Function at 0x43f8b6
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Enumerate processes on remote desktop session host
Query environment variable
Resolve function by parsing pe exports
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c4
push ebx
push esi
push edi
push 1
mov edi, edx
mov esi, ecx
push 8
push str.Activate
mov ecx, edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x48], esi
call fcn.0043a80d
mov ebx, eax
mov dword [esp + 0x40], ebx
test ebx, ebx
jne 0x43f8f5
mov eax, 0x80004005
jmp 0x4403e0
push ecx
xor eax, eax
mov ecx, ebx
push eax
push str.Rescan
call fcn.0043a719
test eax, eax
je 0x43f93a
mov eax, dword [eax + 4]
test eax, eax
jne 0x43f915
mov eax, 0x491414
push 0x48f7a0
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x43f93a
mov edx, edi
mov ecx, esi
call fcn.00441443
cmp eax, 1
je 0x43f93a
xor eax, eax
jmp 0x4403e0
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x18]
call fcn.0043ac50
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x10], edi
test eax, eax
je 0x43f964
mov dword [eax], edi
mov dword [eax + 4], edi
jmp 0x43fd21
mov eax, dword [esi]
cmp dword [eax + 0x14], edi
je 0x43fd21
push ecx
push edi
push str.Restart
mov ecx, ebx
call fcn.0043a719
test eax, eax
je 0x43fd21
mov eax, dword [eax + 4]
test eax, eax
jne 0x43f991
mov eax, 0x491414
push eax
lea ecx, [esp + 0x18]
call fcn.0043b8b2
push edi
push 0x7c
lea ecx, [esp + 0x1c]
call fcn.0043ba25
push edi
lea ecx, [esp + 0x18]
call fcn.0043b93f
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x10]
call fcn.0043ac50
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov esi, edi
cmp word [edi], bx
je 0x43fa12
push str.Explorer
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x43fa81
push 0x4990a8
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x10]
call fcn.0043b9f9
push 0x2c
lea ecx, [esp + 0x10]
call fcn.0043b93f
mov ecx, esi
call fcn.0044bc8f
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], bx
jne 0x43f9cd
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0xc]
mov eax, dword [esi - 0xc]
dec eax
push eax
call fcn.0043c894
push esi
push 0x4990b4
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00449eea
add esp, 0xc
mov ebx, eax
push 0x31
push 0x486080
call sym.Dismx86.exe_DismMultiLanguage
push eax
mov eax, dword [0x4ab214]
push dword [ebx]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add ecx, 0xfffffff0
call fcn.0043c924
cmp ebx, 1
je 0x43fa8a
mov ebx, 0x4c7
lea ecx, [esi - 0x10]
call fcn.0043c924
jmp 0x4403cd
mov esi, dword [esp + 0xc]
push 0xb
pop ebx
jmp 0x43fa74
or dword [esp + 0x54], 0xffffffff
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0x20
xor ebx, ebx
pop ecx
mov dword [esp + 0x24], ebx
call fcn.00436b3a
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esp + 0x20], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
push eax
push 1
push ebx
push ebx
mov dword [esp + 0x48], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x43fb81
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x43fb77
mov esi, ebx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebx + edx]
cmp eax, dword [esp + 0x54]
jne 0x43fb6b
mov eax, dword [ebx + edx + 8]
test eax, eax
je 0x43fb6b
push eax
lea ecx, [esp + 0x34]
call fcn.0043b487
mov ecx, eax
call fcn.004389ee
mov ecx, dword [esp + 0x1c]
add ecx, 4
add ecx, ebx
push eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x28]
call fcn.00442222
mov ecx, dword [eax]
mov eax, dword [esp + 0x18]
add ecx, 0x14
mov edx, dword [ecx + 4]
cmp edx, dword [ecx + 8]
je 0x43fb54
mov eax, dword [eax]
mov dword [edx], eax
add dword [ecx + 4], 4
jmp 0x43fb5b
push eax
push edx
call fcn.004357ba
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x34]
inc esi
add ebx, 0x10
cmp esi, ecx
jb 0x43faf3
mov esi, dword [esp + 0xc]
push dword [esp + 0x38]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
xor eax, eax
mov ebx, edi
mov dword [esp + 0x18], ebx
cmp word [edi], ax
je 0x43fcf6
xor esi, esi
push str.Explorer
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x43fcd8
push str.explorer.exe
lea ecx, [esp + 0x34]
call fcn.0043b487
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x28]
call fcn.00442499
mov edi, dword [esp + 0x78]
cmp byte [edi + 0xd], 0
jne 0x43fbe3
push dword [edi + 0x10]
lea ecx, [esp + 0x34]
call fcn.00431dfc
test eax, eax
jns 0x43fbe7
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.0043c924
cmp edi, dword [esp + 0x20]
je 0x43fc9e
mov eax, dword [edi + 0x18]
mov ebx, dword [edi + 0x14]
mov dword [esp + 0x48], eax
cmp ebx, eax
je 0x43fc9a
push dword [ebx]
push esi
cmp dword [esp + 0x34], esi
jne 0x43fc60
push 0x100403
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x43fc8d
lea eax, [esp + 0x1c]
push eax
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43fc6d
lea eax, [esp + 0x2c]
push eax
push 1
push 2
push esi
push 0xf01ff
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43fc6d
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x43fc8d
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
cmp ebx, dword [esp + 0x48]
jne 0x43fc0f
mov ebx, dword [esp + 0x18]
push 0x208
lea eax, [esp + 0xcc]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0xc8]
push 0x104
push eax
push str._userprofile_AppDataLocaliconcache.db
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0xc8]
call fcn.0044c507
mov ecx, ebx
call fcn.0044bc8f
lea ebx, [ebx + eax*2]
add ebx, 2
mov dword [esp + 0x18], ebx
cmp word [ebx], si
jne 0x43fb94
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
push dword [eax + 4]
lea eax, [esp + 0x24]
push eax
mov ecx, eax
call fcn.004424ea
mov ecx, dword [esp + 0x20]
push 0x20
pop edx
call fcn.0043a508
lea ecx, [esi - 0x10]
call fcn.0043c924
mov ebx, dword [esp + 0x40]
mov eax, dword [ebp + 0x10]
lea edi, [esp + 0x60]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x5c], eax
xor eax, eax
mov dword [esp + 0x58], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ecx, ecx
je 0x43fd9f
mov esi, dword [ebx + 0x1c]
test esi, esi
je 0x43fd8a
xor ebx, ebx
cmp dword [esi + 0x18], 1
jne 0x43fd7f
push ecx
push ebx
push str.Work
mov ecx, esi
call fcn.0043a719
test eax, eax
je 0x43fd78
mov eax, dword [eax + 4]
test eax, eax
jne 0x43fd69
mov eax, 0x491414
push 0xa
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
jmp 0x43fd7b
xor eax, eax
inc eax
add dword [esp + 0x60], eax
mov esi, dword [esi + 0x30]
test esi, esi
jne 0x43fd45
mov ebx, dword [esp + 0x40]
cmp dword [esp + 0x60], 0
je 0x43fd9f
lea eax, [esp + 0x58]
mov dword [ebp + 0xc], 0x4403f0
mov dword [ebp + 0x10], eax
mov esi, dword [esp + 0x3c]
mov edi, dword [ebx + 0x1c]
mov eax, dword [esi]
mov dword [esp + 0xc], eax
test edi, edi
je 0x440255
mov ebx, dword [esp + 0x10]
cmp dword [edi + 0x18], 1
jne 0x44024a
push ecx
push 2
push 0x499160
mov ecx, edi
call fcn.0043a719
test eax, eax
je 0x43fe13
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x43fde1
mov eax, dword [eax + 0xc]
jmp 0x43fde3
xor eax, eax
test ecx, ecx
jne 0x43fdec
mov ecx, 0x491414
push 1
push eax
push ecx
mov ecx, dword [esp + 0x78]
call fcn.0043a80d
test eax, eax
je 0x4403e7
mov edx, eax
mov ecx, esi
call fcn.00441410
cmp eax, 1
jne 0x440242
push ecx
xor esi, esi
mov ecx, edi
push esi
push str.Work
call fcn.0043a719
test eax, eax
je 0x43fe46
mov eax, dword [eax + 4]
test eax, eax
jne 0x43fe33
