Function at 0xedfd60
Capabilities:
Get file attributes
Read file on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov eax, 0xb3cc
call fcn.00eed9c0
push ebx
push ebp
push esi
push edi
push 0xf02890
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0xedfdd5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xf028a4
push esi
call edi
mov bl, byte [esp + 0xb3e0]
test eax, eax
je 0xedfdad
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 0xf022e4
push ecx
call eax
push 0xf028b8
push esi
call edi
test eax, eax
je 0xedfdd5
xor ecx, ecx
test bl, bl
sete cl
dec ecx
and ecx, 0xfffff800
add ecx, 0x1000
push ecx
call eax
mov byte [esp + 0x13], 1
mov eax, dword [0xf0d080]
or ebp, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x800
mov dword [esp + 0x18], 0xf028d4
mov dword [esp + 0x1c], 0xf028ec
cmp byte [eax], 0x78
mov dword [esp + 0x20], 0xf02908
mov dword [esp + 0x24], 0xf02920
mov dword [esp + 0x28], 0xf02938
mov dword [esp + 0x2c], 0xf02950
mov dword [esp + 0x30], 0xf02968
mov dword [esp + 0x34], 0xf02980
mov dword [esp + 0x38], 0xf0299c
mov dword [esp + 0x3c], 0xf029ac
mov dword [esp + 0x40], 0xf029c0
mov dword [esp + 0x44], 0xf029d8
mov dword [esp + 0x48], 0xf029f0
mov dword [esp + 0x4c], 0xf02a08
mov dword [esp + 0x50], 0xf02a20
mov dword [esp + 0x54], 0xf02a34
mov dword [esp + 0x58], 0xf02a4c
mov dword [esp + 0x5c], 0xf02a64
mov dword [esp + 0x60], 0xf02a74
mov dword [esp + 0x64], 0xf02a90
mov dword [esp + 0x68], 0xf02aa8
mov dword [esp + 0x6c], 0xf02ac0
mov dword [esp + 0x70], 0xf02adc
mov dword [esp + 0x74], 0xf02af4
mov dword [esp + 0x78], 0xf02b0c
mov dword [esp + 0x7c], 0xf02b24
mov dword [esp + 0x80], 0xf02b3c
mov dword [esp + 0x84], 0xf02b58
mov dword [esp + 0x88], 0xf02b70
mov dword [esp + 0x8c], 0xf02b88
mov dword [esp + 0x90], 0xf02ba0
mov dword [esp + 0x94], 0xf02bbc
mov dword [esp + 0x98], 0xf02bd4
mov dword [esp + 0x9c], 0xf02bec
mov dword [esp + 0xa0], 0xf02c10
mov dword [esp + 0xa4], 0xf02c28
mov dword [esp + 0xa8], 0xf02c40
mov dword [esp + 0xac], 0xf02c50
mov dword [esp + 0xb0], 0xf02c6c
mov dword [esp + 0xb4], 0xf02c84
mov dword [esp + 0xb8], 0xf02ca0
mov dword [esp + 0xbc], 0xf02cb8
mov dword [esp + 0xc0], 0xf02cd4
mov dword [esp + 0xc4], 0xf02ce4
mov dword [esp + 0xc8], 0xf02cfc
mov dword [esp + 0xcc], 0xf02d14
mov dword [esp + 0xd0], 0xf02d28
mov dword [esp + 0xd4], 0xf02d40
mov dword [esp + 0xd8], 0xf02d58
mov dword [esp + 0xdc], 0xf02d70
mov dword [esp + 0xe0], 0xf02d88
mov dword [esp + 0xe4], 0xf02da0
mov dword [esp + 0xe8], 0xf02dbc
mov dword [esp + 0xec], 0xf02dd8
mov dword [esp + 0xf0], 0xf02df4
mov dword [esp + 0xf4], 0xf02e0c
mov dword [esp + 0xf8], 0xf02e28
mov dword [esp + 0xfc], 0xf02e40
mov dword [esp + 0x100], 0xf02e60
mov dword [esp + 0x104], 0xf02e74
mov dword [esp + 0x108], 0xf02e8c
je 0xee010a
push eax
call fcn.00ef66d8
mov edi, eax
pop ecx
test edi, edi
je 0xee010a
push esi
lea eax, [esp + 0x1318]
push eax
push 0
call ebx
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 0x80000000
lea eax, [esp + 0x132c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebp
je 0xee00fe
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, edi
jne 0xee00fe
push 0
lea eax, [esp + 0x18]
push eax
push 0x7ffe
lea eax, [esp + 0x33e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xee00fe
mov eax, dword [esp + 0x14]
shr eax, 1
xor ecx, ecx
push 0x104
mov word [esp + eax*2 + 0x33e0], cx
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x33e4]
push eax
jmp 0xee00f3
lea eax, [esp + 0x10c]
push eax
call fcn.00edfd16
push 0x104
lea eax, [esp + 0x110]
push eax
push edi
call fcn.00edf86b
mov edi, eax
test edi, edi
jne 0xee00d8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x800
push esi
lea eax, [esp + 0x318]
push eax
push 0
call ebx
push esi
lea eax, [esp + 0x318]
push eax
call fcn.00edb9e0
push eax
lea eax, [esp + 0x23e4]
push eax
call fcn.00edfae7
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edi, edi
xor esi, esi
call fcn.00edaa39
cmp eax, 0x600
jb 0xee0154
push dword [esp + esi*4 + 0x18]
call fcn.00edfd16
jmp 0xee0156
xor eax, eax
test eax, eax
je 0xee017a
push ebp
push 0xf028ec
push ebp
push dword [esp + esi*4 + 0x24]
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0xee019e
push 0x800
push dword [esp + esi*4 + 0x1c]
lea eax, [esp + 0x31c]
push eax
call fcn.00edba56
lea eax, [esp + 0x314]
push eax
call ebx
cmp eax, ebp
jne 0xee01a6
inc esi
cmp esi, 8
jb 0xee013d
jmp 0xee01aa
mov edi, dword [esp + esi*4 + 0x18]
cmp byte [esp + 0x13], 0
jne 0xee01e3
xor esi, esi
push 0x800
push dword [esp + esi*4 + 0x3c]
lea eax, [esp + 0x31c]
push eax
call fcn.00edba56
lea eax, [esp + 0x314]
push eax
call ebx
cmp eax, ebp
jne 0xee01df
inc esi
cmp esi, 0x35
jb 0xee01b3
jmp 0xee01e3
mov edi, dword [esp + esi*4 + 0x38]
test edi, edi
je 0xee02f2
lea eax, [esp + 0x314]
push eax
call fcn.00edba2a
call fcn.00edaa39
cmp eax, 0x600
jb 0xee026a
push 0xf02968
call fcn.00edfd16
push 0xf02ea8
call fcn.00edfd16
lea eax, [esp + 0x23dc]
push eax
lea eax, [esp + 0x318]
push eax
push edi
push 0xf1
call fcn.00edda8b
push eax
lea eax, [esp + 0x1324]
push 0x864
push eax
call fcn.00ed3f53
add esp, 0x18
push 0x30
push 0xf0
call fcn.00edda8b
push eax
lea eax, [esp + 0x131c]
push eax
push 0
call fcn.00ee97a8
jmp 0xee02ea
lea eax, [esp + 0x23dc]
push eax
lea eax, [esp + 0x318]
push eax
push edi
push 0xf02ec0
lea eax, [esp + 0x1324]
push 0x864
push eax
call fcn.00ed3f53
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0xee02ea
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x131c]
push eax
call fcn.00ef2b93
pop ecx
push eax
lea eax, [esp + 0x1320]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb3cc
ret 4