Function at 0x43a1b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push ebx
xor eax, eax
push ebp
mov dword [esp + 0x10], eax
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x20], eax
mov ecx, 0x11
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], eax
mov eax, str.Ati2evxx.exe__CFPnP
mov dword [esp + 0x10], 0
mov dword [esp + 0x28], 0x44
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a1f0
mov ebp, dword [esp + 0x70]
sub eax, edx
mov edi, eax
mov eax, dword [ebp + 4]
add edi, 0xa
xor esi, esi
test al, 0x10
je 0x43a221
movzx eax, byte [ebp + 0x11]
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
mov esi, 0x10
add eax, ecx
jmp 0x43a23f
test al, 2
je 0x43a233
mov edx, dword [ebp + 0x10]
mov esi, 2
mov dword [esp + 0x10], edx
jmp 0x43a243
test al, 1
je 0x43a243
mov eax, dword [ebp + 0x10]
mov esi, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x43a251
lea ecx, [eax + eax*2]
lea edi, [edi + ecx*4]
push edi
call fcn.0045ec66
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x43a275
push str.CeateRestartProcess:_failed_to_create_memory_n
call fcn.0040aab0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, str.Ati2evxx.exe__CFPnP
mov edx, ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43a292
mov eax, str.Ati2evxx.exe__CFPnP
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a2a4
sub eax, edx
push esi
add eax, ebx
push 0x483dec
push eax
call fcn.0045ebd9
mov eax, ebx
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a2c3
mov ecx, dword [ebp + 0x10]
push ecx
sub eax, esi
add eax, ebx
push 0x483dec
push eax
call fcn.0045ebd9
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a2e5
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x43a374
lea esi, [ebp + 0x18]
mov ebp, eax
lea ecx, [ecx]
xor ecx, ecx
mov ch, byte [esi + 4]
xor edx, edx
mov eax, edx
mov dword [esp + 0x14], edx
mov edx, dword [esi - 4]
and edx, 0xff
and eax, 0xff000000
mov cl, byte [esi]
shl ecx, 8
or ecx, edx
or ecx, eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x43a331
or ecx, 0x1000000
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
and eax, 1
shl eax, 4
and edx, 0xf
or eax, edx
shl eax, 0x19
and ecx, 0xc1ffffff
or eax, ecx
push eax
push 0x483dec
add edi, ebx
push edi
call fcn.0045ebd9
mov eax, ebx
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a363
sub eax, edi
add esi, 0x18
dec ebp
mov edi, eax
jne 0x43a300
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x43a3c9
push str.CreateRestartProcess:_create_restart_process_n
call fcn.0040aab0
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
push ebx
call fcn.0045e550
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
push str.CeateRestartProcess:_failed_to_create_process_n
call fcn.0040aab0
add esp, 4
push ebx
call fcn.0045e550
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret