Function at 0x43d69e
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x81c], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x810], ecx
mov ecx, dword [ebp + 0x20]
mov eax, dword [eax]
push ebx
mov ebx, dword [ebp + 0x10]
sub eax, 0x10
mov dword [ebp - 0x820], ecx
mov ecx, dword [ebp + 0x24]
push esi
mov dword [ebp - 0x814], ecx
mov ecx, dword [ebp + 0x28]
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x828], ecx
mov ecx, dword [ebp + 0x2c]
push eax
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x824], ecx
call fcn.00402f5d
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x80c], esi
call fcn.00403a64
push eax
lea ecx, [ebp - 0x808]
call fcn.00402a6b
push edi
lea eax, [ebp - 0x808]
push str.__updateidAF868A92_0866_45d4_9BD8_A8EE2BB2033F__SECTIONIDDCEC36FC_64A3_471f_9DEE_7D01310E1E2C__NOTIFYWINDOW_d__NAME51FA7BCF_DF17_4b1a_8052_C4D98AA5F93D___UPDATETYPEE7CF2847_EEE7_4dc3_9BD5_23902EBF1D89
push eax
call fcn.00415254
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x43d76f
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x818]
push str.__s
push eax
call fcn.0041346d
add esp, 0xc
lea ecx, [ebp - 0x808]
push eax
call fcn.00402bd6
mov ecx, dword [ebp - 0x818]
lea ecx, [ecx - 0x10]
call fcn.004042e9
push dword [ebx]
lea ecx, [ebp - 0x808]
push 0x531600
call fcn.00404301
mov eax, dword [ebp - 0x81c]
lea ecx, [ebp - 0x808]
push dword [eax]
push 0x531650
call fcn.00404301
mov eax, dword [ebp - 0x820]
lea ecx, [ebp - 0x808]
push dword [eax]
push 0x5316a0
call fcn.00404301
mov eax, dword [ebp - 0x810]
lea ecx, [ebp - 0x808]
push dword [eax]
push 0x5316f0
call fcn.00404301
mov edi, str.__execarg
push edi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
push edi
lea ecx, [ebp - 0x808]
call fcn.00402d75
mov ecx, dword [ebp - 0x814]
mov eax, dword [ecx]
lea ecx, [ebp - 0x808]
push dword [eax - 0xc]
push eax
call fcn.00402d75
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
je 0x43d94b
push ebx
push esi
call fcn.00425e47
pop ecx
pop ecx
test eax, eax
je 0x43d94b
push 0x44
pop esi
push esi
lea eax, [ebp - 0x880]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x880], esi
lea edi, [ebp - 0x83c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 5
pop eax
mov ecx, 0x531764
mov word [ebp - 0x850], ax
push ecx
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x854], 1
push eax
push ecx
lea eax, [ebp - 0x810]
push eax
call fcn.0041346d
add esp, 0xc
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.00413428
add esp, 0xc
lea ecx, [ebp - 0x80c]
push eax
call fcn.00402bd6
mov ecx, dword [ebp - 0x814]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0x810]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov esi, dword [ebp - 0x80c]
lea eax, [ebp - 0x804]
mov edi, 0x400
push edi
push esi
push eax
call sub.msvcrt.dll_wcsncpy
push edi
lea eax, [ebp - 0x804]
push 0x52bb0c
push eax
call sub.msvcrt.dll_wcsncat
push edi
push dword [ebp - 0x808]
lea eax, [ebp - 0x804]
push eax
call sub.msvcrt.dll_wcsncat
add esp, 0x24
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x880]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x804]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test ebx, ebx
je 0x43d932
mov eax, dword [ebp - 0x824]
test eax, eax
je 0x43d932
mov ecx, dword [ebp - 0x83c]
mov dword [eax], ecx
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x828]
push dword [ebp - 0x82c]
call fcn.0043b806
mov ecx, dword [ebp - 0x808]
lea ecx, [ecx - 0x10]
call fcn.004042e9
lea ecx, [esi - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret 0x28