Function at 0x43fbdc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
movsx eax, byte [ebx]
cmp eax, 0x61
jb 0x43fbf6
sub eax, 0x20
cmp eax, 0x41
jb 0x43fc06
cmp eax, 0x5a
ja 0x43fc06
cmp byte [ebx + 1], 0x3a
je 0x43fc24
push 0x2f
push ebx
call fcn.0043de3c
add esp, 8
test eax, eax
jne 0x43fc24
push 0x5c
push ebx
call fcn.0043de3c
add esp, 8
test eax, eax
je 0x43fc29
xor edx, edx
mov dword [ebp + 0x18], edx
xor esi, esi
push 0x2e
push ebx
call fcn.0043e0f8
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x43fc91
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x110]
push edx
push 0xb0f225
push ecx
push ebx
call fcn.0043f9d4
add esp, 0x10
mov edi, eax
test eax, eax
je 0x43fcee
push 0xb0f226
mov edx, dword [ebp - 0xc]
push edx
call fcn.0043dee4
add esp, 8
test eax, eax
je 0x43fc8a
push 0xb0f22b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0043dee4
add esp, 8
test eax, eax
jne 0x43fcee
mov esi, 1
jmp 0x43fcee
mov eax, dword [ebp + 0x18]
lea edx, [ebp - 0x110]
push eax
push 0xb0f230
push edx
push ebx
call fcn.0043f9d4
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x43fcee
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x110]
push edx
push 0xb0f235
push ecx
push ebx
call fcn.0043f9d4
add esp, 0x10
mov edi, eax
mov esi, eax
test eax, eax
jne 0x43fcee
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x110]
push edx
push 0xb0f23a
push ecx
push ebx
call fcn.0043f9d4
add esp, 0x10
mov edi, eax
mov esi, eax
test edi, edi
je 0x43fd08
test esi, esi
je 0x43fd1b
push 0xb0f23f
call fcn.0043f414
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x43fd1b
call fcn.0043f034
mov dword [eax], 2
or eax, 0xffffffff
jmp 0x43ff4c
test esi, esi
je 0x43fd38
mov edx, dword [ebp + 0x10]
push edx
push 0xb0f247
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043fa8c
add esp, 0xc
mov ebx, eax
jmp 0x43fd51
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
push 0
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
push ecx
call fcn.0043fa8c
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x43fd68
call fcn.0043f034
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x43ff4c
cmp dword [ebp + 0x14], 0
jne 0x43fd72
xor edi, edi
jmp 0x43fd9c
mov eax, dword [ebp + 0x14]
push eax
call fcn.0043fb78
pop ecx
mov edi, eax
test eax, eax
jne 0x43fd9c
call fcn.0043f034
mov dword [eax], 8
push ebx
call fcn.0043e7f4
pop ecx
or eax, 0xffffffff
jmp 0x43ff4c
call dword [0xb0f16c]
push 0x44
push 0
lea edx, [ebp - 0x160]
push edx
call fcn.00435974
add esp, 0xc
mov dword [ebp - 0x160], 0x44
mov word [ebp - 0x130], 0xa
cmp dword [0xb0dce4], 0
je 0x43fe07
push 0
call dword [0xb0e7b8]
pop ecx
mov word [ebp - 0x12e], ax
movzx ecx, word [ebp - 0x12e]
push ecx
call fcn.0043e908
pop ecx
mov dword [ebp - 0x12c], eax
test eax, eax
je 0x43fd82
mov edx, dword [ebp - 0x12c]
push edx
call dword [0xb0e7b8]
pop ecx
mov dword [ebp - 0x11c], 0xc
xor ecx, ecx
lea eax, [ebp - 0x170]
mov dword [ebp - 0x118], ecx
lea edx, [ebp - 0x160]
mov dword [ebp - 0x114], 1
push eax
push edx
push 0
push edi
cmp dword [ebp + 8], 4
mov ecx, 8
je 0x43fe42
add ecx, 0xfffffff8
push ecx
push 1
lea eax, [ebp - 0x11c]
push eax
lea edx, [ebp - 0x11c]
push edx
push ebx
test esi, esi
je 0x43fe5d
mov ecx, dword [ebp - 8]
jmp 0x43fe63
lea ecx, [ebp - 0x110]
push ecx
call sub.KERNEL32.dll_CreateProcessA
dec eax
je 0x43feac
call sub.KERNEL32.dll_GetLastError
and eax, 0xffff
dec eax
je 0x43fe8a
sub eax, 7
je 0x43fe91
sub eax, 0x51
jne 0x43fe98
mov esi, 0x2a
jmp 0x43fe9d
mov esi, 0x13
jmp 0x43fe9d
mov esi, 8
jmp 0x43fe9d
mov esi, 0x15
call fcn.0043f034
mov dword [eax], esi
or esi, 0xffffffff
jmp 0x43ff3c
mov eax, dword [ebp + 8]
sub eax, 1
jb 0x43fec1
je 0x43fefc
dec eax
je 0x43ff17
dec eax
sub eax, 2
jb 0x43fef0
jmp 0x43ff2d
push 0xffffffffffffffff
mov edx, dword [ebp - 0x170]
push edx
call sub.KERNEL32.dll_WaitForSingleObject
lea ecx, [ebp - 4]
push ecx
mov eax, dword [ebp - 0x170]
push eax
call sub.KERNEL32.dll_GetExitCodeProcess
mov edx, dword [ebp - 0x170]
push edx
call sub.KERNEL32.dll_CloseHandle
mov esi, dword [ebp - 4]
jmp 0x43ff30
mov eax, dword [ebp - 0x170]
push eax
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x170]
push edx
mov ecx, dword [ebp - 0x168]
push ecx
call dword [0xb0f21c]
add esp, 8
mov esi, eax
jmp 0x43ff30
push edi
call fcn.0043e7f4
pop ecx
push ebx
call fcn.0043e7f4
pop ecx
push 0
call fcn.0043f3c4
pop ecx
or esi, 0xffffffff
mov eax, dword [ebp - 0x16c]
push eax
call sub.KERNEL32.dll_CloseHandle
push edi
call fcn.0043e7f4
pop ecx
push ebx
call fcn.0043e7f4
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret