Function at 0x43ff14
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4f
push 0
push 0
dec ecx
jne 0x43ff1c
push ecx
push ebx
push esi
push edi
mov ebx, dword [0x45ac80]
xor eax, eax
push ebp
push 0x440587
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x440598]
push eax
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x1dc]
call fcn.00443cc4
mov ecx, dword [ebp - 0x1dc]
mov eax, dword [ebx + 0x14]
mov edx, 0x4405a4
call fcn.0040dbf8
mov edx, dword [ebp - 0x1d8]
lea eax, [ebx + 0x14]
call fcn.00404e40
mov al, byte [0x440598]
push eax
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x1e4]
call fcn.00443d1c
mov ecx, dword [ebp - 0x1e4]
mov eax, dword [ebx + 0x14]
mov edx, 0x4405b8
call fcn.0040dbf8
mov edx, dword [ebp - 0x1e0]
lea eax, [ebx + 0x14]
call fcn.00404e40
mov al, byte [0x440598]
push eax
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x1ec]
call fcn.00443da8
mov ecx, dword [ebp - 0x1ec]
mov eax, dword [ebx + 0x14]
mov edx, 0x4405cc
call fcn.0040dbf8
mov edx, dword [ebp - 0x1e8]
lea eax, [ebx + 0x14]
call fcn.00404e40
mov al, byte [0x440598]
push eax
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x1f4]
call fcn.00443e08
mov ecx, dword [ebp - 0x1f4]
mov eax, dword [ebx + 0x14]
mov edx, 0x4405e0
call fcn.0040dbf8
mov edx, dword [ebp - 0x1f0]
lea eax, [ebx + 0x14]
call fcn.00404e40
mov eax, dword [0x45b080]
mov eax, dword [eax]
call fcn.00409150
test al, al
je 0x44003b
mov eax, dword [0x45b080]
mov eax, dword [eax]
call fcn.00409368
lea edx, [ebp - 0x1fc]
xor eax, eax
call fcn.00402df4
mov eax, dword [ebp - 0x1fc]
lea edx, [ebp - 0x1f8]
call fcn.004087c8
mov eax, dword [ebp - 0x1f8]
push eax
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x204]
call fcn.004050f8
mov eax, dword [ebp - 0x204]
lea edx, [ebp - 0x200]
call fcn.004087c8
mov edx, dword [ebp - 0x200]
pop eax
call fcn.004051f8
je 0x4403e9
lea edx, [ebp - 0x208]
mov eax, dword [ebx + 0x14]
call fcn.00445ee0
lea edx, [ebp - 0x210]
mov eax, dword [0x45af34]
mov eax, dword [eax]
call fcn.0040942c
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
call fcn.00445ee0
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x214]
call fcn.004050f8
mov eax, dword [ebp - 0x214]
call fcn.00409368
push 0
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x218]
call fcn.004050f8
mov eax, dword [ebp - 0x218]
call fcn.004052ac
push eax
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.00402df4
mov eax, dword [ebp - 0x21c]
call fcn.004052ac
push eax
mov eax, dword [0x45acc4]
mov eax, dword [eax]
call eax
jmp 0x44012b
push 0x14
call sub.kernel32.dll_Sleep_1
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x220]
call fcn.004050f8
mov eax, dword [ebp - 0x220]
call fcn.00444348
test al, al
je 0x440124
push 0
mov eax, dword [0x45af34]
mov eax, dword [eax]
call fcn.004052ac
push eax
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x224]
call fcn.004050f8
mov eax, dword [ebp - 0x224]
call fcn.004052ac
push eax
mov eax, dword [0x45acc4]
mov eax, dword [eax]
call eax
lea eax, [ebp - 4]
mov edx, 0x4405f4
call fcn.00404e84
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.00402df4
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.00409460
lea eax, [ebp - 0x228]
mov edx, 0x440604
call fcn.004050b4
mov eax, dword [ebp - 0x228]
mov edx, dword [ebx + 0x14]
call fcn.004051f8
je 0x440244
lea eax, [ebp - 0x230]
call fcn.00443cc4
lea eax, [ebp - 0x230]
mov edx, dword [ebp - 4]
call fcn.004050b4
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d4]
call fcn.004031c4
lea eax, [ebp - 0x1d4]
call fcn.00402f54
call fcn.00402bb0
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.00402df4
mov eax, dword [ebp - 0x234]
call fcn.004052ac
mov edx, eax
lea eax, [ebp - 0x1d4]
call fcn.00403a94
call fcn.00403ae8
call fcn.00402bb0
lea eax, [ebp - 0x1d4]
call fcn.00403368
call fcn.00402bb0
lea edx, [ebp - 0x238]
mov eax, 0x440610
call fcn.004469b0
mov eax, dword [ebp - 0x238]
call fcn.004485e0
test al, al
je 0x4402a4
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402df4
lea eax, [ebp - 0x23c]
mov edx, 0x44064c
call fcn.004050b4
mov eax, dword [ebp - 0x23c]
call fcn.004052ac
call fcn.0044307c
push 0x384
call sub.kernel32.dll_Sleep_1
call fcn.00445310
jmp 0x44055c
lea eax, [ebp - 0x240]
call fcn.00443da8
mov edx, dword [ebp - 0x240]
mov ecx, dword [ebx + 0x30]
lea eax, [ebp - 8]
call fcn.004050f8
lea edx, [ebp - 0x248]
xor eax, eax
call fcn.00402df4
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00445f28
mov eax, dword [ebx + 0x30]
mov edx, 0x44065c
call fcn.004051f8
je 0x4403e9
mov eax, dword [ebp - 8]
call fcn.00409150
test al, al
jne 0x4403e9
mov edx, dword [ebp - 8]
mov eax, 0x44066c
call fcn.00446198
cmp al, 1
jne 0x4403b8
lea edx, [ebp - 0x24c]
mov eax, 0x440678
call fcn.00446a90
mov eax, dword [ebp - 0x24c]
call fcn.004052ac
push eax
mov eax, dword [0x45ad14]
mov eax, dword [eax]
call fcn.004052ac
push eax
call sub.kernel32.dll_LoadLibraryA
push eax
call fcn.00444bf4
mov edx, dword [0x45affc]
mov dword [edx], eax
lea edx, [ebp - 0x250]
mov eax, 0x4406b8
call fcn.00446a90
mov eax, dword [ebp - 0x250]
call fcn.004052ac
push eax
mov eax, dword [0x45ad14]
mov eax, dword [eax]
call fcn.004052ac
push eax
call sub.kernel32.dll_LoadLibraryA
push eax
call fcn.00444bf4
mov edx, dword [0x45add4]
mov dword [edx], eax
mov eax, dword [ebp - 8]
call fcn.004052ac
mov edi, eax
push edi
mov eax, dword [0x45affc]
mov eax, dword [eax]
call eax
mov esi, eax
or esi, 2
or esi, 1
or esi, 4
push esi
push edi
mov eax, dword [0x45add4]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 8]
call fcn.00409150
test al, al
je 0x4403e9
push 1
push 0x4406f4
push 0x4406f4
mov eax, dword [ebp - 8]
call fcn.004052ac
push eax
push 0x4406f8
push 0
mov eax, dword [0x45ad90]
mov eax, dword [eax]
call eax
lea edx, [ebp - 0x258]
xor eax, eax
call fcn.00402df4
mov eax, dword [ebp - 0x258]
lea edx, [ebp - 0x254]
call fcn.004087c8
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x260]
call fcn.004050f8
mov eax, dword [ebp - 0x260]
lea edx, [ebp - 0x25c]
call fcn.004087c8
mov edx, dword [ebp - 0x25c]
pop eax
call fcn.004051f8
je 0x4404ed
lea edx, [ebp - 0x264]
mov eax, 0x440708
call fcn.004469b0
mov eax, dword [ebp - 0x264]
call fcn.004485e0
cmp al, 1
je 0x440480
lea edx, [ebp - 0x268]
mov eax, 0x44073c
call fcn.004469b0
mov eax, dword [ebp - 0x268]
call fcn.004485e0
cmp al, 1
jne 0x4404ed
push dword [ebx + 0x14]
push dword [ebx + 0x10]
mov eax, dword [0x45ae34]
push dword [eax]
lea eax, [ebp - 0x26c]
mov edx, 3
call fcn.0040516c
mov eax, dword [ebp - 0x26c]
call fcn.004052ac
call fcn.0044307c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x440549
push 0
push dword [ebx + 0x14]
push dword [ebx + 0x10]
mov eax, dword [0x45ae34]
push dword [eax]
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.0040516c
mov eax, dword [ebp - 0x270]
call fcn.004052ac
push eax
call sub.kernel32.dll_WinExec
jmp 0x440549
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push 0x440774
lea eax, [ebp - 0x274]
mov edx, 3
call fcn.0040516c
mov eax, dword [ebp - 0x274]
call fcn.004052ac
call fcn.0044307c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x440549
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x27c]
call fcn.004050f8
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x440774
call fcn.0044489c
push 0x4445c0
push 0x1f4
push 0
push 0
call sub.user32.dll_SetTimer
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44058e
lea eax, [ebp - 0x27c]
mov edx, 0x2a
call fcn.00404e10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e10
ret