Function at 0x43ce70
Capabilities:
Accept command line arguments
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3fc
mov eax, dword [0x4cf640]
xor eax, esp
mov dword [esp + 0x3f8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0xffffffffffffffff
mov dword [esp + 0x20], eax
call sub.IMM32.dll_ImmDisableIME
call fcn.00432280
xor esi, esi
push 0x206
mov eax, 7
lea ecx, [esp + 0x1fe]
push esi
push ecx
mov dword [esp + 0x1f8], eax
mov dword [esp + 0x1f4], esi
mov word [esp + 0x1e4], si
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x1bc], esi
mov word [esp + 0x1ac], si
mov word [esp + 0x204], si
call fcn.00479220
add esp, 0xc
push 0x104
lea edx, [esp + 0x1fc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x1f8]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x43cf10
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1fc]
push eax
lea ecx, [esp + 0x1a4]
call fcn.0040244b
mov eax, dword [esp + 0x1b0]
lea edi, [eax - 1]
cmp edi, eax
jbe 0x43cf47
call fcn.00479177
mov eax, dword [esp + 0x1a0]
mov ebx, 8
cmp dword [esp + 0x1b4], ebx
jae 0x43cf63
lea eax, [esp + 0x1a0]
cmp word [eax + edi*2], 0x5c
je 0x43cfc7
push 1
push 0x4b5754
lea ecx, [esp + 0x188]
mov dword [esp + 0x1a0], 7
mov dword [esp + 0x19c], esi
mov word [esp + 0x18c], si
call fcn.0040244b
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x188]
push ecx
lea ecx, [esp + 0x1a8]
call fcn.0040c4f0
cmp dword [esp + 0x198], ebx
jb 0x43cfc7
mov edx, dword [esp + 0x184]
push edx
call fcn.00478d09
add esp, 4
push str.Kernel32.dll
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0x16c]
push ecx
call fcn.0040cba0
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [esp + 0x1e0]
call fcn.0040216a
cmp dword [esp + 0x17c], ebx
jb 0x43d00d
mov edx, dword [esp + 0x168]
push edx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0x1ec], ebx
mov eax, dword [esp + 0x1d8]
jae 0x43d024
lea eax, [esp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
je 0x43d04f
push str.SetDllDirectoryA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x43d048
push 0x4bc576
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4b6c68]
mov cx, word [0x4b6c6c]
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x1f0]
push edx
push edi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x2c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x1d8], 7
mov dword [esp + 0x1d4], esi
mov word [esp + 0x1c4], si
mov dword [esp + 0x1f8], eax
mov word [esp + 0x1fc], cx
call fcn.00431e90
add esp, 8
cmp eax, esi
mov dword [esp + 0x1c], eax
je 0x43d526
mov esi, eax
push str.RegServer
push esi
call fcn.00431ee0
add esp, 8
test eax, eax
jne 0x43d0d3
mov dword [esp + 0x14], 1
jmp 0x43d526
push str.UnregServer
push esi
call fcn.00431ee0
add esp, 8
test eax, eax
jne 0x43d0f2
mov dword [esp + 0x14], 2
jmp 0x43d526
push str.Embedding
push esi
call fcn.00431ee0
add esp, 8
test eax, eax
jne 0x43d111
mov dword [esp + 0x14], 3
jmp 0x43d526
push str.Install
push esi
call fcn.00431ee0
add esp, 8
test eax, eax
jne 0x43d526
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x1c], 4
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
mov dword [esp + 0x28], eax
je 0x43d2e2
xor ebx, ebx
cmp dword [esp + 0x10], ebx
jle 0x43d2e2
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + ebx*4]
push edx
lea ecx, [esp + 0x114]
call fcn.00404256
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x114]
call fcn.004340a0
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x114]
mov esi, eax
call fcn.00423e30
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x114]
mov edi, eax
call fcn.004340a0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push fcn.0047b3bc
push ecx
mov ecx, dword [edi + 4]
push edx
mov edx, dword [edi]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x54]
push eax
call fcn.00434430
add esp, 0x20
push str.pid
lea ecx, [esp + 0x184]
call fcn.00404256
push str.dir
lea ecx, [esp + 0x168]
call fcn.00404256
push 0
lea ecx, [esp + 0x184]
push ecx
lea ecx, [esp + 0x118]
call fcn.00423340
cmp eax, 0xffffffff
lea ecx, [esp + 0x110]
je 0x43d259
mov edx, dword [esp + 0x194]
push 0xffffffffffffffff
add edx, eax
push edx
lea eax, [esp + 0x134]
push eax
call fcn.00425320
push 1
push 1
lea ecx, [esp + 0x134]
push ecx
lea ecx, [esp + 0x94]
call fcn.0043a0f0
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x8c]
call fcn.00439ea0
lea ecx, [esp + 0x88]
call fcn.004335e0
jmp 0x43d2a5
push 0
lea eax, [esp + 0x168]
push eax
call fcn.00423340
cmp eax, 0xffffffff
je 0x43d2b1
mov ecx, dword [esp + 0x178]
push 0xffffffffffffffff
add ecx, eax
push ecx
lea edx, [esp + 0x134]
push edx
lea ecx, [esp + 0x11c]
call fcn.00425320
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x1c4]
call fcn.0040216a
lea ecx, [esp + 0x12c]
call fcn.00402039
lea ecx, [esp + 0x164]
call fcn.00402039
lea ecx, [esp + 0x180]
call fcn.00402039
lea ecx, [esp + 0x110]
call fcn.00402039
add ebx, 1
cmp ebx, dword [esp + 0x10]
jl 0x43d153
cmp dword [esp + 0x18], 0
jne 0x43d526
mov ecx, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0x130]
call fcn.00404256
push 0x4bc578
lea ecx, [esp + 0x114]
call fcn.00404256
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x130]
call fcn.004340a0
mov esi, eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x130]
call fcn.00423e30
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x130]
mov edi, eax
call fcn.004340a0
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push fcn.0047b3bc
push edx
mov edx, dword [edi + 4]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.00434430
add esp, 0x20
push 0
push 0x4b6ebc
lea ecx, [esp + 0x134]
call fcn.00416f70
cmp eax, 0xffffffff
je 0x43d50e
mov edx, dword [esp + 0x140]
push edx
push 0
push 0x4b6eb4
lea ecx, [esp + 0x138]
call fcn.00416f70
push eax
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x138]
call fcn.00425320
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.0040216a
lea ecx, [esp + 0x164]
call fcn.00402039
push 0
push 0x4bca74
lea ecx, [esp + 0x118]
call fcn.00433820
cmp eax, 0xffffffff
je 0x43d435
push 0
push 0x4bca74
lea ecx, [esp + 0x118]
call fcn.00433820
push eax
push 0
lea ecx, [esp + 0x16c]
push ecx
lea ecx, [esp + 0x11c]
call fcn.00425320
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.0040216a
lea ecx, [esp + 0x164]
call fcn.00402039
cmp dword [esp + 0x124], 0
je 0x43d50e
push 0x4bc576
lea ecx, [esp + 0x14c]
mov byte [esp + 0x28], 1
call fcn.00404092
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x114]
push eax
call fcn.00451810
add esp, 8
push 3
push 0
lea ecx, [esp + 0x150]
call fcn.0040230d
push 0
push 0x4b6eb0
lea ecx, [esp + 0x150]
call fcn.00433600
cmp eax, 0xffffffff
je 0x43d4c9
lea esp, [esp]
push 1
push eax
lea ecx, [esp + 0x150]
call fcn.0040230d
push 1
push 0
push 0x4b6eb0
lea ecx, [esp + 0x154]
call fcn.00432dc0
cmp eax, 0xffffffff
jne 0x43d4a0
lea ecx, [esp + 0x148]
push ecx
call fcn.004423a0
add esp, 4
test al, al
je 0x43d502
cmp dword [esp + 0x160], 0x10
mov eax, dword [esp + 0x14c]
jae 0x43d4f5
lea eax, [esp + 0x14c]
push eax
call fcn.0047938e
add esp, 4
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x148]
call fcn.00401f9e
lea ecx, [esp + 0x110]
call fcn.00402039
lea ecx, [esp + 0x12c]
call fcn.00402039
mov esi, dword [esp + 0x14]
xor ebx, ebx
lea eax, [esi - 1]
cmp eax, 3
mov dword [esp + 0x10], ebx
ja case.default.0x43d53c
jmp dword [eax*4 + 0x43d978]
mov edx, dword [ebp + 0x14]
push edx
mov ecx, 0x4d1cd0
call fcn.00435210
mov dword [esp + 0x10], eax
lea eax, [esp + 0x110]
push ebx
push eax
call fcn.004437b0
lea ecx, [esp + 0x188]
push ebx
push ecx
call fcn.00443860
push str.DownloadProxyPS.dll
lea edx, [esp + 0x194]
push edx
lea eax, [esp + 0x144]
push eax
call fcn.0040cba0
push str._bugreport_xf.exe
lea ecx, [esp + 0x1a0]
push ecx
lea edx, [esp + 0x16c]
push edx
call fcn.0040cba0
add esp, 0x28
cmp dword [esp + 0x124], ebx
mov edi, 8
je 0x43d765
