Function at 0x40ce18
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1068
call fcn.0044d9b0
mov dword [esp], 0xaa937b77
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp]
cmp eax, 0xf247de0e
jle 0x40cebe
cmp eax, 0x241b1474
jle 0x40cf1c
cmp eax, 0x602deeae
jg 0x40cf9b
cmp eax, 0x4431cd5a
jg 0x40d0c9
cmp eax, 0x241b1475
je 0x40d23a
cmp eax, 0x3a09e3b4
je 0x40d25a
cmp eax, 0x3bc3b379
jne 0x40ce4e
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov dword [esp], 0xa3fe076
jmp 0x40ce4e
cmp eax, 0xc3501d21
jle 0x40cf5f
cmp eax, 0xdd27e91a
jle 0x40cfd3
cmp eax, 0xe7dc6a3d
jg 0x40d0ff
cmp eax, 0xdd27e91b
je 0x40d27b
cmp eax, 0xe04cd1ec
je 0x40d2ab
cmp eax, 0xe26df8f2
jne 0x40ce4e
imul edi, edi, 0x638000
call fcn.0040ce18
call fcn.0040ce18
mov dword [esp], 0xa076448d
jmp 0x40ce4e
cmp eax, 0x80ea685
jg 0x40d01c
cmp eax, 0x845a73
jle 0x40d137
cmp eax, 0x845a74
je 0x40d2bb
cmp eax, 0x6f0d1ed
je 0x40d2ed
cmp eax, 0x76d9ca6
jne 0x40ce4e
mov dword [esp], 0x602deeaf
jmp 0x40ce4e
cmp eax, 0xa076448c
jg 0x40d064
cmp eax, 0x895cf965
jle 0x40d16a
cmp eax, 0x895cf966
je 0x40d303
cmp eax, 0x90fbe531
je 0x40d321
cmp eax, 0x9d1fe6d8
je 0x40d5aa
jmp 0x40ce4e
cmp eax, 0x65a2ab42
jle 0x40d194
cmp eax, 0x65a2ab43
je 0x40d348
cmp eax, 0x724743a3
je 0x40d356
cmp eax, 0x7e43d795
jne 0x40ce4e
mov dword [esp], 0xc3501d22
jmp 0x40ce4e
cmp eax, 0xc7b8ff6c
jle 0x40d1b6
cmp eax, 0xc7b8ff6d
je 0x40d362
cmp eax, 0xccb8bb14
je 0x40d396
cmp eax, 0xd85c26d6
jne 0x40ce4e
mov eax, dword [esp + 4]
shl eax, 0xd
or eax, 0x5c
imul eax, eax, 0x31
mov dword [esp + 4], eax
mov dword [esp], 0xa076448d
jmp 0x40ce4e
cmp eax, 0x12caeac4
jle 0x40d1e5
cmp eax, 0x12caeac5
je 0x40d3b3
cmp eax, 0x13d0c0b8
je 0x40d3e7
cmp eax, 0x1ceb96f1
jne 0x40ce4e
push dword [esp + 0x14]
call fcn.00460ec4
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp], 0x76d9ca6
jmp 0x40ce4e
cmp eax, 0xb2409be5
jle 0x40d218
cmp eax, 0xb2409be6
je 0x40d3ff
cmp eax, 0xb244b70c
je 0x40d40b
cmp eax, 0xbf8677a6
jne 0x40ce4e
mov eax, dword [esp + 4]
lea ecx, [eax + 0x86]
imul ecx, ecx
imul edx, ecx, 0x1e5
dec edx
shl eax, 7
add eax, 0x3800
mov dword [esp + 4], eax
mov eax, 0x4da77fde
cmp ecx, edx
je 0x40d0be
mov eax, 0x65a2ab43
mov dword [esp], eax
xor esi, esi
inc esi
jmp 0x40ce4e
cmp eax, 0x4431cd5b
je 0x40d431
cmp eax, 0x4da77fde
jne 0x40d590
mov ecx, dword [esp + 0x3c]
add ecx, 0x30
mov eax, 0x12caeac5
cmp ecx, dword [esp + 0x14]
ja 0x40d55e
mov eax, 0xccb8bb14
jmp 0x40d55e
cmp eax, 0xe7dc6a3e
je 0x40d469
cmp eax, 0xeb227f65
jne 0x40d59d
cmp dword [0x482c30], 1
mov eax, 0x459792f2
je 0x40d128
mov eax, 0xf6c5cd5b
mov dword [esp], eax
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
jmp 0x40ce4e
cmp eax, 0xf247de0f
je 0x40d48d
cmp eax, 0xf6c5cd5b
jne 0x40ce4e
imul eax, dword [esp + 4], 0xd100
add eax, 0xffffd65d
mov dword [esp + 4], eax
mov dword [esp], 0x724743a3
jmp 0x40ce4e
cmp eax, 0x88be01a0
je 0x40d4b0
cmp eax, 0x8927a85f
jne 0x40ce4e
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
mov dword [esp], 0xb2409be6
jmp 0x40ce4e
cmp eax, 0x602deeaf
je 0x40d4c8
cmp eax, 0x64ee4232
jne 0x40ce4e
mov dword [esp], 0x3bc3b379
jmp 0x40ce4e
cmp eax, 0xc3501d22
je 0x40d51e
cmp eax, 0xc71cd4ca
jne 0x40ce4e
call fcn.0040d610
mov dword [esp], 0x8927a85f
mov dword [esp + 8], 0
jmp 0x40ce4e
cmp eax, 0x80ea686
je 0x40d53c
cmp eax, 0xa3fe076
jne 0x40ce4e
imul eax, dword [esp + 4], 0x34000000
add eax, 0x15b40000
mov dword [esp + 4], eax
mov dword [esp], 0x3a09e3b4
jmp 0x40ce4e
cmp eax, 0xa076448d
je 0x40d566
cmp eax, 0xaa937b77
jne 0x40ce4e
mov dword [esp], 0x241b1475
jmp 0x40ce4e
lea eax, [esp + 0x50]
push eax
push 0x1c
push 0x482c30
call fcn.0040e540
add esp, 0xc
mov dword [esp], 0xd85c26d6
jmp 0x40ce4e
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [0x482c34]
mov dword [esp + 0x3c], eax
mov dword [esp], 0x4da77fde
jmp 0x40ce4e
xor eax, eax
push eax
push 0x80
mov ecx, 3
push ecx
push eax
push ecx
push 0x80000000
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0xc], eax
mov dword [esp], 0x13d0c0b8
jmp 0x40ce4e
mov dword [esp], 0x459792f2
mov dword [esp + 0x10], ebx
jmp 0x40ce4e
mov ecx, dword [esp + 4]
add ecx, 0x54
imul eax, ecx, 0xb0f
imul ecx, ecx
imul edx, ecx, 0x48ab
dec edx
mov dword [esp + 4], eax
mov eax, 0x895cf966
cmp ecx, edx
je 0x40d55e
mov eax, 0xdd27e91b
jmp 0x40d55e
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0xbf8677a6
jmp 0x40ce4e
push 0x800
lea eax, [esp + 0x68]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esp], 0x845a74
jmp 0x40ce4e
imul edi, edi, 0x3d04
add edi, 0xff9dcdb0
mov eax, 0x80ea686
cmp edi, 0xf0
jl 0x40d55e
mov eax, 0xe7dc6a3e
jmp 0x40d55e
mov dword [esp], 0xe04cd1ec
mov ebx, esi
jmp 0x40ce4e
mov dword [esp], 0x895cf966
jmp 0x40ce4e
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 9
imul eax, eax
shr ecx, 0xd
imul edx, eax, 0x1c2f
dec edx
add ecx, 0xffffffba
mov dword [esp + 4], ecx
mov ecx, 0x1ceb96f1
cmp edx, eax
je 0x40d588
mov ecx, 0x9d1fe6d8
jmp 0x40d588
imul eax, dword [esp + 4], 0x1ee000
add eax, 0xffff5719
mov dword [esp + 4], eax
mov dword [esp], 0x1ceb96f1
jmp 0x40ce4e
mov eax, dword [esp + 4]
lea ecx, [eax + 0x10e]
imul ecx, ecx
imul edx, ecx, 0x1321
dec edx
add eax, 0x162
mov dword [esp + 4], eax
mov eax, 0x895cf966
cmp edx, ecx
je 0x40d55e
mov eax, 0x6f0d1ed
jmp 0x40d55e
imul eax, dword [esp + 4], 0x2e00
mov dword [esp + 4], eax
mov dword [esp], 0x7e43d795
jmp 0x40ce4e
mov dword [esp], 0x88be01a0
jmp 0x40ce4e
imul edi, edi, 0x69
add edi, 0x2139
call fcn.0040d610
mov eax, 0x241b1475
cmp edi, 4
jge 0x40d55e
mov eax, 0xa076448d
jmp 0x40d55e
mov eax, dword [esp + 4]
mov ecx, 0xffffff4e
add eax, ecx
shr eax, 8
mov dword [esp + 4], eax
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x5abd
dec edx
mov eax, 0xc3501d22
cmp ecx, edx
je 0x40d45d
mov eax, 0x65a2ab43
mov dword [esp], eax
mov esi, dword [esp + 0x44]
jmp 0x40ce4e
imul edi, edi, 0xbde0
add edi, 0xa3eae8
mov eax, 0xb244b70c
cmp edi, 0x23
jae 0x40d55e
mov eax, 0xe26df8f2
jmp 0x40d55e
lea eax, [edi + edi*8]
lea edi, [eax + eax*2]
add edi, 0xfffff58f
shr edi, 0xa
and edi, 0xfffffffe
call fcn.0040d610
mov dword [esp], 0xeb227f65
jmp 0x40ce4e
push dword [esp + 0x18]
call fcn.00460b1c
add esp, 4
mov dword [esp], 0x4431cd5b
jmp 0x40ce4e
xor eax, eax
mov dword [esp + 0x38], eax
push eax
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x482c34]
mov ecx, dword [esp + 0x18]
add eax, ecx
add eax, 8
push 0x14
push 0x482c38
push eax
call fcn.0044e9dd
add esp, 0xc
mov dword [esp + 0x40], eax
mov dword [esp], 0xc7b8ff6d
jmp 0x40ce4e
mov ecx, dword [esp + 0xc]
mov eax, 0xe04cd1ec
cmp ecx, 0xffffffff
je 0x40d531
mov eax, 0x64ee4232
mov dword [esp], eax
xor ebx, ebx
inc ebx
jmp 0x40ce4e
add edi, 0xffffff63
call fcn.0040ce18
call fcn.0040d610
mov eax, 0xf247de0f
cmp edi, 0xee
jae 0x40d55e
mov eax, 0xeb227f65
mov dword [esp], eax
jmp 0x40ce4e
push 0x14
push 0x482c4c
lea eax, [esp + 0x58]
push eax
call fcn.0044e9dd
add esp, 0xc
mov ecx, 0xeb227f65
test eax, eax
je 0x40d588
mov ecx, 0xeee9bf99
mov dword [esp], ecx
jmp 0x40ce4e
cmp eax, 0x459792f2
jne 0x40ce4e
jmp 0x40d5c6
cmp eax, 0xeee9bf99
jne 0x40ce4e
jmp 0x40d5ec
cmp dword [esp + 0x40], 0
mov eax, 0xc71cd4ca
je 0x40d5bb
mov eax, 0x8927a85f
mov dword [esp], eax
xor eax, eax
inc eax
jmp 0x40ce4a
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], esi
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], esi
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]