mov eax, 0x491414
push 0xa
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x68], eax
jmp 0x43fe4e
mov dword [esp + 0x68], 1
cmp dword [edi], esi
je 0x43fe56
mov esi, dword [edi]
jmp 0x43fe5b
mov esi, 0x491414
je 0x43fe62
mov eax, dword [edi + 8]
jmp 0x43fe64
xor eax, eax
sub eax, 6
je 0x440184
sub eax, 1
je 0x44009d
sub eax, 1
je 0x440041
sub eax, 1
je 0x43ffb9
sub eax, 1
je 0x43ff89
sub eax, 4
je 0x43ff5c
sub eax, 1
jne 0x4401dd
push 0xf
mov edx, str.SetServiceStart
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x43ff2f
cmp dword [ebp + 8], eax
jne 0x4401e6
push ecx
xor ebx, ebx
mov ecx, edi
push ebx
push str.Name
call fcn.0043a719
mov esi, eax
test esi, esi
jne 0x43fee6
mov dword [esp + 0x10], 0x80004005
mov ebx, dword [esp + 0x10]
jmp 0x4401ea
push ecx
push ebx
push 0x48f600
mov ecx, edi
call fcn.0043a719
test eax, eax
je 0x43fed5
mov eax, dword [eax + 4]
test eax, eax
jne 0x43ff04
mov eax, 0x491414
mov esi, dword [esi + 4]
test esi, esi
jne 0x43ff10
mov esi, 0x491414
push 0xa
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
push eax
push esi
push dword [esp + 0x14]
call sym.Dismx86.exe_DismSetServiceStart
mov ebx, eax
jmp 0x4401e2
push 0xf
mov edx, str.FileCreateByZIP
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x4401dd
cmp dword [ebp + 8], eax
jne 0x4401e6
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.0043f635
jmp 0x43ff28
push 0xe
mov edx, str.ExplorerNotify
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x4401dd
cmp dword [ebp + 8], eax
jne 0x4401e6
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.0043d866
jmp 0x43ff28
push 9
mov edx, str.AddPackage
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x4401e6
cmp dword [ebp + 8], eax
jne 0x4401e6
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.0043f118
jmp 0x43ff28
push 9
mov edx, str.RegDelete
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x43ffe5
cmp dword [ebp + 8], eax
jne 0x4401e6
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.0043d4cd
jmp 0x43ff28
push 9
mov edx, str.ImportReg
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x440011
cmp dword [ebp + 8], eax
jne 0x4401e6
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.0043f01b
jmp 0x43ff28
push 9
mov edx, str.AddDriver
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x4401e6
cmp dword [ebp + 8], eax
jne 0x4401e6
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.0043f386
jmp 0x43ff28
push 8
mov edx, str.RegWrite
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x44006d
cmp dword [ebp + 8], eax
jne 0x4401e6
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.0043ccbf
jmp 0x43ff28
push 8
mov edx, str.FileMove
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x4401dd
cmp dword [ebp + 8], eax
jne 0x4401e6
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.0043f4e9
jmp 0x43ff28
push 7
mov edx, str.General
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x4400fe
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x20]
push dword [ebp + 0x10]
mov dword [esp + 0x24], eax
mov edx, edi
push dword [ebp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, esi
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.0043e91b
mov ebx, eax
mov dword [esp + 0x10], ebx
test esi, esi
je 0x4401e6
test ebx, ebx
jne 0x4401ea
mov eax, dword [esp + 0x20]
add dword [esi], eax
mov eax, dword [esp + 0x24]
jmp 0x4401d8
push 7
mov edx, str.RegMove
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x44012a
cmp dword [ebp + 8], eax
jne 0x4401e6
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.0043d5db
jmp 0x43ff28
push 7
mov edx, str.CScript
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x4401dd
