Function at 0x43cb10
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1a0
mov esi, esp
mov dword [esi + 0x188], ebp
mov dword [esi + 0x18c], esp
mov dword [esi + 0x198], 0xffffffff
mov dword [esi + 0x194], 0x4c2e00
mov edi, ecx
lea eax, [esi + 0x190]
mov ecx, dword fs:[0]
mov dword [esi + 0x190], ecx
mov dword fs:[0], eax
mov eax, dword [edi + 0x18]
inc eax
cmp eax, 2
mov dword [esi + 0x58], eax
jae 0x43cbf9
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x2c], eax
push dword [ebp + 8]
call fcn.005d8724
add esp, 4
mov ecx, dword [edi + 0x30]
mov dword [esi + 8], edi
mov dword [edi + 0x30], eax
test ecx, ecx
je 0x43cb93
push ecx
call fcn.005d31b1
add esp, 4
push dword [ebp + 0xc]
call fcn.005d8724
add esp, 4
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x48], 0
mov eax, dword [0x6d1ebc]
setne dl
test eax, eax
je 0x43cc11
mov dword [esi + 0xc], eax
add eax, 8
mov byte [esi + 0x34], dl
mov dword [esi + 0x198], 9
mov dword [esi + 0x10], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0xc]
mov al, byte [eax + 0x50]
mov dword [esi + 0x198], 0
mov byte [esi + 0xc], al
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [esi + 0xc], 0
mov dl, byte [esi + 0x34]
setne cl
jmp 0x43cc13
call fcn.00406c70
mov ecx, 2
cmp eax, 5
jge 0x43cb6c
jmp 0x43d6b0
xor ecx, ecx
xor eax, eax
mov al, dl
mov dword [esi + 0x60], ecx
shl eax, 0x13
or eax, 0x40c
test cl, cl
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x20]
mov dword [esi + 0x198], 9
jne 0x43cc54
test eax, eax
je 0x43cc54
call fcn.00406c70
mov edx, dword [esi + 0xc]
cmp eax, 5
lea ecx, [edx + 0x1000000]
cmovl edx, ecx
mov dword [esi + 0xc], edx
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [esi + 0x6c]
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0x6c], 0x44
mov dword [esi + 0x198], 0xa
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [esi + 0x98], 1
je 0x43ce15
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
or byte [eax + 0x30], 1
test edi, edi
je 0x43cd31
push edi
call fcn.005d3244
add esp, 4
jmp 0x43cd33
xor eax, eax
lea ecx, [esi + 0xc8]
push eax
push edi
push ecx
call fcn.00497650
add esp, 0xc
push 0x65ca6f
call fcn.006289d0
add esp, 4
mov dword [esi + 0x198], 0x16
lea edx, [esi + 0x14]
lea ecx, [esi + 0xc8]
push eax
push 0x65ca6f
push edx
call fcn.00408470
push 0x65b8f6
call fcn.006289d0
add esp, 4
mov edi, dword [esi + 0x28]
cmp dword [esi + 0x24], eax
jne 0x43cdab
cmp edi, 0xf
lea ecx, [esi + 0x14]
jbe 0x43cd90
mov ecx, dword [esi + 0x14]
push eax
push 0x65b8f6
push ecx
call fcn.005d5792
add esp, 0xc
test eax, eax
sete bl
cmp edi, 0x10
jae 0x43cdb2
jmp 0x43cde2
xor ebx, ebx
cmp edi, 0x10
jb 0x43cde2
mov eax, dword [esi + 0x14]
lea ecx, [edi + 1]
cmp ecx, 0x1000
jb 0x43cdd8
mov edx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, edx
cmp eax, 0x20
jae 0x43d6c8
add edi, 0x24
mov eax, edx
mov ecx, edi
push ecx
push eax
call fcn.005d319e
add esp, 8
lea ecx, [esi + 0xc8]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xf
mov byte [esi + 0x14], 0
call fcn.00473320
test bl, bl
jne 0x43ce0c
movzx eax, word [esi + 0x9c]
jmp 0x43ce0e
xor eax, eax
mov ecx, dword [ebp + 0x14]
mov word [ecx + 0x34], ax
cmp byte [0x6ceef8], 0
mov ecx, dword [0x6cef04]
mov edi, dword [esi + 0xc]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x198], 0xa
setne dh
test ecx, ecx
mov ebx, edi
setne dl
or ebx, 0x400
xor eax, eax
test dh, dl
cmovne eax, ecx
cmove ebx, edi
mov dword [esi + 0x64], eax
lea eax, [esi + 0x48]
mov dword [esi + 0x34], ebx
push eax
call fcn.0043db70
add esp, 4
test al, al
je 0x43ced9
cmp word [esi + 0x98], 0
jns 0x43ce85
mov eax, dword [ebp + 0x14]
or byte [eax + 0x31], 0x80
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x10]
mov dword [ecx + 0x10], 0
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x43ceb2
test eax, eax
je 0x43cfea
call fcn.0040e440
mov eax, dword [esi + 0xc]
test eax, eax
je 0x43cfe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0xc], 0xffffffff
je 0x43cfd3
mov dword [esi + 0x10], eax
call fcn.0040e440
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43cfea
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x43cfb8
mov dword [esi + 8], 0x3c
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x43cfc4
lea ecx, [esi + 0xc8]
push 0
push 0x153
push str.win_src_target_process.cc
call fcn.0041f9f0
lea eax, [esi + 0xd8]
mov dword [esi + 0x198], 0xb
push str.security_descriptor___error:
push eax
call fcn.005df800
add esp, 8
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x14]
push eax
push str.0x_X
push ecx
call fcn.0043b100
add esp, 0xc
lea eax, [esi + 0x14]
mov dword [esi + 0x198], 0xc
push eax
push dword [esi + 0xc]
call fcn.004a29e0
add esp, 8
mov ecx, dword [esi + 0x28]
cmp ecx, 8
jb 0x43cfa8
mov eax, dword [esi + 0x14]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x43cf9e
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x43d6d7
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
lea ecx, [esi + 0xc8]
call fcn.00424810
jmp 0x43d68b
mov dword [esi + 8], 0x3c
jmp 0x43d68b
push 0
call fcn.00410ec0
add esp, 4
jmp 0x43d68b
mov dword [esi + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43cfea
mov dword [esi + 0xc], 0
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x18], 0
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
je 0x43d019
test eax, eax
je 0x43d05a
mov dword [esi + 0x198], 0xd
call fcn.0040e440
mov eax, dword [esi + 0x10]
test eax, eax
je 0x43d053
mov dword [esi + 0x198], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x10], 0xffffffff
je 0x43d043
mov dword [esi + 0x5c], eax
call fcn.0040e440
mov eax, dword [esi + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43d05a
mov dword [esi + 0x10], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43d05a
mov dword [esi + 0x10], 0
mov al, byte [ebp + 0x10]
add dword [esi + 0x2c], 4
cmp dword [esi + 0x58], 2
xorps xmm0, xmm0
movaps xmmword [esi + 0xb0], xmm0
movzx eax, al
jae 0x43d083
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x198], 0xe
jmp 0x43d09a
xor ecx, ecx
cmp byte [0x6cef19], 0
mov dword [esi + 0x198], 0xe
cmovne ecx, dword [esi + 0x10]
lea edx, [esi + 0xb0]
push edx
push dword [esi + 0x2c]
push 0
push dword [esi + 0x64]
push dword [esi + 0x34]
push eax
lea eax, [esi + 0x48]
push eax
push eax
push dword [esi + 0x30]
push dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x43d1ad
lea eax, [esi + 0xb0]
lea ecx, [esi + 0x38]
push eax
call fcn.0043df50
mov eax, dword [esi + 8]
cmp dword [eax + 0x20], 0
je 0x43d127
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x43d0fe
mov dword [esi + 0x198], 0x11
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 0x4c], 0
cmp byte [esi + 0x60], 0
jne 0x43d127
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x38]
mov ecx, dword [ecx + 0x20]
mov dword [esi + 0x198], 0x11
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x43d368
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x43d2a7
cmp byte [0x6cef19], 0
jne 0x43d14c
cmp dword [esi + 0x58], 2
jae 0x43d518
mov ecx, dword [ebp + 0x18]
lea eax, [esi + 0x38]
mov dword [esi + 0x198], 0x11
push eax
call fcn.0043e170
test al, al
je 0x43d285
push dword [esi + 0x38]
call fcn.0043e2d0
add esp, 4
mov ecx, dword [esi + 8]
test eax, eax
mov dword [ecx + 0x2c], eax
je 0x43d346
lea eax, [esi + 0xc8]
lea ecx, [esi + 0x38]
push eax
call fcn.0043e430
mov ecx, dword [esi + 8]
lea eax, [esi + 0xc8]
push eax
call fcn.0043e030
mov dword [esi + 8], 0
jmp 0x43d643
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x43d306
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x43d2fc
lea ecx, [esi + 0xc8]
push 0
push 0x182
push str.win_src_target_process.cc
call fcn.0041f9f0
lea eax, [esi + 0xd8]
mov dword [esi + 0x198], 0xf
push str.CreateProcessAsUserW_failed_to_create_sandbox_process___error:
push eax
call fcn.005df800
add esp, 8
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x14]
push eax
push str.0x_X
push ecx
call fcn.0043b100
add esp, 0xc
lea eax, [esi + 0x14]
mov dword [esi + 0x198], 0x10
push eax
push dword [esi + 8]
call fcn.004a29e0
add esp, 8
mov ecx, dword [esi + 0x28]
cmp ecx, 8
jb 0x43d275
mov eax, dword [esi + 0x14]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x43d26b
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x43d6e6
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
lea ecx, [esi + 0xc8]
call fcn.00424810
jmp 0x43d306
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 8], 0x17
mov dword [ecx], eax
push 0
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x43d643
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x198], 0x11
mov dword [esi + 0x68], ecx
lea ecx, [esi + 0x68]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x43d440
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
inc eax
cmp eax, 2
jb 0x43d139
call fcn.0040e440
mov eax, dword [esi + 8]
push dword [eax + 0x14]
call fcn.0040f9e0
add esp, 4
mov eax, dword [esi + 8]
mov dword [eax + 0x14], 0
jmp 0x43d139
push 0
call fcn.00410ec0
add esp, 4
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x198], 0xe
test eax, eax
je 0x43d325
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 8], 0x12
mov dword [ecx], eax
cmp dword [esi + 0x10], 0
jne 0x43d651
jmp 0x43d66b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 8], 0x2b
mov dword [ecx], eax
push 0
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x43d643
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x43d5e9
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x43d5df
lea ecx, [esi + 0xc8]
push 0
push 0x199
push str.win_src_target_process.cc
call fcn.0041f9f0
lea eax, [esi + 0xd8]
mov dword [esi + 0x198], 0x14
push str.job_object___error:
push eax
call fcn.005df800
add esp, 8
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x14]
push eax
push str.0x_X
push ecx
call fcn.0043b100
add esp, 0xc
lea eax, [esi + 0x14]
mov dword [esi + 0x198], 0x15
push eax
push dword [esi + 8]
call fcn.004a29e0
add esp, 8
mov ecx, dword [esi + 0x28]
cmp ecx, 8
jb 0x43d430
mov eax, dword [esi + 0x14]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x43d426
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x43d6f5
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
lea ecx, [esi + 0xc8]
call fcn.00424810
jmp 0x43d5e9
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x43d61c
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x43d612
lea ecx, [esi + 0xc8]
push 0
push 0x1c5
push str.win_src_target_process.cc
call fcn.0041f9f0
lea eax, [esi + 0xd8]
mov dword [esi + 0x198], 0x12
push str.set_thread_token___error:
push eax
call fcn.005df800
add esp, 8
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x14]
push eax
push str.0x_X
push ecx
call fcn.0043b100
add esp, 0xc
lea eax, [esi + 0x14]
mov dword [esi + 0x198], 0x13
push eax
push dword [esi + 8]
call fcn.004a29e0
add esp, 8
mov ecx, dword [esi + 0x28]
cmp ecx, 8
jb 0x43d508
mov eax, dword [esi + 0x14]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x43d4fe
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x43d704
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
lea ecx, [esi + 0xc8]
call fcn.00424810
jmp 0x43d61c
cmp dword [esi + 0x10], 0
mov eax, 0xc0000001
je 0x43d5b3
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x43d5b3
mov edi, dword [esi + 0x38]
test edi, edi
je 0x43d5b3
mov dword [esi + 0xcc], ecx
mov ecx, dword [0x6d2098]
mov eax, dword [esi + 0x10]
test ecx, ecx
mov dword [esi + 0xc8], eax
jne 0x43d583
mov dword [esi + 0x2c], edi
mov dword [esi + 0x198], 0x11
push 0x6d2098
push str.NtSetInformationProcess
call fcn.0043c2d0
mov eax, 0xc0000001
add esp, 8
mov ecx, dword [0x6d2098]
mov edi, dword [esi + 0x2c]
test ecx, ecx
je 0x43d5b3
mov dword [esi + 0x198], 0xffffffff
call dword [0x64689c]
lea eax, [esi + 0xc8]
mov dword [esi + 0x198], 0x11
push 8
push eax
push 9
push edi
call ecx
test eax, eax
jns 0x43d14c
mov dword [esi + 0x198], 0x11
push eax
call fcn.004aeb00
add esp, 4
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 8], 0x3e
mov dword [ecx], eax
push 0
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x43d643
push 0
call fcn.00410ec0
add esp, 4
mov dword [esi + 0x198], 0x11
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 8], 0x14
mov dword [ecx], eax
push 0
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x43d643
push 0
call fcn.00410ec0
add esp, 4
mov dword [esi + 0x198], 0x11
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
push 0
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 8], 0x15
lea ecx, [esi + 0x38]
call fcn.0043e4b0
cmp dword [esi + 0x10], 0
je 0x43d66b
mov dword [esi + 0x198], 6
call fcn.0040e440
push dword [esi + 0x10]
call fcn.0040f9e0
add esp, 4
cmp dword [esi + 0xc], 0
je 0x43d68b
mov dword [esi + 0x198], 7
call fcn.0040e440
push dword [esi + 0xc]
call fcn.0040f9e0
add esp, 4
mov dword [esi + 0x198], 8
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x43d6ad
push eax
call fcn.005d31b1
add esp, 4
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x190]
mov dword fs:[0], eax
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
mov dword [esi + 0x198], 1
call fcn.006207e0
mov dword [esi + 0x198], 2
call fcn.006207e0
mov dword [esi + 0x198], 3
call fcn.006207e0
mov dword [esi + 0x198], 4
call fcn.006207e0
mov dword [esi + 0x198], 5
call fcn.006207e0
nop word cs:[eax + eax]
nop dword [eax]
push ebp
sub esp, 0x2c
lea esi, [ebp - 0x19c]
mov ebp, dword [esi + 0x188]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x2c
lea esi, [ebp - 0x19c]
mov ebp, dword [esi + 0x188]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x2c
lea esi, [ebp - 0x19c]
mov ebp, dword [esi + 0x188]
mov ecx, dword [esi + 0x28]
cmp ecx, 8
jb 0x43d7a7
mov eax, dword [esi + 0x14]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x43d79d
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x43d7c0
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 7
mov word [esi + 0x14], 0
add esp, 0x2c
pop ebp
ret
call fcn.006207e0
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x2c
lea esi, [ebp - 0x19c]
mov ebp, dword [esi + 0x188]
lea ecx, [esi + 0xc8]
call fcn.00424810
add esp, 0x2c
pop ebp
ret