Function at 0x43cac8
Capabilities:
Parse pe header

Disassembly:
push 0x118
push 0x43cdb8
call fcn.00417abd
mov eax, dword [0x44de1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x44e9f4]
xor ecx, ecx
cmp eax, ecx
je 0x43cb09
mov dword [ebp - 4], ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x43cc08
mov eax, dword [ebp + 8]
dec eax
je 0x43cb25
mov edi, 0x43cd94
mov dword [ebp - 0x128], 0x43cce0
mov esi, 0xd4
jmp 0x43cb39
mov edi, 0x43ccc0
mov dword [ebp - 0x128], 0x43cc20
mov esi, 0xb9
mov byte [ebp - 0x20], cl
push 0x104
lea eax, [ebp - 0x124]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43cb66
push 0x423920
lea eax, [ebp - 0x124]
push eax
call fcn.0040533a
pop ecx
pop ecx
lea ebx, [ebp - 0x124]
mov eax, ebx
push eax
call fcn.00407a9b
pop ecx
add eax, 0xb
cmp eax, 0x3c
jbe 0x43cba2
mov eax, ebx
push eax
call fcn.00407a9b
mov ebx, eax
lea eax, [ebp - 0x124]
sub eax, 0x31
add ebx, eax
push 3
push 0x42391c
push ebx
call fcn.0040e651
add esp, 0x10
push ebx
call fcn.00407a9b
pop ecx
lea eax, [eax + esi + 0xc]
add eax, 3
and eax, 0xfffffffc
call fcn.0041763c
mov dword [ebp - 0x18], esp
mov esi, esp
push edi
push esi
call fcn.0040533a
mov edi, 0x423918
push edi
push esi
call fcn.0041bda5
push 0x43cc10
push esi
call fcn.0041bda5
push ebx
push esi
call fcn.0041bda5
push edi
push esi
call fcn.0041bda5
push dword [ebp - 0x128]
push esi
call fcn.0041bda5
push 0x12010
push 0x4238f0
push esi
call fcn.0043f5ba
add esp, 0x3c
push 3
call fcn.0043c515
nop
push eax
jb 0x43cc82
jb 0x43cc77
insd dword es:[edi], dx
cmp ah, byte [eax]
add byte [eax - 0x6f6f6f70], dl
nop
inc ecx
and byte [edx + 0x75], ah
jb 0x43cc49
outsd dx, dword [esi]
jbe 0x43cc91
jb 0x43cca0
jne 0x43cc9e
and byte [eax + 0x61], ch
jae 0x43cc55
bound esp, qword [ebp + 0x65]
outsb dx, byte [esi]
and byte [ebp + 0x74], ah
arpl word gs:[ebp + 0x64], si
and byte [edi + 0x68], dh
imul esp, dword [ebx + 0x68], 0x73616820
and byte [ebx + 0x6f], ah
push 0x63207361
outsd dx, dword [esi]
jb 0x43ccc3
jne 0x43ccc3
je 0x43ccba
and byte fs:[eax + ebp*2 + 0x65], dh
and byte [eax + 0x72], dh
outsd dx, dword [esi]
jb 0x43ccc2
insd dword es:[edi], dx
daa
jae 0x43cc6f
imul ebp, dword [esi + 0x74], 0x616e7265
insb byte es:[edi], dx
and byte [ebx + 0x74], dh
popal
je 0x43ccd2
je 0x43ccd8
and byte cs:[eax], ah
push esp
push 0x72702065
outsd dx, dword [esi]
jb 0x43cce1
insd dword es:[edi], dx
and byte [ebx + 0x61], ah
outsb dx, byte [esi]
arpl word [ecx + 0x6e], sp
outsb dx, byte [esi]
outsd dx, dword [esi]
je 0x43cca9
jae 0x43ccec
insb byte es:[edi], dx
jns 0x43ccb0
arpl word [edi + 0x6e], bp
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x43ccfe
outsb dx, byte [esi]
jne 0x43ccfd
and byte [ebp + 0x78], ah
arpl word gs:[ebp + 0x74], si
imul ebp, dword [edi + 0x6e], 0x646e6120
and byte [ebp + 0x75], ch
je 0x43cd09
outsd dx, dword [esi]
