Function at 0x4329e8
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x838
mov esi, esp
mov dword [esi + 0x2c], 0x81fa5c77
mov eax, 0x81fa5c77
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, 0x1bccc989
jg 0x432a3f
cmp eax, 0xe67b9926
jg 0x432a82
cmp eax, 0x9f55d048
jg 0x432b1a
cmp eax, 0x81fa5c77
je 0x432bdc
cmp eax, 0x9e2a8d5b
jne 0x432a0d
mov eax, 0x4774cb5
jmp 0x432a0d
cmp eax, 0x3cf3a763
jle 0x432aba
cmp eax, 0x4443c689
jg 0x432b3d
cmp eax, 0x3cf3a764
je 0x432bf2
cmp eax, 0x4162420e
jne 0x432a0d
mov eax, dword [esi]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov eax, 0xb9cab840
jmp 0x432a0d
cmp eax, 0x4774cb4
jg 0x432b6f
cmp eax, 0xe67b9927
je 0x432c0e
cmp eax, 0xe95f12ee
jne 0x432a0d
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov eax, 0x3cf3a764
jmp 0x432a0d
cmp eax, 0x27a97147
jle 0x432bb3
cmp eax, 0x27a97148
je 0x432c53
cmp eax, 0x2af00f3c
jne 0x432a0d
mov eax, dword [esi + 0xc]
mov ecx, 0x84
add eax, ecx
mov ecx, eax
shr ecx, 7
imul ecx, ecx
imul edx, ecx, 0x8731
dec edx
shr eax, 1
and eax, 0x7ffff800
add eax, 0xfffa60ae
mov dword [esi + 0xc], eax
mov eax, 0x81fa5c77
cmp edx, ecx
je 0x432a0d
mov eax, 0x4162420e
jmp 0x432a0d
cmp eax, 0x9f55d049
je 0x432c64
cmp eax, 0xb9cab840
jne 0x432a0d
mov eax, dword [esi + 0x10]
mov eax, 0x9f55d049
jmp 0x432a0d
cmp eax, 0x4443c68a
je 0x432c77
cmp eax, 0x744fc4ce
jne 0x432a0d
push 0x67
push 0x470450
push dword [esi + 8]
call fcn.00441d60
add esp, 0xc
mov eax, 0xacde224
jmp 0x432a0d
cmp eax, 0x4774cb5
je 0x432ca9
cmp eax, 0xacde224
jne 0x432a0d
push 8
push 0x4704b7
push 0x67
push dword [esi + 8]
call fcn.00432d00
add esp, 0x10
push 0x68
push dword [esi + 8]
push dword [esi + 0x10]
call fcn.00441d60
add esp, 0xc
mov eax, 0x1bccc98a
jmp 0x432a0d
cmp eax, 0x20baa0c4
jne 0x432cb6
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi], eax
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x10], eax
mov eax, 0x9e2a8d5b
jmp 0x432a0d
push eax
sub esp, 0x1fc
mov eax, esp
mov dword [esi + 4], eax
mov eax, 0x20baa0c4
jmp 0x432a0d
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
add eax, 0xffffffff
adc ecx, 0xffffffff
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov eax, 0x2af00f3c
jmp 0x432a0d
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x200
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
push edi
push 3
push edi
push 7
push 0x80000000
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x14], eax
mov eax, dword [esi]
push dword [esi]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, 0x4443c68a
jmp 0x432a0d
mov eax, dword [esi + 8]
mov byte [eax + 0x67], 0
mov eax, 0x744fc4ce
jmp 0x432a0d
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 8], eax
mov eax, 0x27a97148
jmp 0x432a0d
mov eax, dword [esi + 0xc]
lea ecx, [eax - 0xc3]
imul ecx, ecx
imul edx, ecx, 0x6737
dec edx
add eax, 0xfffffeaa
mov dword [esi + 0xc], eax
mov eax, 0x20baa0c4
cmp ecx, edx
je 0x432a0d
mov eax, 0xe95f12ee
jmp 0x432a0d
mov eax, dword [esi + 4]
mov eax, 0xe67b9927
jmp 0x432a0d
cmp eax, 0x1bccc98a
jne 0x432a0d
mov dword [esi + 0x2c], eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
lea edi, [esi + 0x30]
push ecx
push ecx
push dword [eax]
push dword [esi + 0x10]
push 0x800
push edi
call fcn.004250b7
add esp, 0x18
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]