Function at 0x438de0
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, esp
mov dword [esi], 0xb9be0274
mov edi, dword [esi + 0xc]
mov eax, dword [esi]
cmp eax, 0xeafef8d7
jg 0x438e6b
cmp eax, 0xc9f1c1e3
jle 0x438f06
cmp eax, 0xdbd7bab3
jg 0x438f4c
cmp eax, 0xc9f1c1e4
je 0x4390ac
cmp eax, 0xcf350614
je 0x4390c8
cmp eax, 0xda3e6df0
jne 0x438df7
mov eax, dword [esi + 0x14]
mov byte [eax + 0x67], 0
mov ebx, 0x67
push ebx
push 0x47c380
push dword [esi + 0x14]
call fcn.00448eb0
add esp, 0xc
push 8
push 0x47c3e7
push ebx
push dword [esi + 0x14]
call fcn.00439230
add esp, 0x10
mov dword [esi], 0xe3056842
jmp 0x438df7
cmp eax, 0x46b8f08e
jg 0x438ea9
cmp eax, 0x23bc4a88
jg 0x438f90
cmp eax, 0xeafef8d8
je 0x4390eb
cmp eax, 0xf4d8c38d
je 0x4390f6
cmp eax, 0x8f0cc61
jne 0x438df7
mov dword [esi], 0x8af531ab
jmp 0x438df7
cmp eax, 0x619ba9b2
jle 0x438fd8
cmp eax, 0x70f09108
jle 0x43904e
cmp eax, 0x70f09109
je 0x43910d
cmp eax, 0x7beaea4b
jne 0x438df7
mov eax, dword [esi + 4]
mov ecx, 0xffffff3e
add eax, ecx
mov ecx, eax
shl ecx, 0xd
imul eax, eax
imul edx, eax, 0x73e3
dec edx
mov dword [esi + 4], ecx
mov ecx, 0x5080623c
cmp edx, eax
je 0x438eff
mov ecx, 0xdbd7bab4
mov dword [esi], ecx
jmp 0x438df7
cmp eax, 0xb9be0273
jle 0x439002
cmp eax, 0xb9be0274
je 0x439118
cmp eax, 0xc1669378
je 0x43912f
cmp eax, 0xc45fd1d8
jne 0x438df7
imul edi, edi, 0xe1c000
add edi, 0xe0de4000
shr edi, 5
mov dword [esi], 0x5f981636
jmp 0x438df7
cmp eax, 0xdbd7bab4
je 0x439143
cmp eax, 0xe107af37
je 0x439157
cmp eax, 0xe3056842
jne 0x438df7
push 0x68
push dword [esi + 0x14]
push dword [esi + 0x1c]
call fcn.00448eb0
add esp, 0xc
mov eax, dword [esi + 8]
mov eax, dword [eax]
mov dword [esi + 0x24], eax
mov dword [esi], 0x619ba9b3
jmp 0x438df7
cmp eax, 0x3090480f
jg 0x43907f
cmp eax, 0x23bc4a89
jne 0x4391c6
mov eax, dword [esi + 4]
add eax, 0xffffff91
shr eax, 0xf
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x15ef
shl eax, 0x16
dec edx
mov dword [esi + 4], eax
mov eax, 0xc45fd1d8
cmp edx, ecx
je 0x4390a5
mov eax, 0xda3e6df0
jmp 0x4390a5
cmp eax, 0x46b8f08f
je 0x439165
cmp eax, 0x5080623c
jne 0x4391b9
shr edi, 0xf
add edi, 0xdb
mov dword [esi], 0x30904810
jmp 0x438df7
cmp eax, 0x8af531ab
je 0x43917b
cmp eax, 0x9f79ae4b
jne 0x438df7
push dword [esi + 8]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov edx, dword [esi + 8]
mov dword [edx], ecx
mov dword [edx + 4], eax
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0x7beaea4b
jmp 0x438df7
cmp eax, 0x619ba9b3
jne 0x4391d3
mov eax, dword [esi + 0x10]
push eax
push eax
push dword [esi + 0x24]
push dword [esi + 0x1c]
push 0x800
push dword [esi + 0x18]
call fcn.00428473
add esp, 0x18
mov dword [esi], 0x46b8f08f
jmp 0x438df7
cmp eax, 0x3c8ab27c
jne 0x4391e0
shr edi, 4
and edi, 0x3fffff
mov eax, 0xf4d8c38d
cmp edi, 0xdc
jb 0x4390a5
mov eax, 0x9f79ae4b
mov dword [esi], eax
jmp 0x438df7
mov eax, dword [esi + 4]
shr eax, 7
and eax, 0x3ffff8
lea eax, [eax + eax*2]
mov dword [esi + 4], eax
mov dword [esi], 0x9f79ae4b
jmp 0x438df7
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 8], eax
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [esi], 0xe107af37
jmp 0x438df7
mov dword [esi], 0x23bc4a89
jmp 0x438df7
push eax
sub esp, 0x1fc
mov eax, esp
mov dword [esi + 0x10], eax
mov dword [esi], 0xcf350614
jmp 0x438df7
mov dword [esi], 0xc1669378
jmp 0x438df7
push eax
sub esp, 0x7fc
mov eax, esp
mov dword [esi + 0x18], eax
mov dword [esi], 0xf4d8c38d
jmp 0x438df7
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x14], eax
mov dword [esi], 0xeafef8d8
jmp 0x438df7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, dword [esi + 0x1c]
mov dword [esi], 0x70f09109
jmp 0x438df7
mov eax, dword [esi + 0x10]
mov dword [esi], 0x8f0cc61
jmp 0x438df7
push 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [esi], 0x65bbaa71
jmp 0x438df7
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x200
push dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 8]
mov dword [esi], 0xc9f1c1e4
jmp 0x438df7
cmp eax, 0x5f981636
jne 0x438df7
jmp 0x4391f9
cmp eax, 0x27bdab9a
jne 0x438df7
jmp 0x439206
cmp eax, 0x65bbaa71
jne 0x438df7
jmp 0x439219
cmp eax, 0x30904810
jne 0x438df7
add edi, 0xffffff04
mov dword [esi + 0xc], edi
call fcn.00438de0
imul eax, edi, 0x53
add eax, 0xffffcd19
shr eax, 3
jmp 0x439211
imul eax, edi, 0xaa4
add eax, 0x21450
mov dword [esi + 0xc], eax
call fcn.00438de0
mov dword [esi + 0xc], edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]