Function at 0x43ee3c
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x4c], 0xffffffff
cmp dword [0x526e00], 0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x64], edx
jne 0x43ee95
mov eax, 0x4a686d
mov ebx, 0xc000007a
call fcn.0043e1e9
mov dword [esp + 4], str.NtCreateFile
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push ecx
push ecx
mov dword [0x526e00], eax
test eax, eax
je 0x43ee97
xor ebx, ebx
cmp dword [0x526dfc], 0
jne 0x43eecc
mov eax, 0x4a686d
call fcn.0043e1e9
mov dword [esp + 4], str.RtlDosPathNameToNtPathNameW
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
push edx
push edx
mov dword [0x526dfc], eax
mov eax, 0xc000007a
cmove ebx, eax
cmp dword [0x526df8], 0
jne 0x43ef01
mov eax, 0x4a686d
call fcn.0043e1e9
mov dword [esp + 4], str.RtlFreeHeap
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
push ecx
push ecx
mov dword [0x526df8], eax
mov eax, 0xc000007a
cmove ebx, eax
cmp dword [0x526df4], 0
jne 0x43ef2c
mov eax, 0x4a686d
call fcn.0043e1e9
mov dword [esp + 4], str.RtlSetLastWin32ErrorAndNtStatusFromNtStatus
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edx
push edx
mov dword [0x526df4], eax
cmp dword [0x526df4], 0
mov eax, dword [ebp + 8]
je 0x43ef3c
test ebx, ebx
je 0x43ef9d
call fcn.0043d8c1
xor ecx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
mov edx, eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x5c], edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
sub esp, 0x1c
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp - 0x5c]
mov esi, eax
test edx, edx
je 0x43ef8e
mov dword [esp], edx
call sub.msvcrt.dll_free
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
jmp 0x43f17c
call fcn.0043d8c1
mov edx, eax
mov eax, dword [ebp + 0x18]
dec eax
cmp eax, 4
ja 0x43efd0
mov eax, dword [ebp + 0x18]
mov ebx, esi
shr ebx, 0x1e
mov al, byte [eax + 0x4a6ad7]
xor ebx, 1
and ebx, 1
mov byte [ebp - 0x5c], al
shl ebx, 5
test esi, esi
jns 0x43efdc
or ebx, 2
jmp 0x43efdc
mov dword [esp], 0x57
jmp 0x43f081
bt esi, 0x1d
jae 0x43efe5
or ebx, 8
bt esi, 0x1c
jae 0x43efee
or bh, 8
bt esi, 0x1b
jae 0x43eff7
or ebx, 4
bt esi, 0x1a
jae 0x43f006
or bh, 0x10
or edi, 0x10000
bt esi, 0x19
jae 0x43f029
bt edi, 0x1c
jae 0x43f017
or bh, 0x44
jmp 0x43f02c
test edi, edi
jns 0x43f01e
or bh, 0x40
bt edi, 0x1e
jae 0x43f02c
or bh, 4
jmp 0x43f02c
or ebx, 0x40
bt esi, 0x15
jae 0x43f038
or ebx, 0x200000
bt esi, 0x14
jae 0x43f044
or ebx, 0x400000
xor eax, eax
lea ecx, [ebp - 0x38]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [ebp - 0x60], edx
call dword [0x526dfc]
mov edx, dword [ebp - 0x60]
lea ecx, [ebp - 0x38]
sub esp, 0x10
test al, al
jne 0x43f090
test edx, edx
je 0x43f07a
mov dword [esp], edx
call sub.msvcrt.dll_free
mov dword [esp], 2
call dword [sym.imp.KERNEL32.DLL_SetLastError]
or ebx, 0xffffffff
push eax
jmp 0x43f17c
xor eax, eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
je 0x43f0cb
mov eax, dword [ebp + 0x14]
cmp dword [eax + 8], 0
setne al
movzx eax, al
add eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
bt esi, 0x18
jb 0x43f0d5
or dword [ebp - 0x24], 0x40
mov dword [ebp - 0x60], edx
mov edx, dword [ebp - 0x64]
and esi, 0x7fa7
or edi, 0x100080
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], edx
xor edx, edx
mov dword [ebp - 0x48], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ebx
movzx eax, byte [ebp - 0x5c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x48]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x40]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [0x526e00]
mov ecx, dword [ebp - 0x34]
sub esp, 0x2c
mov ebx, eax
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [0x526df8]
mov edx, dword [ebp - 0x60]
sub esp, 0xc
test edx, edx
je 0x43f16f
mov dword [esp], edx
call sub.msvcrt.dll_free
mov dword [esp], ebx
call dword [0x526df4]
push eax
mov ebx, dword [ebp - 0x4c]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret