Function at 0x43c3d0
Capabilities:
Encode data using xor
Get file size
Read file on windows
Read from mailslot

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb9c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x524ee0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov ecx, dword [0x526340]
mov dword [ebp - 4], 0
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x17
idiv ecx
cmp edx, 0x16
jne 0x43c425
inc dword [0x52778c]
mov eax, dword [ebp + 0xc]
or edi, 0xffffffff
cmp dword [eax - 0xc], 0
jl 0x43c7e4
push str.chrome
push eax
call fcn.004a9f2f
add esp, 8
test eax, eax
je 0x43c7e4
mov ecx, dword [ebp + 0xc]
sub eax, ecx
sar eax, 1
test eax, eax
jle 0x43c7e4
push 0x5c
push ecx
call fcn.004a9e89
mov esi, eax
add esp, 8
test esi, esi
jne 0x43c46f
or esi, edi
jmp 0x43c474
sub esi, dword [ebp + 0xc]
sar esi, 1
call fcn.0043fa10
test al, al
jne 0x43c483
dec dword [0x526340]
test esi, esi
jle 0x43c7e4
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040bd70
mov byte [ebp - 4], 1
call fcn.0043fb10
test al, al
jne 0x43c537
mov edx, dword [0x526340]
xor esi, esi
mov ecx, esi
and ecx, 1
dec ecx
not ecx
and ecx, edx
mov eax, esi
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
inc esi
add edx, eax
cmp esi, 0x100
jl 0x43c4b4
mov dword [0x526340], edx
push str.VisualElementsManifest.xml
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040b6c0
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
mov byte [ebp - 4], 2
jge 0x43c56f
push 0
lea ecx, [ebp - 0x10]
call fcn.004085d0
mov eax, dword [ebp - 0x10]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [0x526340]
mov ebx, eax
lea eax, [esi + 1]
imul eax, esi
cdq
mov ecx, 0x11
idiv ecx
cmp edx, 0xa
jne 0x43c5b9
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov esi, dword [0x526340]
test ebx, ebx
je 0x43c78b
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 0xa]
push ecx
call fcn.004a97a2
add esp, 4
lea ecx, [ebp - 0x18]
push 0
push ecx
push esi
push eax
push ebx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call fcn.0043f940
test al, al
jne 0x43c5fd
call fcn.004a96f9
mov dword [0x526340], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov byte [eax + esi], 0
mov ecx, dword [0x526340]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov ecx, 0xe
idiv ecx
cmp edx, 9
jne 0x43c62f
dec dword [0x5277a0]
push str.SplashScreen_Image
push esi
call fcn.004ab860
mov esi, dword [0x526340]
mov ebx, eax
mov eax, esi
imul eax, esi
cdq
mov ecx, 0xf
idiv ecx
add esp, 8
cmp edx, 0xe
jne 0x43c67b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, dword [0x526340]
test ebx, ebx
je 0x43c78b
call fcn.0043fab0
test al, al
jne 0x43c6ed
test esi, esi
je 0x43c6ed
mov eax, esi
and eax, 0x80000001
jns 0x43c69e
dec eax
or eax, 0xfffffffe
inc eax
jne 0x43c6ab
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x43c6b2
lea esi, [esi*2 + 1]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*2]
sub ecx, eax
mov dword [0x526340], esi
sub ecx, 0
je 0x43c6dc
sub ecx, 2
je 0x43c6df
dec ecx
je 0x43c6e0
jmp 0x43c6e9
add esi, 2
inc esi
add esi, 2
mov dword [0x526340], esi
test esi, esi
jne 0x43c690
add ebx, 0x14
push 0x5c
push ebx
call fcn.004ab730
add esp, 8
test eax, eax
je 0x43c765
sub esp, 0x18
mov ecx, esp
push ebx
mov byte [eax], 0
call fcn.00401000
mov ebx, dword [ebp + 8]
push ebx
call fcn.004512c0
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
or edi, 0xffffffff
add esp, 0x1c
mov byte [ebp - 4], 1
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43c73c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43c7f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x43c7f3
call fcn.0043fab0
test al, al
jne 0x43c785
push 0xef
push 0xee
push str._d__d_n
call fcn.004aa80e
add esp, 0xc
mov esi, dword [0x526340]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0x14
idiv ecx
cmp edx, 0xd
jne 0x43c7a4
dec esi
mov dword [0x526340], esi
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43c7c4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43c7e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp + 8]
push 0x4e4260
mov ecx, ebx
call fcn.00401ff0
mov esi, dword [ebp + 0xc]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x43c814
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret