Function at 0x43f6e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call fcn.00441c70
cmp eax, 4
jne 0x43f71a
mov eax, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x43f735
mov eax, 3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
call fcn.00441c70
mov dword [ebp - 0x118], eax
cmp eax, 4
je 0x43f78d
cmp eax, 3
je 0x43f78d
lea ecx, [ebp - 0x118]
call fcn.0044a220
test eax, eax
je 0x43f762
cmp dword [ebp - 0x118], 0
jne 0x43f78d
push 0
push 4
lea edx, [ebp - 0x11c]
mov ecx, str.K7SystemMonitor
call fcn.0043b010
add esp, 8
test eax, eax
je 0x43f7c5
mov eax, dword [ebp - 0x11c]
cmp eax, 0xfffffffd
ja 0x43f7bb
je 0x43f78d
sub eax, 1
push ebx
mov ecx, 0x3ed
call fcn.0043a940
add esp, 4
push str.wndClassK7SysMonVer1
push str.wndClassK7SysMonVer1
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x43f8ca
or eax, 0xffffffff
jmp 0x43f8e2
cmp eax, 0xfffffffe
je 0x43f78d
cmp eax, 0xffffffff
jne 0x43f78d
push 0
push str.SoftwareK7_ComputingK7TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x114], 0
call fcn.0045e060
mov esi, eax
test esi, esi
je 0x43f801
push 0x104
lea eax, [ebp - 0x114]
push eax
push str.DirProductBase
push esi
call fcn.0045e550
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.K7SysMon.Exe
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x174], 0x44
push eax
lea eax, [ebp - 0x174]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x114]
movlpd qword [ebp - 0x170], xmm0
push eax
push 0
movlpd qword [ebp - 0x168], xmm0
movlpd qword [ebp - 0x160], xmm0
movlpd qword [ebp - 0x158], xmm0
movlpd qword [ebp - 0x150], xmm0
movlpd qword [ebp - 0x148], xmm0
movlpd qword [ebp - 0x140], xmm0
movlpd qword [ebp - 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x43f8b4
push 0x1d4c0
push dword [ebp - 0x12c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x12c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x43f78d
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
not edi
and edi, 1
push 0
add edi, 0x601
push edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x4b37
je 0x43f8f3
xor eax, eax
jmp 0x43f8f6
movzx eax, ax
add eax, 3
cmp eax, 5
ja case.0x43f8fe.0
jmp dword [eax*4 + 0x43f974]
mov eax, 5
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
mov eax, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
mov eax, 6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 9
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004606ac
mov esp, ebp
pop ebp
ret