Function at 0x43da24
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa98
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [esi + 0x94]
push 0x200
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esi + 0x24], 0xb9be0274
mov eax, 0xb9be0274
mov edi, dword [esi + 0x28]
xor ebx, ebx
cmp eax, 0xdbd7bab3
jle 0x43da93
cmp eax, 0xf4d8c38c
jle 0x43dada
cmp eax, 0x70f09108
jg 0x43db67
cmp eax, 0xf4d8c38d
je 0x43dbad
cmp eax, 0x8f0cc61
jne 0x43da61
mov eax, 0x8af531ab
jmp 0x43da61
cmp eax, 0xc1669377
jle 0x43db17
cmp eax, 0xcf350613
jle 0x43db98
cmp eax, 0xcf350614
je 0x43dbc3
cmp eax, 0xda3e6df0
jne 0x43da61
imul eax, edi, 0xca
add eax, 0xffff500a
shr eax, 0x15
imul edi, eax, 0x2c
mov eax, 0xcf350614
cmp edi, 0x89
jae 0x43da61
jmp 0x43db8e
cmp eax, 0xdbd7bab4
je 0x43dbee
cmp eax, 0xe107af37
je 0x43dc21
cmp eax, 0xeafef8d8
jne 0x43da61
mov eax, dword [esi]
shr eax, 3
imul eax, eax, 0x6e
shr eax, 0xb
add eax, 0xffffff3e
mov dword [esi], eax
mov eax, 0xc1669378
jmp 0x43da61
cmp eax, 0x8af531ab
je 0x43db8e
cmp eax, 0x9f79ae4b
je 0x43dc58
cmp eax, 0xb9be0274
jne 0x43da61
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
lea eax, [esi + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x14], eax
lea eax, [esi + 8]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, 0xf4d8c38d
jmp 0x43da61
cmp eax, 0x70f09109
je 0x43dc6b
cmp eax, 0x7beaea4b
jne 0x43da61
mov eax, dword [esi + 4]
mov byte [eax + 0x67], 0
mov eax, 0x70f09109
jmp 0x43da61
mov eax, 0x9f79ae4b
jmp 0x43da61
cmp eax, 0xc9f1c1e4
jne 0x43dc87
mov eax, 0x7beaea4b
jmp 0x43da61
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x18], eax
mov eax, 0xe107af37
jmp 0x43da61
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
add eax, 0xffffffff
adc ecx, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, 0x8f0cc61
jmp 0x43da61
mov ecx, dword [esi]
shr ecx, 9
imul eax, ecx, 0x113e80
imul ecx, ecx
imul edx, ecx, 0xc7f
dec edx
add eax, 0x33bb80
mov dword [esi], eax
mov eax, 0xda3e6df0
cmp edx, ecx
je 0x43da61
mov eax, 0xc9f1c1e4
jmp 0x43da61
mov ecx, dword [esi]
lea eax, [ecx + ecx*8]
lea eax, [eax + eax*2]
add eax, ecx
add eax, ecx
shr eax, 8
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0xc5
dec edx
add eax, 0x2f
mov dword [esi], eax
mov eax, 0xb9be0274
cmp edx, ecx
je 0x43da61
mov eax, 0xcf350614
jmp 0x43da61
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 4], eax
mov eax, 0xdbd7bab4
jmp 0x43da61
push 0x67
push 0x480390
push dword [esi + 4]
call fcn.0044cd70
add esp, 0xc
mov eax, 0xeafef8d8
jmp 0x43da61
cmp eax, 0xc1669378
jne 0x43da61
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
push 5
push 0x4803f7
push 0x67
push dword [esi + 4]
call fcn.0043dcf0
add esp, 0x10
lea ebx, [esi + 0x2c]
push 0x68
push dword [esi + 4]
push ebx
call fcn.0044cd70
add esp, 0xc
lea edi, [esi + 0x294]
lea eax, [esi + 0x94]
push eax
push eax
push dword [esi + 8]
push ebx
push 0x800
push edi
call fcn.0042c4cd
add esp, 0x18
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]