outsb dx, byte [esi]
and byte [ecx + 0x6e], ah
and byte fs:[ebp + 0x75], ch
jae 0x43cd1f
or ch, byte [esi + 0x6f]
ja 0x43ccd0
bound esp, qword [ebp + 0x20]
je 0x43cd1a
jb 0x43cd24
imul ebp, dword [esi + 0x61], 0x2e646574
or al, byte [eax]
je 0x43cd21
or al, byte cs:[eax]
inc edx
jne 0x43cd29
jb 0x43cce7
jb 0x43cce7
outsd dx, dword [esi]
jbe 0x43cd2f
jb 0x43cd3e
jne 0x43cd3c
and byte [ebp + 0x74], ah
je 0x43cd38
arpl word gs:[ebp + 0x64], si
arpl word [ebp + 0x64], si
and dword [eax], eax
nop
nop
nop
nop
nop
add byte [eax - 0x6f6f6f70], dl
nop
nop
inc ecx
and byte [ebx + 0x65], dh
arpl word [ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x20], 0x6f727265
jb 0x43cd60
outsd dx, dword [esi]
jb 0x43cd11
outsd dx, dword [esi]
and byte [ebp + 0x6e], dh
imul ebp, dword [esi + 0x6f], 0x77
outsb dx, byte [esi]
and byte [ebx + 0x61], ah
popal
jne 0x43cd73
and byte gs:[eax + 0x61], ch
jae 0x43cd26
bound esp, qword [ebp + 0x65]
outsb dx, byte [esi]
and byte [ebp + 0x74], ah
arpl word gs:[ebp + 0x64], si
and byte [edi + 0x68], dh
and byte fs:[edi + 0x68], dh
imul esp, dword [ebx + 0x68], 0x73616820
or ah, byte [ebx + 0x6f]
push 0x630a7361
outsd dx, dword [esi]
jb 0x43cd94
jb 0x43cd98
jne 0x43cd94
jo 0x43cd99
je 0x43cd8b
and byte fs:[eax + ebp*2 + 0x65], dh
and byte fs:[eax + ebp*2 + 0x65], dh
push 0x72702065
and byte [eax + 0x72], dh
outsd dx, dword [esi]
jb 0x43cd93
insd dword es:[edi], dx
daa
jae 0x43cd56
imul ebp, dword [esi + 0x74], 0x616e7265
je 0x43cd9f
jb 0x43cdaa
popal
insb byte es:[edi], dx
and byte [ebx + 0x74], dh
popal
je 0x43cda9
and byte cs:[eax], ah
push esp
push 0x72702065
outsd dx, dword [esi]
jb 0x43cdb2
insd dword es:[edi], dx
and byte [ebx + 0x61], ah
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
je 0x43cd7a
jae 0x43cdbd
insb byte es:[edi], dx
jns 0x43cd6b
or ah, byte [ebx + 0x6f]
outsb dx, byte [esi]
arpl word [edi + 0x6e], bp
je 0x43cdcf
outsb dx, byte [esi]
jne 0x43cdce
and byte [ebp + 0x78], ah
arpl word gs:[ebp + 0x74], si
js 0x43cdd2
arpl word [ebp + 0x74], si
imul ebp, dword [edi + 0x6e], 0x646e6120
and byte [ebp + 0x75], ch
and byte [ecx + 0x6e], ah
and byte fs:[ebp + 0x75], ch
jae 0x43cdf0
and byte [esi + 0x6f], ch
ja 0x43cda1
bound esp, qword [ebp + 0x20]
je 0x43cdeb
jb 0x43cdf5
imul ebp, dword [esi + 0x61], 0x2e646574
or al, byte [eax]
je 0x43cdf2
or al, byte cs:[eax]
nop
nop
nop
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x6f], 0x77
outsb dx, byte [esi]
outsd dx, dword [esi]
ja 0x43ce09
and byte [ebx + 0x65], dh
arpl word [ebp + 0x72], si
jne 0x43ce13
imul esi, dword [ecx + edi*2 + 0x20], 0x6c696166
jne 0x43ce1d
jb 0x43ce11
and byte gs:[ebp + 0x74], ah
and byte [ebp + 0x74], ah
arpl word gs:[ebp + 0x64], si
and dword [eax], eax
je 0x43ce19
and dword fs:[eax], eax
nop
retf
or byte [ebx - 0x3c09f7a2], cl
add esi, dword [ebp + 0x1b]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x43cdf2
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x43cdf9
cmp ebx, dword [eax + 4]
jae 0x43cdf9
xor eax, eax
jmp 0x43cfe9
lock add dword [eax], eax
add byte [edi - 0x75], dl
jle 0x43ce09
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x43ce0a
xor eax, eax
inc eax
jmp 0x43cfe8
add byte [ebx], dh
ror byte [ecx - 0x3c74f7ab], cl
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x43ce20
cmp ecx, edx
jae 0x43cf65
retf 0x830f
add dword [eax], eax
add byte [ebx + 0x74000478], al
add edi, edi
inc ebp
or byte [edx - 0x7d], al
ror byte [ebx + edi], 0xd7
cmp dword [eax + 4], 0
je 0x43ce29
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x43ce11
cmp dword [ebp + 8], 0
je 0x43ce4b
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x43cf65
cmp eax, esi
jae 0x43cf65
mov eax, dword [0x44e9f8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x43ce70
cmp dword [esi*4 + 0x44ea00], edi
je 0x43cf69
inc esi
cmp esi, eax
jl 0x43ce5e
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x43cfe5
cmp dword [ebp - 8], 0x1000000
jne 0x43cfe5
test byte [ebp - 0xc], 0xcc
je 0x43ceee
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x43cfe5
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x43cfe5
cmp word [eax + 0x18], 0x10b
jne 0x43cfe5
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x43cfe5
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x43ceee
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x43ceee
test byte [ecx + 0x27], 0x80
jne 0x43cf65
push 1
push 0x44ea40
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x43ce02
mov ecx, dword [0x44e9f8]
test ecx, ecx
mov edx, ecx
jle 0x43cf22
lea eax, [ecx*4 + 0x44e9fc]
cmp dword [eax], edi
je 0x43cf22
dec edx
sub eax, 4
test edx, edx
jg 0x43cf16
test edx, edx
jne 0x43cf53
push 0xf
pop ebx
cmp ecx, ebx
jg 0x43cf2f
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x43cf47
lea eax, [edx*4 + 0x44ea00]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x43cf35
cmp ecx, 0x10
jge 0x43cf53
inc ecx
mov dword [0x44e9f8], ecx
push 0
push 0x44ea40
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x43ce02
xor eax, eax
jmp 0x43cfe8
test esi, esi
jle 0x43ce02
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x44ea40
call ebx
test eax, eax
jne 0x43ce02
cmp dword [esi*4 + 0x44ea00], edi
je 0x43cfbf
mov eax, dword [0x44e9f8]
lea esi, [eax - 1]
test esi, esi
jl 0x43cfad
cmp dword [esi*4 + 0x44ea00], edi
je 0x43cfa9
dec esi
jns 0x43cf9d
test esi, esi
jge 0x43cfbd
cmp eax, 0x10
jge 0x43cfb8
inc eax
mov dword [0x44e9f8], eax
lea esi, [eax - 1]
jmp 0x43cfbf
je 0x43cfd7
xor ecx, ecx
test esi, esi
jl 0x43cfd7
lea eax, [ecx*4 + 0x44ea00]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x43cfc5
push 0
push 0x44ea40
call ebx
jmp 0x43ce02
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret