Function at 0x43af40
Capabilities:
Suspend thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x441004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x60
xor esi, esi
lea eax, [ebp - 0x6c]
push esi
push eax
mov ebx, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x90], esi
lea edi, [esi + 1]
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x84], esi
push dword [ebp + 8]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], 0xa
mov dword [ebp - 0x74], esi
call dword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_DebugActiveProcess]
test eax, eax
jne 0x43b004
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43afb5
movzx esi, si
or esi, 0x80070000
lea edx, [ebp - 0x78]
mov dword [ebp - 0x78], 0
mov ecx, esi
call fcn.00435760
cmp dword [0x441604], 0
je 0x43b621
push 0x42e208
push dword [ebp - 0x78]
push esi
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43b621
push 0x91
jmp 0x43b60b
push 0xffffffffffffffff
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_WaitForDebugEvent]
test eax, eax
je 0x43b5b4
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x70], 0x10002
cmp eax, 8
ja case.0x43b02c.7
jmp dword [eax*4 + 0x43b704]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x70], 0x80010001
cmp eax, 0x80000003
ja 0x43b154
je 0x43b088
cmp eax, 0x40010005
je 0x43b072
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x43b162
cmp dword [0x441604], esi
je case.0x43b02c.7
push 0x42e30c
jmp 0x43b30c
cmp dword [0x441604], esi
je case.0x43b02c.7
push 0x42e37c
jmp 0x43b30c
cmp dword [0x441604], esi
je 0x43b0a1
push 0x42e288
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0xc
cmp dword [ebp - 0x88], esi
je 0x43b14d
lea ecx, [ecx]
mov edi, dword [ebp - 0x90]
test edi, edi
je 0x43b6f7
add edi, 8
cmp dword [0x441604], esi
je 0x43b0dc
push dword [edi]
push 0x42e2bc
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
push dword [edi + 4]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x43b3c3
push edi
mov ecx, ebx
call fcn.0043c1c0
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x43b6f7
mov ecx, dword [eax]
mov dword [ebp - 0x90], ecx
test ecx, ecx
je 0x43b115
mov dword [ecx + 4], esi
jmp 0x43b11b
mov dword [ebp - 0x8c], esi
mov ecx, dword [ebp - 0x80]
mov dword [eax], ecx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x88]
sub eax, 1
mov dword [ebp - 0x88], eax
jne 0x43b145
lea ecx, [ebp - 0x90]
call fcn.00437b30
mov eax, dword [ebp - 0x88]
test eax, eax
jne 0x43b0b0
xor edi, edi
jmp case.0x43b02c.7
cmp eax, 0x80000004
je 0x43b19b
cmp eax, 0xc0000005
je 0x43b185
cmp dword [0x441604], esi
je case.0x43b02c.7
push eax
push 0x42e3a8
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
jmp case.0x43b02c.7
cmp dword [0x441604], esi
je case.0x43b02c.7
push 0x42e250
jmp 0x43b30c
cmp dword [0x441604], esi
je case.0x43b02c.7
push 0x42e348
jmp 0x43b30c
cmp dword [0x441604], esi
je 0x43b1cd
push dword [ebp - 0x64]
push 0x42e3d8
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
push 2
push 0
push 0
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x43b48b
push 2
push 0
push 0
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], esi
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x43b427
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0xa8]
push eax
call fcn.0043c1c0
push dword [ebp - 0x60]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp case.0x43b02c.7
cmp dword [0x441604], esi
je case.0x43b02c.7
push 0x42e508
jmp 0x43b30c
cmp dword [0x441604], esi
je 0x43b286
push dword [ebp - 0x64]
push 0x42e528
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
push 2
push 0
push 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], esi
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x43b4ef
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x9c]
push eax
call fcn.0043c1c0
jmp case.0x43b02c.7
cmp dword [0x441604], esi
je case.0x43b02c.7
push 0x42e5d4
jmp 0x43b30c
cmp dword [0x441604], esi
je case.0x43b02c.7
push 0x42e5f4
jmp 0x43b30c
cmp dword [0x441604], esi
je case.0x43b02c.7
push 0x42e614
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0xc
push dword [ebp - 0x70]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
