Function at 0x433a90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0c
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 0x2c], eax
call fcn.00424ec0
call fcn.0042a970
push 0x433ef0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x28], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00434f70
add esp, 4
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, 0x48de64
call fcn.00434e70
mov dword [ebp - 0x28], eax
call fcn.0041a660
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.00433840
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 8]
push eax
call sub.gdiplus.dll_GdiplusStartup
lea ecx, [ebp - 0x14]
push ecx
call dword [ebp - 0x10]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3d8]
call fcn.0042d810
cmp dword [ebp + 0x10], 0
je 0x433def
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x3e0]
call fcn.004053d0
lea ecx, [ebp - 0x3e8]
call fcn.004053b0
lea ecx, [ebp - 0x3dc]
call fcn.004053b0
lea eax, [ebp - 0x3dc]
push eax
lea ecx, [ebp - 0x3e8]
push ecx
lea edx, [ebp - 0x3e0]
push edx
call fcn.004338f0
add esp, 0xc
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0
je 0x433dce
push 0x476ac4
lea eax, [ebp - 0x3e8]
push eax
call fcn.00407d80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x433bd9
lea ecx, [ebp - 0x3dc]
call fcn.00405880
test eax, eax
jle 0x433bd4
lea ecx, [ebp - 0x3dc]
call fcn.00419920
push eax
lea ecx, [ebp - 0x3d8]
call fcn.00430cf0
jmp 0x433da6
push 0x476acc
lea edx, [ebp - 0x3e8]
push edx
call fcn.00407d80
add esp, 8
movzx eax, al
test eax, eax
je 0x433c5e
push 0x40
push 0x476ad8
push 0x476b30
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x48de64
call fcn.00434d70
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0xa04], 0
lea ecx, [ebp - 0x3dc]
call fcn.00443990
lea ecx, [ebp - 0x3e8]
call fcn.00443990
lea ecx, [ebp - 0x3e0]
call fcn.00443990
lea ecx, [ebp - 0x3d8]
call fcn.0042da00
mov eax, dword [ebp - 0xa04]
jmp 0x433ed7
push 0x476b88
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00407d80
add esp, 8
movzx edx, al
test edx, edx
je 0x433ce3
push 0x40
push 0x476b24
push str.It_isnt_support_run_in_virtual_machine_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x48de64
call fcn.00434d70
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0xa08], 0
lea ecx, [ebp - 0x3dc]
call fcn.00443990
lea ecx, [ebp - 0x3e8]
call fcn.00443990
lea ecx, [ebp - 0x3e0]
call fcn.00443990
lea ecx, [ebp - 0x3d8]
call fcn.0042da00
mov eax, dword [ebp - 0xa08]
jmp 0x433ed7
push 0x476be4
lea eax, [ebp - 0x3e8]
push eax
call fcn.00407d80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x433d65
push 0x40
push 0x476bec
push str.It_isnt_support_run_at_remote_desktop_session
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x48de64
call fcn.00434d70
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0xa0c], 0
lea ecx, [ebp - 0x3dc]
call fcn.00443990
lea ecx, [ebp - 0x3e8]
call fcn.00443990
lea ecx, [ebp - 0x3e0]
call fcn.00443990
lea ecx, [ebp - 0x3d8]
call fcn.0042da00
mov eax, dword [ebp - 0xa0c]
jmp 0x433ed7
push 0x476c58
lea edx, [ebp - 0x3e8]
push edx
call fcn.00407d80
add esp, 8
movzx eax, al
test eax, eax
je 0x433da6
lea ecx, [ebp - 0x3dc]
call fcn.00405880
test eax, eax
jle 0x433da6
lea ecx, [ebp - 0x3dc]
call fcn.00419920
push eax
lea ecx, [ebp - 0x3d8]
call fcn.004311d0
lea ecx, [ebp - 0x3dc]
push ecx
lea edx, [ebp - 0x3e8]
push edx
lea eax, [ebp - 0x3e0]
push eax
call fcn.004338f0
add esp, 0xc
mov dword [ebp - 0x3e4], eax
jmp 0x433b86
lea ecx, [ebp - 0x3dc]
call fcn.00443990
lea ecx, [ebp - 0x3e8]
call fcn.00443990
lea ecx, [ebp - 0x3e0]
call fcn.00443990
call fcn.00434790
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x3d8]
call fcn.00434990
mov dword [ebp - 4], eax
call fcn.004348f0
cmp dword [ebp - 0x3c], 0
je 0x433e49
push 0x104
lea ecx, [ebp - 0x5f0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 5
push 0
push 0x476c60
lea edx, [ebp - 0x5f0]
push edx
push 0x476c68
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x433eb9
cmp dword [ebp - 0x38], 0
je 0x433e82
push 0x104
lea eax, [ebp - 0x7f8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 5
push 0
push 0x476c74
lea ecx, [ebp - 0x7f8]
push ecx
push 0x476c7c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x433eb9
cmp dword [ebp - 0x34], 0
je 0x433eb9
push 0x104
lea edx, [ebp - 0xa00]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 5
push 0
push 0x476c88
lea eax, [ebp - 0xa00]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x3d8]
call fcn.0042da00
mov ecx, 0x48de64
call fcn.00434d70
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.004567ae
mov esp, ebp
pop ebp
ret 0x10