Function at 0x4093f0
Capabilities:
Create process on windows
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40993f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
call sub.KERNEL32.DLL_SetLastError
mov eax, dword [ebp - 0x14]
dec eax
je 0x409432
dec eax
je 0x409442
jmp 0x409455
lea eax, [ebp - 0x24]
mov edx, dword [0x42a948]
call fcn.00403f44
jmp 0x409455
lea eax, [ebp - 0x24]
mov ecx, 0x409954
mov edx, dword [0x42a948]
call fcn.00404148
push 0
push 0x90000080
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 0x24]
call fcn.004040cc
push eax
call sub.KERNEL32.DLL_CreateFileW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4097c2
xor eax, eax
push ebp
push 0x4097bb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_CreateFileMappingW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40978a
xor eax, eax
push ebp
push 0x409783
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40976c
xor eax, eax
push ebp
push 0x409765
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 2
jg 0x40974a
push 1
push dword [ebp - 4]
push 8
push 0x40d11c
push 0x40d114
push 0x40d10c
push 0x40d104
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0xa
push 0x40d148
push 0x40d13c
push 0x40d130
push 0x40d124
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0xd
push 0x40d184
push 0x40d174
push 0x40d164
push 0x40d154
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 9
push 0x40d1b8
push 0x40d1ac
push 0x40d1a0
push 0x40d194
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 9
push 0x40d1b8
push 0x40d1ac
push 0x40d1a0
push 0x40d194
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x34
push 0x40d260
push 0x40d22c
push 0x40d1f8
push 0x40d1c4
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0xe
push 0x40d2c4
push 0x40d2b4
push 0x40d2a4
push 0x40d294
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x24
push 0x40d340
push 0x40d31c
push 0x40d2f8
push 0x40d2d4
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x24
push 0x40d340
push 0x40d31c
push 0x40d2f8
push 0x40d2d4
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x1e
push 0x40d3c4
push 0x40d3a4
push 0x40d384
push 0x40d364
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x11
push 0x40d470
push 0x40d45c
push 0x40d448
push 0x40d434
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 7
push 0x40d49c
push 0x40d494
push 0x40d48c
push 0x40d484
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x47
push 0x40d57c
push 0x40d534
push 0x40d4ec
push 0x40d4a4
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x47
push 0x40d57c
push 0x40d534
push 0x40d4ec
push 0x40d4a4
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
cmp byte [0x40d0a8], 1
jne 0x40974e
push 1
push dword [ebp - 4]
push 0x12
push 0x40d420
push 0x40d40c
push 0x40d3f8
push 0x40d3e4
push dword [ebp - 8]
call fcn.00407c00
or dword [ebp - 0xc], eax
jmp 0x40974e
cmp dword [ebp - 0x14], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40976c
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40978a
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4097c2
cmp byte [0x40d0ac], 0
je 0x4097b1
cmp dword [ebp - 0xc], 0
je 0x4097b1
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.IMAGEHLP.DLL_ImageRemoveCertificate
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
call sub.KERNEL32.DLL_GetLastError
mov dword [0x42a93c], eax
cmp dword [0x42a93c], 0
je 0x409887
lea edx, [ebp - 0x18]
mov eax, dword [0x42a93c]
call fcn.00407e98
cmp dword [0x42a93c], 2
je 0x40980d
cmp dword [0x42a93c], 3
je 0x40980d
cmp dword [0x42a93c], 4
je 0x40980d
cmp dword [0x42a93c], 0x3ee
jne 0x40981b
lea eax, [ebp - 0x18]
mov edx, dword [0x40d0c4]
call fcn.00403ab8
cmp dword [0x42a93c], 5
je 0x409836
cmp dword [0x42a93c], 0x20
je 0x409836
cmp dword [0x42a93c], 0x21
jne 0x409844
lea eax, [ebp - 0x18]
mov edx, dword [0x40d0c8]
call fcn.00403ab8
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
call fcn.00407e34
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00407b24
push dword [ebp - 0x28]
push 0x409964
lea edx, [ebp - 0x30]
mov eax, dword [0x42a93c]
call fcn.00407afc
push dword [ebp - 0x30]
push 0x409978
push dword [ebp - 0x18]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00403be0
mov eax, 0x409984
call fcn.0040840c
test al, al
jne 0x409909
cmp dword [ebp - 0x14], 1
jne 0x4098ca
cmp dword [0x42a93c], 0
je 0x409909
push 0x40010
push 0x40998c
mov eax, dword [ebp - 0x18]
call fcn.00403d20
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.USER32.DLL_MessageBoxA_1
mov eax, dword [0x42a93c]
mov dword [ebp - 0xc], eax
jmp 0x409909
cmp dword [ebp - 0x14], 2
jne 0x409909
cmp dword [0x42a93c], 0
jne 0x409909
cmp dword [ebp - 0xc], 1
jne 0x409909
push 0x40134
push 0x40998c
mov eax, dword [0x40d0cc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.USER32.DLL_MessageBoxA_1
cmp eax, 6
jne 0x409909
push 0
push 0x4099a4
call sub.KERNEL32.DLL_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409946
lea eax, [ebp - 0x30]
call fcn.004038b0
lea eax, [ebp - 0x2c]
call fcn.00403ee4
lea eax, [ebp - 0x28]
call fcn.004038b0
lea eax, [ebp - 0x24]
call fcn.00403ee4
lea eax, [ebp - 0x18]
call fcn.004038b0
ret