call dword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_ContinueDebugEvent]
test eax, eax
je 0x43b553
test edi, edi
jne 0x43b004
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x43b345
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [ebp - 0x74]
push dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov dword [ebp - 0x74], esi
call dword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_DebugActiveProcessStop]
test eax, eax
jne 0x43b621
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43b374
movzx esi, si
or esi, 0x80070000
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0
mov ecx, esi
call fcn.00435760
cmp dword [0x441604], 0
je 0x43b621
push 0x42e67c
push dword [ebp - 0x70]
push esi
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43b621
push 0x156
jmp 0x43b60b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43b3d8
movzx esi, si
or esi, 0x80070000
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0
mov ecx, esi
call fcn.00435760
cmp dword [0x441604], 0
je 0x43b621
push 0x42e2dc
push dword [ebp - 0x70]
push esi
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43b621
push 0xb2
jmp 0x43b60b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43b43c
movzx esi, si
or esi, 0x80070000
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0
mov ecx, esi
call fcn.00435760
cmp dword [0x441604], 0
je 0x43b621
push 0x42e488
push dword [ebp - 0x70]
push esi
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43b621
push 0xf7
jmp 0x43b60b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43b4a0
movzx esi, si
or esi, 0x80070000
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0
mov ecx, esi
call fcn.00435760
cmp dword [0x441604], 0
je 0x43b621
push 0x42e408
push dword [ebp - 0x70]
push esi
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43b621
push 0xec
jmp 0x43b60b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43b504
movzx esi, si
or esi, 0x80070000
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0
mov ecx, esi
call fcn.00435760
cmp dword [0x441604], 0
je 0x43b621
push 0x42e558
push dword [ebp - 0x70]
push esi
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43b621
push 0x123
jmp 0x43b60b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43b568
movzx esi, si
or esi, 0x80070000
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0
mov ecx, esi
call fcn.00435760
cmp dword [0x441604], 0
je 0x43b621
push 0x42e628
push dword [ebp - 0x70]
push esi
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43b621
push 0x14f
jmp 0x43b60b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43b5c9
movzx esi, si
or esi, 0x80070000
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0
mov ecx, esi
call fcn.00435760
cmp dword [0x441604], 0
je 0x43b621
push 0x42e224
push dword [ebp - 0x70]
push esi
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43b621
push 0x95
push 0x42e0f4
push 0x42b77c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x14
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x43b636
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x88], 0
je 0x43b6d7
jmp 0x43b650
mov ecx, dword [ebp - 0x90]
test ecx, ecx
je 0x43b6f7
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
mov edx, edi
mov dword [ebp - 0x9c], eax
mov ebx, edi
mov eax, dword [ecx]
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x98], 0
test eax, eax
je 0x43b697
mov dword [eax + 4], 0
jmp 0x43b6a1
mov dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x80]
mov dword [ecx], eax
sub dword [ebp - 0x88], 1
mov dword [ebp - 0x80], ecx
jne 0x43b6bf
lea ecx, [ebp - 0x90]
call fcn.00437b30
mov edx, ebx
test edx, edx
je 0x43b6ca
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp dword [ebp - 0x88], 0
jne 0x43b650
lea ecx, [ebp - 0x90]
call fcn.00437b30
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ffc0
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x80004005
call fcn.00435870
lea ecx, [ecx]
xor esi, dword [eax - 0x4d95ffbd]
inc ebx
add byte [ecx - 0x1effbc4f], dh
mov dl, 0x43
add byte [edx + esi*4 + 0x43], dl
add byte [esi - 0x4e], al
inc ebx
add byte [eax], bl
mov bl, 0x43
add al, dh
mov dl, 0x43
add bh, bh
mov dl, 0x43
add ah, cl
int3