Function at 0x43ede0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d41b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x80], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov esi, eax
test esi, esi
je 0x43ee6c
mov ebx, dword [esp + 0x90]
jne 0x43ee45
xor eax, eax
jmp 0x43ee48
mov eax, dword [esi + 0x20]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
jne 0x43ef5a
mov ecx, dword [esi + 0x20]
push 2
push ecx
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov esi, eax
test esi, esi
jne 0x43ee45
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x34], 0x44
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x80], 1
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x8c]
mov byte [esp + 0x80], 2
push ecx
lea ecx, [esp + 0x94]
call fcn.004d0c62
lea edx, [esp + 0x18]
mov ecx, ebp
push edx
call fcn.0043f230
mov ecx, dword [esp + 0x88]
lea edx, [esp + 0x8c]
push ecx
mov bl, 3
push eax
push edx
mov byte [esp + 0x8c], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x84], 4
call fcn.004d0c8c
lea ecx, [esp + 0x8c]
mov byte [esp + 0x80], bl
call fcn.004d0c74
lea ecx, [esp + 0x18]
mov byte [esp + 0x80], 2
call fcn.004d0c74
mov eax, dword [esp + 0x90]
mov esi, str..sli
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43f07f
test cl, cl
je 0x43ef53
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43f07f
add eax, 2
add esi, 2
test cl, cl
jne 0x43ef27
xor eax, eax
jmp 0x43f084
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_IsZoomed]
mov eax, dword [esp + 0x8c]
lea ecx, [esp + 0x14]
push eax
push str._open___s___
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [ebp + 0x1d0]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx - 8]
inc edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp + 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x88]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
push ecx
call edi
push str.System
mov ebx, eax
call edi
mov ecx, eax
mov eax, dword [ebp + 0x20]
test eax, eax
mov dword [esp + 0x8c], ecx
je 0x43efd5
mov eax, dword [eax + 0x20]
and ecx, 0xffff
mov edx, ebx
shl ecx, 0x10
and edx, 0xffff
or ecx, edx
push ecx
push eax
mov eax, dword [esi + 0x20]
push 0x3e0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x43f004
xor edi, edi
jmp 0x43f007
mov edi, dword [eax + 0x20]
mov ecx, dword [ebp + 0x1d0]
push ecx
push 0
push 0x3e8
call sub.USER32.dll_PackDDElParam
mov edx, dword [esi + 0x20]
push eax
push edi
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push 0x3e8
push edx
call edi
mov ebp, dword [ebp + 0x20]
test ebp, ebp
je 0x43f037
mov ebp, dword [ebp + 0x20]
mov eax, dword [esi + 0x20]
push 0
push ebp
push 0x3e1
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push ebx
call edi
mov ecx, dword [esp + 0x8c]
push ecx
call edi
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
test eax, eax
je 0x43f1fe
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x43f1fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43f09e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x90]
push eax
call fcn.004d0c8c
jmp 0x43f18b
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push 0x4f5670
push edx
call sub.MFC42.DLL_operator_2
push 0x4f5670
push eax
lea eax, [esp + 0x24]
mov byte [esp + 0x88], 5
push eax
call sub.MFC42.DLL_operator
push 0x4f566c
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x8c], 6
call sub.MFC42.DLL_operator
lea edx, [esp + 0x90]
mov byte [esp + 0x80], 7
push edx
push eax
lea eax, [esp + 0x90]
push eax
call sub.MFC42.DLL_operator_1
push 0x4f5670
lea ecx, [esp + 0x90]
mov bl, 8
push eax
push ecx
mov byte [esp + 0x8c], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x84], 9
call fcn.004d0c8c
lea ecx, [esp + 0x8c]
mov byte [esp + 0x80], bl
call fcn.004d0c74
lea ecx, [esp + 0x88]
mov byte [esp + 0x80], 7
call fcn.004d0c74
lea ecx, [esp + 0x18]
mov byte [esp + 0x80], 6
call fcn.004d0c74
lea ecx, [esp + 0x1c]
mov byte [esp + 0x80], 5
call fcn.004d0c74
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 2
call fcn.004d0c74
mov edx, dword [esp + 0x90]
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x94]
mov eax, dword [edx - 8]
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push eax
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x94]
test eax, eax
je 0x43f1d9
mov eax, dword [esp + 0x24]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x10]
mov byte [esp + 0x80], 1
call fcn.004d0c74
lea ecx, [esp + 0x90]
mov byte [esp + 0x80], 0
call fcn.004d0c74
lea ecx, [esp + 0x14]
mov dword [esp + 0x80], 0xffffffff
call fcn.004d0c74
mov ecx, dword [esp + 0x78]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x74
ret 0x10