Function at 0x43c390
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x56af98
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x5c6590]
xor eax, esp
mov dword [esp + 0x354], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5c6590]
xor eax, esp
push eax
lea eax, [esp + 0x36c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x16a]
push ecx
mov word [esp + 0x16c], ax
call fcn.00540cb0
add esp, 0xc
call fcn.004436d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43c407
push 0x80004005
call fcn.00402fd0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x58], ebp
push 0x104
lea ecx, [esp + 0x164]
push ecx
push 0
mov dword [esp + 0x380], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x160]
push edx
lea ecx, [esp + 0x18]
call fcn.00402a10
mov ebx, 1
mov byte [esp + 0x374], bl
mov eax, dword [esp + 0x14]
push 0x5c
push eax
call fcn.0054047d
add esp, 8
test eax, eax
jne 0x43c46c
or eax, 0xffffffff
jmp 0x43c472
sub eax, dword [esp + 0x14]
sar eax, 1
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00419620
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x378], 2
call fcn.004090a0
mov byte [esp + 0x374], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43c4ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
push 0x5a0530
lea ecx, [esp + 0x1c]
call fcn.00408de0
cmp byte [esi + 4], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
je 0x43c4f0
push str.AdapterChange_64.exe
push ecx
push edx
call fcn.0043de60
add esp, 0xc
mov byte [esp + 0x374], 3
jmp 0x43c507
push str.AdapterChange.exe
push ecx
push edx
call fcn.0043de60
add esp, 0xc
mov byte [esp + 0x374], 4
push eax
lea ecx, [esp + 0x18]
call fcn.004090a0
mov byte [esp + 0x374], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c538
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.004436d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43c552
push 0x80004005
call fcn.00402fd0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
add esi, 0xce34
cmp byte [esp + 0x37c], 0
push 3
mov byte [esp + 0x378], 5
lea ebx, [esp + 0x60]
push esi
je 0x43c5ad
lea ecx, [esp + 0x68]
mov dword [esp + 0x64], ecx
call fcn.0040e5e0
sub esp, 0x104
mov edi, esp
push str.enable__s
lea edx, [esp + 0x120]
mov byte [esp + 0x47c], 6
push edx
jmp 0x43c5d7
lea edx, [esp + 0x68]
mov dword [esp + 0x64], edx
call fcn.0040e5e0
sub esp, 0x104
mov edi, esp
push str.disable__s
lea eax, [esp + 0x120]
mov byte [esp + 0x47c], 7
push eax
mov ecx, 0x41
lea esi, [esp + 0x168]
rep movsd dword es:[edi], dword [esi]
call fcn.004030a0
mov eax, dword [esp + 0x168]
lea ecx, [esp + 0x16c]
add esp, 0x10c
cmp eax, ecx
je 0x43c60b
push eax
call fcn.0053ebc0
add esp, 4
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
xor ebx, ebx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x4008340
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x59e600
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x43c684
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
mov byte [esp + 0x374], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43c6a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x374], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c6cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x374], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c6f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x36c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x354]
xor ecx, esp
call fcn.0053e694
add esp, 0x364
ret 4