Function at 0x438c20
Capabilities:
Create process on windows
Get common file path
Get file size
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5396f8
push 0x524140
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov dword [ebp - 0x30], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
push 0x800
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1c], eax
push 0x400
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x28], eax
push 0x400
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x24], eax
push 0x400
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], ebx
je 0x438ebc
cmp dword [ebp - 0x28], ebx
je 0x438ebc
cmp dword [ebp - 0x24], ebx
je 0x438ebc
cmp eax, ebx
je 0x438ebc
lea edi, [ebp - 0x9c]
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov dword [ebp - 0x9c], 0x44
mov eax, dword [ebp - 0x1c]
mov byte [eax], bl
mov eax, dword [ebp - 0x28]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [ebp - 0x24]
push eax
push ebx
push 0x54aacc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0x400
mov eax, dword [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.MSVCR80.dll_strrchr]
add esp, 8
test eax, eax
je 0x438d43
mov byte [eax], bl
mov eax, dword [ebp - 0x20]
push eax
push str._sCNIDSK16.EXE
mov edi, dword [ebp - 0x1c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
mov eax, dword [ebp - 0x24]
push eax
push str.__s
mov edi, dword [ebp - 0x1c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
mov dword [ebp - 0x2c], 1
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp + 8], ecx
jle 0x438ddd
mov eax, dword [ebp + 0xc]
lea esi, [eax + ecx*4]
mov eax, dword [esi]
push eax
push 0x54aaac
mov edi, dword [ebp - 0x1c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
add esi, 4
inc dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp + 8], ecx
jg 0x438da8
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x438ebc
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x438e2c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x438ebc
push 0
push 0x4000080
push 3
push 0
push 0
push Ordinal_4
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x438ebc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x438eb5
lea eax, [edi + 1]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x438eb5
push 0
lea eax, [ebp - 0x48]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438ea5
mov eax, dword [ebp + 0x10]
push eax
push 1
push edi
push ebx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
call fcn.00438edc
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret