Function at 0x43ae20
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x150]
push ebx
sub esp, 0x1ac
mov dword [ebp - 0x170], 0xc
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x174]
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x154], 0x44
mov dword [esp], eax
call fcn.0057d960
mov ebx, dword [sym.imp.kernel32.dll_GetTempPathA]
mov dword [esp + 4], 0x6f7840
mov dword [esp], 0x104
call ebx
sub esp, 8
mov dword [esp], 0x6f7840
call sub.msvcrt.dll_strlen
mov ecx, 2
mov edx, 0x6f7840
mov dword [eax + 0x6f7840], 0x736e6f63
mov dword [eax + 0x6f7844], 0x5f656c6f
mov dword [eax + 0x6f7848], 0x2e697567
mov dword [eax + 0x6f784c], 0x657865
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
call fcn.00433c00
mov dword [esp + 4], 0x6f7720
mov dword [esp], 0x104
call ebx
sub esp, 8
mov dword [esp], 0x6f7720
call sub.msvcrt.dll_strlen
mov ecx, 3
mov edx, 0x6f7720
mov dword [eax + 0x6f7720], 0x736e6f63
mov dword [eax + 0x6f7724], 0x5f656c6f
mov dword [eax + 0x6f7728], 0x2e697563
mov dword [eax + 0x6f772c], 0x657865
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
call fcn.00433c00
lea eax, [ebp - 0x170]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateEventA]
sub esp, 0x10
mov esi, eax
mov dword [ebp - 0x17c], eax
call fcn.0057d110
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x145f
xor eax, eax
test esi, esi
setne al
mov dword [esp + 4], str.Couldnt_create_event_n
xor esi, esi
mov dword [esp], eax
call fcn.00427ef0
mov eax, dword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
mov dword [ebp - 0x188], eax
call eax
mov edi, dword [sym.imp.kernel32.dll_SetConsoleCtrlHandler]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18c], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
sub esp, 8
mov dword [esp + 4], 1
mov dword [esp], 0x426e10
call edi
sub esp, 8
mov ebx, eax
mov eax, 0x1466
call fcn.00427180
mov dword [esp], ebx
mov ebx, 0x592620
mov dword [esp + 4], str.Couldnt_set_ctrl_c_handler_flag_n
call fcn.00427ef0
mov dword [ebp - 0x190], edi
mov dword [esp + 4], esi
mov dword [esp], str.test__u
call fcn.004270f0
mov ecx, dword [ebx]
mov eax, 0x6f7840
mov edx, 0x6f7720
test ecx, ecx
lea ecx, [ebp - 0x110]
cmove edx, eax
mov eax, dword [ebp - 0x17c]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov dword [ebp - 0x184], edx
mov dword [esp], ecx
mov dword [esp + 8], str.__s__console_ctrl_handler__p
mov dword [esp + 4], 0x104
call fcn.00427610
mov edi, eax
call fcn.0057d110
lea ecx, [ebp - 0x110]
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x146d
xor eax, eax
cmp edi, 0x103
setbe al
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], str.Truncated_string__s___lu__n
mov dword [esp], eax
call fcn.00427ef0
lea ecx, [ebp - 0x164]
mov edi, dword [ebx + 4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], ecx
lea ecx, [ebp - 0x154]
mov dword [esp + 0x20], ecx
lea ecx, [ebp - 0x110]
mov dword [esp + 4], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov dword [ebp - 0x180], eax
call fcn.0057d110
mov edx, dword [ebp - 0x184]
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x1471
mov dword [esp + 0xc], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], 0x590d1b
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x180]
mov dword [esp], ecx
call fcn.00427ef0
mov dword [esp + 4], 0x1388
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x180], eax
call fcn.0057d110
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x1474
mov eax, dword [ebp - 0x17c]
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x180]
xor eax, eax
mov dword [esp + 4], str.Child_didnt_init__lu__p_n
test edx, edx
mov dword [esp + 8], edx
sete al
mov dword [esp], eax
call fcn.00427ef0
mov edx, dword [ebx + 8]
cmp edx, 1
je 0x43b1de
cmp edx, 2
je 0x43b460
test edx, edx
je 0x43b440
mov dword [ebp - 0x180], edx
call fcn.0057d110
mov edx, dword [ebp - 0x180]
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x1484
mov dword [esp + 8], edx
mov dword [esp + 4], str.Unexpected_pgid_kind__u_n
mov dword [esp], 0
call fcn.00427ef0
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GenerateConsoleCtrlEvent]
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x1489
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov dword [esp + 4], str.GenerateConsoleCtrlEvent_failed:__lu_n
mov dword [esp + 8], edx
test edi, edi
je 0x43b3d0
mov dword [esp], 1
call fcn.00427ef0
mov dword [esp + 4], 0x7d0
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x148d
xor eax, eax
test edi, edi
sete al
mov dword [esp + 4], str.Expecting_child_to_be_terminated_n
mov dword [esp], eax
call fcn.00427ef0
lea eax, [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x1492
mov dword [esp + 4], 0x591a5d
mov dword [esp], edi
call fcn.00427ef0
call fcn.0057d110
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x1494
mov eax, dword [ebp - 0x178]
mov edx, dword [ebx + 0xc]
mov dword [esp + 4], str.Unexpected_exit_code__lx__instead_of__x_n
mov dword [esp + 8], eax
cmp edx, eax
mov dword [esp + 0xc], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00427ef0
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x160]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
je 0x43b32d
sub edx, 1
mov dword [eax + 0xbec], edx
add esi, 1
add ebx, 0x10
cmp esi, 0xe
jne 0x43b000
mov eax, dword [ebp - 0x17c]
mov edi, dword [ebp - 0x190]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x188]
sub esp, 4
call eax
mov esi, dword [ebp - 0x18c]
mov eax, dword [eax + 0x10]
mov dword [eax + 0x14], esi
mov dword [esp + 4], 0
mov dword [esp], 0x426e10
call edi
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x14a1
mov dword [esp], ebx
mov dword [esp + 4], str.Couldnt_remove_ctrl_c_handler_flag_n
call fcn.00427ef0
mov ebx, dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [esp], 0x6f7840
call ebx
sub esp, 4
mov dword [esp], 0x6f7720
call ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [0x8f0770]
test edx, edx
sete dl
cmp dword [eax + 0x34], 0x57
sete al
movzx eax, al
and eax, edx
mov dword [esp], eax
call fcn.00427ef0
mov dword [esp + 4], 0x7d0
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x148d
xor eax, eax
test edi, edi
sete al
mov dword [esp + 4], str.Expecting_child_to_be_terminated_n
mov dword [esp], eax
call fcn.00427ef0
jmp 0x43b2f1
mov eax, dword [ebp - 0x188]
call eax
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x29c]
jmp 0x43b1e0
call fcn.0057d110
shr edi, 9
and edi, 1
mov dword [eax], 0x58f03f
mov dword [eax + 4], 0x147c
mov dword [esp + 4], str.PGID_should_only_be_used_with_new_process_groupw_n
mov dword [esp], edi
call fcn.00427ef0
mov eax, dword [ebp - 0x15c]
jmp 0x43b1e0