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x48]
push dword [ebp + 0x10]
mov dword [esp + 0x4c], eax
mov edx, edi
push dword [ebp + 0xc]
mov dword [esp + 0x54], eax
mov eax, esi
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.0043e899
mov ebx, eax
mov dword [esp + 0x10], ebx
test esi, esi
je 0x4401e6
test ebx, ebx
jne 0x4401ea
mov eax, dword [esp + 0x48]
add dword [esi], eax
mov eax, dword [esp + 0x4c]
jmp 0x4401d8
push 6
mov edx, str.Custom
mov ecx, esi
call fcn.00442f8e
pop ecx
test eax, eax
jne 0x4401dd
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x40]
push dword [ebp + 0x10]
mov dword [esp + 0x44], eax
mov edx, edi
push dword [ebp + 0xc]
mov dword [esp + 0x4c], eax
mov eax, esi
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.0043ef3c
mov ebx, eax
mov dword [esp + 0x10], ebx
test esi, esi
je 0x4401e6
test ebx, ebx
jne 0x4401ea
mov eax, dword [esp + 0x40]
add dword [esi], eax
mov eax, dword [esp + 0x44]
adc dword [esi + 4], eax
jmp 0x4401e6
mov ebx, 0x80004002
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x44023e
push ecx
push 9
push str.SkipError
mov ecx, edi
call fcn.0043a719
test eax, eax
je 0x440255
mov eax, dword [eax + 4]
test eax, eax
jne 0x440209
mov eax, 0x491414
xor esi, esi
jmp 0x440229
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
cmp eax, ebx
je 0x440234
mov eax, dword [esp + 0x18]
add eax, 2
mov dword [esp + 0x18], eax
cmp word [eax], si
jne 0x44020d
jmp 0x44023a
mov ebx, esi
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x440257
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x68]
add dword [esp + 0x64], eax
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x43fdb8
xor esi, esi
mov edi, dword [esp + 0x14]
mov ebx, edi
cmp word [edi], si
je 0x4403c9
push str.Explorer
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4403b3
push 0x104
lea eax, [esp + 0xcc]
push eax
push str.__SystemRoot_explorer.exe_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x40
lea eax, [esp + 0x88]
mov dword [esp + 0x84], 0x44
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0xac], 1
mov dword [esp + 0xc], esi
push 5
pop eax
push esi
push dword [esp + 0x30]
mov word [esp + 0xb8], ax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
or dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x14]
push eax
push ecx
push ecx
call fcn.0043ca5b
mov esi, eax
test esi, esi
je 0x44030f
mov ecx, dword [esp + 0x14]
call fcn.0043c93c
mov esi, eax
test esi, esi
je 0x44030f
push dword [esp + 0x14]
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov esi, eax
cmp dword [esp + 0x14], 0xffffffff
je 0x440320
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x44035f
lea eax, [esp + 0x70]
xor ecx, ecx
push eax
lea eax, [esp + 0x84]
push eax
push ecx
push dword [esp + 0x18]
lea eax, [esp + 0xd8]
push 0x400
push ecx
push ecx
push ecx
push eax
push ecx
push dword [esp + 0x54]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test esi, esi
jne 0x44038e
lea eax, [esp + 0x70]
xor esi, esi
push eax
lea eax, [esp + 0x84]
push eax
push esi
push dword [esp + 0x18]
lea eax, [esp + 0xd8]
push 0x400
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4403a2
push dword [esp + 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x74]
call esi
xor esi, esi
cmp dword [esp + 0xc], 0
je 0x4403b3
push dword [esp + 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, ebx
call fcn.0044bc8f
lea ebx, [ebx + eax*2]
add ebx, 2
cmp word [ebx], si
jne 0x440266
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
call fcn.004387e2
lea ecx, [edi - 0x10]
call fcn.0043c924
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x14]
push 0xb
pop ebx
jmp 0x4403cd