cmp esi, 1
mov eax, dword [esp + 0x114]
jne 0x43d6b6
cmp dword [esp + 0x128], edi
jae 0x43d5da
lea eax, [esp + 0x114]
push 0x4b6d48
push eax
call fcn.0043edc0
mov eax, dword [esp + 0x154]
add esp, 8
cmp dword [esp + 0x160], edi
jae 0x43d5ff
lea eax, [esp + 0x14c]
push 0x4b6e40
push eax
call fcn.0043edc0
add esp, 8
push 0x4b6c70
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x74]
push str._s__
push ecx
call fcn.00434970
add esp, 0xc
push eax
lea edx, [esp + 0x16c]
push edx
call fcn.0040cba0
add esp, 0xc
lea ecx, [esp + 0x6c]
call fcn.00402039
cmp dword [esp + 0x17c], edi
mov eax, dword [esp + 0x168]
jae 0x43d65d
lea eax, [esp + 0x168]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x2b4
call fcn.00478d0e
add esp, 4
cmp eax, ebx
je 0x43d759
mov ecx, eax
call fcn.004546f0
mov esi, eax
cmp esi, ebx
je 0x43d759
mov ecx, esi
call fcn.00458330
mov ecx, esi
call fcn.00458dd0
mov ecx, esi
call fcn.00452da0
push esi
call fcn.00478d09
add esp, 4
jmp 0x43d759
cmp dword [esp + 0x128], edi
jae 0x43d6c6
lea eax, [esp + 0x114]
push 0x4b6d48
push eax
call fcn.0043f020
mov eax, dword [esp + 0x154]
add esp, 8
cmp dword [esp + 0x160], edi
jae 0x43d6eb
lea eax, [esp + 0x14c]
push 0x4b6e40
push eax
call fcn.0043f020
add esp, 8
push 0x4b6c70
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x58]
push str._u__s__
push ecx
call fcn.00434970
add esp, 0xc
push eax
lea edx, [esp + 0x16c]
push edx
call fcn.0040cba0
add esp, 0xc
lea ecx, [esp + 0x50]
call fcn.00402039
cmp dword [esp + 0x17c], edi
mov eax, dword [esp + 0x168]
jae 0x43d749
lea eax, [esp + 0x168]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x164]
call fcn.00402039
cmp dword [esp + 0x160], edi
jb 0x43d77e
mov eax, dword [esp + 0x14c]
push eax
call fcn.00478d09
add esp, 4
cmp dword [esp + 0x144], edi
mov esi, 7
mov dword [esp + 0x160], esi
mov dword [esp + 0x15c], ebx
mov word [esp + 0x14c], bx
jb 0x43d7b2
mov ecx, dword [esp + 0x130]
push ecx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0x198], edi
mov dword [esp + 0x144], esi
mov dword [esp + 0x140], ebx
mov word [esp + 0x130], bx
jb 0x43d7e1
mov edx, dword [esp + 0x184]
push edx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0x128], edi
mov dword [esp + 0x198], esi
mov dword [esp + 0x194], ebx
mov word [esp + 0x184], bx
jb 0x43d8dc
mov eax, dword [esp + 0x114]
push eax
call fcn.00478d09
add esp, 4
jmp 0x43d8dc
lea ecx, [esp + 0x28]
push ecx
call fcn.00431890
mov ecx, dword [eax]
add esp, 4
call fcn.004319b0
lea ecx, [esp + 0x28]
call fcn.00422160
mov edx, dword [ebp + 0x14]
push edx
mov ecx, 0x4d1cd0
call fcn.00435210
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
call fcn.00431890
mov ecx, dword [eax]
add esp, 4
call fcn.0042e150
lea ecx, [esp + 0x1c]
call fcn.00422160
call fcn.0042b0f0
jmp case.default.0x43d53c
push 0x2b4
call fcn.00478d0e
add esp, 4
cmp eax, ebx
je 0x43d96e
mov ecx, eax
call fcn.004546f0
mov esi, eax
cmp esi, ebx
je 0x43d8ad
mov ecx, esi
call fcn.00454b90
mov ecx, esi
call fcn.00455610
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
push ecx
push edx
mov ecx, esi
call fcn.00453330
lea eax, [esp + 0x1b8]
push eax
push esi
call fcn.0043c460
add esp, 8
cmp esi, ebx
je case.default.0x43d53c
mov ecx, esi
call fcn.00452da0
push esi
call fcn.00478d09
add esp, 4
mov esi, 7
mov edi, 8
cmp dword [esp + 0x1d0], edi
jb 0x43d8f5
mov ecx, dword [esp + 0x1bc]
push ecx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0x1b4], edi
mov dword [esp + 0x1d0], esi
mov dword [esp + 0x1cc], ebx
mov word [esp + 0x1bc], bx
jb 0x43d924
mov edx, dword [esp + 0x1a0]
push edx
call fcn.00478d09
add esp, 4
cmp dword [esp + 0x1ec], edi
mov dword [esp + 0x1b4], esi
mov dword [esp + 0x1b0], ebx
mov word [esp + 0x1a0], bx
jb 0x43d953
mov eax, dword [esp + 0x1d8]
push eax
call fcn.00478d09
add esp, 4
mov ecx, dword [esp + 0x404]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00478cd0
mov esp, ebp
pop ebp
ret 0x10
xor esi, esi
jmp 0x43d8ad