Function at 0x43edbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test byte [0x4f9f4c], 0x40
je 0x43ede7
push 0xb
push 0
mov eax, dword [esi]
push eax
push 0
call fcn.0045bf34
jmp 0x43f068
mov dword [0x50a5bc], 1
mov dword [0x50a5c0], 5
mov eax, dword [esi + 4]
test eax, eax
je 0x43ee26
cmp byte [eax], 0x2d
jne 0x43ee26
push 0x6e
push eax
call fcn.00401278
add esp, 8
test eax, eax
je 0x43ee20
mov dword [0x50a5c0], 7
inc dword [0x50a5bc]
mov edx, dword [0x50a5bc]
cmp dword [esi + edx*4], 0
jne 0x43ee45
push 0
push 0
mov ecx, dword [esi]
push ecx
push 0
call fcn.0045bf34
jmp 0x43f068
mov eax, dword [0x50a5bc]
mov edx, dword [esi + eax*4]
cmp byte [edx], 0x22
jne 0x43ee93
push 0
push pe_nt_image_headers32
push edi
mov ecx, dword [0x50a5bc]
push ecx
push esi
call fcn.004b7ad4
mov dword [0x50a5bc], eax
cmp dword [0x50a5bc], 0
jge 0x43ee88
push 3
push 0
mov eax, dword [esi]
push eax
push 0
call fcn.0045bf34
jmp 0x43f068
inc dword [0x50a5bc]
jmp 0x43efd6
mov byte [edi], 0
jmp 0x43ef83
cmp byte [edi], 0
je 0x43eee5
cmp byte [edi + 1], 0
je 0x43eee5
push 0x3a
mov edx, dword [0x50a5bc]
mov ecx, dword [esi + edx*4]
push ecx
call fcn.00401278
add esp, 8
test eax, eax
jne 0x43efd6
push ebx
push 0x4f366a
push edi
call sub.SHELL32.dll_FindExecutableA
cmp eax, 0x1f
ja 0x43efd6
push 0x4f366d
push edi
call fcn.0040123c
add esp, 8
mov eax, dword [0x50a5bc]
mov edx, dword [esi + eax*4]
push edx
push edi
call fcn.0040123c
add esp, 8
mov ecx, dword [0x50a5bc]
mov eax, dword [esi + ecx*4]
push esi
push edi
mov edi, eax
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
call fcn.00408b88
pop ecx
push 0x4f3670
push ebx
call fcn.004015f8
add esp, 8
test eax, eax
je 0x43ef49
inc dword [0x50a5bc]
jmp 0x43efd6
push 0x4f3676
push ebx
call fcn.004015f8
add esp, 8
test eax, eax
je 0x43ef63
inc dword [0x50a5bc]
jmp 0x43efd6
push 0x4f367c
push ebx
call fcn.004015f8
add esp, 8
test eax, eax
je 0x43ef7d
inc dword [0x50a5bc]
jmp 0x43efd6
inc dword [0x50a5bc]
mov eax, dword [0x50a5bc]
cmp dword [esi + eax*4], 0
jne 0x43ee9b
jmp 0x43efd6
mov byte [ebx], 0
push esi
push ebx
mov ecx, dword [0x50a5bc]
push ecx
call fcn.004b6b5c
cmp byte [edi], 0
jne 0x43f019
cmp byte [ebx], 0
je 0x43f019
push esi
push edi
mov esi, edi
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [ebx], 0
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
mov eax, dword [0x50a5c0]
push eax
push 0x4f7cec
push ebx
push edi
push 0x4f3682
mov edx, dword [0x4fd9ec]
push edx
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x43f05c
push 0
call sub.KERNEL32.dll_SetErrorMode
push 4
push edi
mov ecx, dword [esi]
push ecx
push 0
call fcn.0045bf34
jmp 0x43f068
push 0
call sub.KERNEL32.dll_SetErrorMode
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc