Function at 0x43a8d6
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x214], edx
xor edi, edi
mov word [ebp - 0x210], ax
push 0x206
lea eax, [ebp - 0x20e]
mov dword [ebp - 0x218], ecx
push edi
push eax
mov esi, edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x270], edi
lea eax, [ebp - 0x26c]
mov ebx, edi
push 0x40
push edi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x228], edi
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x43a975
test dword [eax + 0x1c], 0x100
je 0x43a975
cmp byte [eax + 0x19], 5
jb 0x43a975
push dword [eax + 0x14]
mov edx, 0x40d33c
push dword [eax + 0x10]
push 0x31
pop ecx
call fcn.00414ca8
push 0x20019
push 0
mov edx, 0x40d2a8
mov ecx, SysReAllocString
call fcn.0041be9e
mov edi, eax
test edi, edi
jne 0x43a9d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x43abc1
test dword [ecx + 0x1c], 0x100
je 0x43abc1
cmp byte [ecx + 0x19], 2
jb 0x43abc1
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x32
jmp 0x43ab9c
push ecx
push 0
xor edx, edx
mov ecx, edi
push 0
inc edx
call fcn.0041bf3f
mov ebx, eax
test ebx, ebx
jne 0x43aa72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x43aa20
test dword [eax + 0x1c], 0x100
je 0x43aa20
cmp byte [eax + 0x19], 2
jb 0x43aa20
push esi
push dword [eax + 0x14]
mov edx, 0x40d33c
push dword [eax + 0x10]
push 0x33
pop ecx
call fcn.00414ccb
push ecx
push 0
push 0
push 2
pop edx
mov ecx, edi
call fcn.0041bf3f
mov ebx, eax
test ebx, ebx
jne 0x43aa72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x43abc1
test dword [eax + 0x1c], 0x100
je 0x43abc1
cmp byte [eax + 0x19], 2
jb 0x43abc1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x34
jmp 0x43ab9c
push 0x40d2f8
push ebx
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x43aabe
mov esi, 0x65b
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x43abc1
test dword [eax + 0x1c], 0x100
je 0x43abc1
cmp byte [eax + 0x19], 2
jb 0x43abc1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x35
jmp 0x43ab9c
push dword [ebp - 0x218]
xor ecx, ecx
push dword [ebp - 0x214]
mov word [eax], cx
lea eax, [ebp - 0x210]
push ebx
push 0x40d304
push 0x104
push eax
call fcn.00416647
add esp, 0x18
test eax, eax
jns 0x43ab34
mov ecx, eax
movzx esi, ax
and ecx, 0x1fff0000
cmp ecx, 0x70000
je 0x43ab02
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x43abc1
test dword [eax + 0x1c], 0x100
je 0x43abc1
cmp byte [eax + 0x19], 2
jb 0x43abc1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x36
jmp 0x43ab9c
push 9
pop eax
mov word [ebp - 0x240], ax
xor ecx, ecx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x270], 0x44
push eax
lea eax, [ebp - 0x270]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x210]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x43aba9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x43abc1
test dword [eax + 0x1c], 0x100
je 0x43abc1
cmp byte [eax + 0x19], 2
jb 0x43abc1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x37
mov edx, 0x40d33c
pop ecx
call fcn.00414ccb
jmp 0x43abc1
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.0041c919
test edi, edi
je 0x43abd3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret