Function at 0x100043d7
Capabilities:
Create process on windows
Delete file
Encode data using xor
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf34
push ebx
push esi
push edi
mov esi, edx
call fcn.100030eb
push esi
mov edi, eax
call dword [esi + 0x18]
pop ecx
push eax
xor ebx, ebx
push ebx
push esi
call dword [esi + 0x1c]
pop ecx
pop ecx
push eax
push edi
call dword [edi + 0x14]
mov ecx, esi
call fcn.100031f9
push 0x38
lea eax, [ebp - 0x98]
push ebx
push eax
call sub.ntdll.dll_memset
push 0x38
lea eax, [ebp - 0x98]
push eax
push edi
call dword [edi + 0x10]
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push edi
call dword [edi + 0x10]
push edi
call dword [edi + 0x18]
add esp, 0x34
cmp eax, dword [ebp - 4]
jne 0x10004657
push 4
push 0x1000
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x10004657
push dword [ebp - 4]
push ebx
push edi
call dword [edi + 0x10]
add esp, 0xc
mov ecx, edi
call fcn.100031f9
mov edx, dword [ebp - 4]
lea edi, [ebp - 0xf30]
mov ecx, 0x2a2
mov esi, 0x1004e8e0
rep movsd dword es:[edi], dword [esi]
xor eax, eax
xor byte [ebp + eax - 0xf30], 0x3a
inc eax
cmp eax, 0xa88
jl 0x10004484
lea edi, [edx - 0xa8c]
mov ecx, 0x2a2
add edi, ebx
lea esi, [ebp - 0xf30]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x208
lea eax, [ebp - 0x2a0]
push esi
push 0
push eax
call sub.ntdll.dll_memset
push esi
lea eax, [ebp - 0x4a8]
push 0
push eax
call sub.ntdll.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x2a0]
add esp, 0x18
push 0x1004f144
push eax
call esi
push 0x1004aab4
lea eax, [ebp - 0x2a0]
push eax
call esi
push 0x1004f2d4
lea eax, [ebp - 0x2a0]
push eax
call esi
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x4a8]
push eax
call esi
push str..bak
lea eax, [ebp - 0x4a8]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_MoveFileW]
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call edi
push dword [ebp - 4]
mov edx, ebx
lea ecx, [ebp - 0x2a0]
call fcn.1000e070
pop ecx
test eax, eax
jne 0x10004639
lea eax, [ebp - 0x4a8]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x60]
push 0
push eax
call sub.ntdll.dll_memset
xor eax, eax
mov dword [ebp - 0x60], ebx
lea edi, [ebp - 0x14]
mov dword [ebp - 0x34], 1
stosd dword es:[edi], eax
xor ebx, ebx
push 0x208
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x6b0]
push eax
call sub.ntdll.dll_memset
add esp, 0x18
lea eax, [ebp - 0x6b0]
push 0x1004f144
push eax
call esi
push 0x1004aab4
lea eax, [ebp - 0x6b0]
push eax
call esi
push 0x1004f20c
lea eax, [ebp - 0x6b0]
push eax
call esi
push 0x1004aab8
lea eax, [ebp - 0x6b0]
push eax
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push 0x210
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6b0]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x10004628
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x1000461b
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x10], ebx
je 0x10004628
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
push 0x7b
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x10004657
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x4a8]
push eax
call edi
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret