Function at 0x43b73c
Capabilities:
Create process on windows
Set environment variable
Terminate process

Disassembly:
push 0xa4
mov eax, 0x4edd0e
call fcn.004d2094
xor esi, esi
push 0x40
lea eax, [ebp - 0xac]
push esi
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0xb0], esi
call fcn.004cc1d0
xor eax, eax
mov dword [ebp - 0x68], esi
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
cmp dword [ebp + 0x18], esi
jne 0x43b782
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], eax
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
call fcn.00424eef
lea eax, [ebp - 0x10]
push eax
call fcn.004782a0
mov eax, dword [eax]
push 0x507f2c
push eax
call fcn.004cb335
mov ecx, dword [ebp - 0x10]
add esp, 0x10
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042201a
test bl, bl
je 0x43b824
call fcn.004bc4b7
push eax
lea ecx, [ebp - 0x10]
call fcn.0042636f
mov byte [ebp - 4], 3
call fcn.004bc4b7
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042636f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
push ecx
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 4
lea ebx, [ebp - 0x10]
call fcn.00424eef
call fcn.004a7c80
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042201a
xor esi, esi
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push dword [ebp + 0x10]
push dword [ebp + 8]
push str.ExecInject__s__s__
push eax
call fcn.00478210
add esp, 0x10
call fcn.0043b6e5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb0], 0x44
pop ecx
mov ecx, 0x507f5c
cmp dword [eax - 0xc], esi
jne 0x43b860
mov ecx, 0x50007c
push eax
push ecx
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0x507f60
push eax
call fcn.00478210
add esp, 0x14
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xb0]
push eax
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
push esi
push esi
push esi
push esi
push esi
mov byte [ebp - 4], 5
call fcn.00424f8a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00424af8
cmp edi, esi
je 0x43b922
test byte [ebp + 0x1c], 1
je 0x43b8ec
push 0xffffffffffffffff
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x53f3dc
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push ecx
mov eax, esp
mov dword [ebp + 0x18], esp
push dword [0x53f3dc]
push str.ExecInject:_ExecWait__CreateProcess_:_g_LoaderExitCode_d
push eax
call fcn.00478210
add esp, 0xc
call fcn.0043b6e5
pop ecx
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, esi
jmp 0x43bad5
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
push str.ExecInject__s__s__:_CreateProcess_failed__LE_d._Checking_for_ShellExec___Elevation_requirements
push ecx
call fcn.00478210
add esp, 0x14
call fcn.0043b6e5
pop ecx
call edi
mov ebx, dword [ebp + 0x18]
mov dword [ebx], eax
cmp eax, 0xc1
jne 0x43b9fc
push 0x38
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004cc1d0
add esp, 0xc
test byte [ebp + 0x1c], 2
mov dword [ebp - 0x4c], str.open
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], esi
je 0x43b98a
mov dword [ebp - 0x54], 0x400
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
xor ebx, ebx
lea eax, [ebp - 0x58]
inc ebx
push eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x43b8ef
test byte [ebp + 0x1c], bl
je 0x43b9f5
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x53f3dc
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push ecx
mov eax, esp
mov dword [ebp + 0x18], esp
push dword [0x53f3dc]
push str.ExecInject:_ExecWait__ShellExecInfo_:_g_LoaderExitCode_d
push eax
call fcn.00478210
add esp, 0xc
call fcn.0043b6e5
pop ecx
mov esi, ebx
jmp 0x43b8ef
cmp eax, 0x2e4
je 0x43ba13
cmp eax, 0x4c7
je 0x43ba13
call edi
mov dword [ebx], eax
jmp 0x43b8ef
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00476ed0
test eax, eax
je 0x43ba34
push str.RunAsAdmin
push str.__COMPAT_LAYER
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x38
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004cc1d0
add esp, 0xc
push dword [ebp + 8]
mov dword [ebp - 0x4c], str.runas
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
call fcn.004cbcc0
pop ecx
push dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
call fcn.004cbcc0
pop ecx
push dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
call fcn.004cbcc0
pop ecx
push 6
push esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x43baa3
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call edi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebx], eax
call fcn.0042201a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0042201a
xor eax, eax
call fcn.004d216c
ret