0xff
and eax, 0xff000000
mov cl, byte [esi]
shl ecx, 8
or ecx, edx
or ecx, eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x43a8d1
or ecx, 0x1000000
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
and eax, 1
shl eax, 4
and edx, 0xf
or eax, edx
shl eax, 0x19
and ecx, 0xc1ffffff
or eax, ecx
push eax
push 0x484124
add edi, ebx
push edi
call fcn.0045f139
mov eax, ebx
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a903
sub eax, edi
add esi, 0x18
dec ebp
mov edi, eax
jne 0x43a8a0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x43a969
push str.CreateRestartProcess:_create_restart_process_n
call fcn.0040a4a0
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
push ebx
call fcn.0045eab0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
push str.CeateRestartProcess:_failed_to_create_process_n
call fcn.0040a4a0
add esp, 4
push ebx
call fcn.0045eab0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret