Function at 0x4103aa
Capabilities:
Bypass windows file protection
Get file attributes
Read file on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov eax, 0xb3c8
call fcn.0041e630
push ebx
push ebp
push esi
push edi
push 0x433b60
xor bh, bh
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x41042f
push 0x433b74
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov bl, byte [esp + 0xb3dc]
mov edi, eax
test edi, edi
je 0x4103fc
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 0x4335b4
push ecx
mov ecx, edi
call dword [fcn.00433260]
call edi
push 0x433b88
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x41042f
xor ecx, ecx
test bl, bl
sete cl
dec ecx
and ecx, 0xfffff800
add ecx, 0x1000
push ecx
mov ecx, esi
call dword [fcn.00433260]
call esi
mov bh, 1
mov eax, dword [0x43e080]
or ebp, 0xffffffff
mov dword [esp + 0x14], 0x433ba4
mov esi, 0x800
mov dword [esp + 0x18], 0x433bbc
mov dword [esp + 0x1c], 0x433bd8
cmp byte [eax], 0x78
mov dword [esp + 0x20], 0x433bf0
mov dword [esp + 0x24], 0x433c08
mov dword [esp + 0x28], 0x433c20
mov dword [esp + 0x2c], 0x433c38
mov dword [esp + 0x30], 0x433c50
mov dword [esp + 0x34], 0x433c6c
mov dword [esp + 0x38], 0x433c7c
mov dword [esp + 0x3c], 0x433c90
mov dword [esp + 0x40], 0x433ca8
mov dword [esp + 0x44], 0x433cc0
mov dword [esp + 0x48], 0x433cd8
mov dword [esp + 0x4c], 0x433cf0
mov dword [esp + 0x50], 0x433d04
mov dword [esp + 0x54], 0x433d1c
mov dword [esp + 0x58], 0x433d34
mov dword [esp + 0x5c], 0x433d44
mov dword [esp + 0x60], 0x433d60
mov dword [esp + 0x64], 0x433d78
mov dword [esp + 0x68], 0x433d90
mov dword [esp + 0x6c], 0x433dac
mov dword [esp + 0x70], 0x433dc4
mov dword [esp + 0x74], 0x433ddc
mov dword [esp + 0x78], 0x433df4
mov dword [esp + 0x7c], 0x433e0c
mov dword [esp + 0x80], 0x433e28
mov dword [esp + 0x84], 0x433e40
mov dword [esp + 0x88], 0x433e58
mov dword [esp + 0x8c], 0x433e70
mov dword [esp + 0x90], 0x433e8c
mov dword [esp + 0x94], 0x433ea4
mov dword [esp + 0x98], 0x433ebc
mov dword [esp + 0x9c], 0x433ee0
mov dword [esp + 0xa0], 0x433ef8
mov dword [esp + 0xa4], 0x433f10
mov dword [esp + 0xa8], 0x433f20
mov dword [esp + 0xac], 0x433f3c
mov dword [esp + 0xb0], 0x433f54
mov dword [esp + 0xb4], 0x433f70
mov dword [esp + 0xb8], 0x433f88
mov dword [esp + 0xbc], 0x433fa4
mov dword [esp + 0xc0], 0x433fb4
mov dword [esp + 0xc4], 0x433fcc
mov dword [esp + 0xc8], 0x433fe4
mov dword [esp + 0xcc], 0x433ff8
mov dword [esp + 0xd0], 0x434010
mov dword [esp + 0xd4], 0x434028
mov dword [esp + 0xd8], 0x434040
mov dword [esp + 0xdc], 0x434058
mov dword [esp + 0xe0], 0x434070
mov dword [esp + 0xe4], 0x43408c
mov dword [esp + 0xe8], 0x4340a8
mov dword [esp + 0xec], 0x4340c4
mov dword [esp + 0xf0], 0x4340dc
mov dword [esp + 0xf4], 0x4340f8
mov dword [esp + 0xf8], 0x434110
mov dword [esp + 0xfc], 0x434130
mov dword [esp + 0x100], 0x434144
mov dword [esp + 0x104], 0x43415c
je 0x41075f
push eax
call fcn.004273cd
mov edi, eax
pop ecx
test edi, edi
je 0x41075f
push esi
lea eax, [esp + 0x1314]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 0x80000000
lea eax, [esp + 0x1328]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebp
je 0x410753
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, edi
jne 0x410753
push 0
lea eax, [esp + 0x14]
push eax
push 0x7ffe
lea eax, [esp + 0x33e4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410753
mov eax, dword [esp + 0x10]
shr eax, 1
xor ecx, ecx
push 0x104
mov word [esp + eax*2 + reloc.user32.dll_ShowCursor], cx
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0x33e0]
push eax
jmp 0x410748
lea eax, [esp + 0x108]
push eax
call fcn.00410360
push 0x104
lea eax, [esp + 0x10c]
push eax
push edi
call fcn.0040feb3
mov edi, eax
test edi, edi
jne 0x41072d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x800
push esi
lea eax, [esp + 0x314]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [esp + 0x314]
push eax
call fcn.0040be89
push eax
lea eax, [esp + 0x23e0]
push eax
call fcn.00410131
xor edi, edi
xor esi, esi
call fcn.0040aee5
cmp eax, 0x600
jb 0x4107a7
push dword [esp + esi*4 + 0x14]
call fcn.00410360
jmp 0x4107a9
xor eax, eax
test eax, eax
je 0x4107cd
push ebp
push 0x433bbc
push ebp
push dword [esp + esi*4 + 0x20]
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x4107f5
push 0x800
push dword [esp + esi*4 + 0x18]
lea eax, [esp + 0x318]
push eax
call fcn.0040beff
lea eax, [esp + 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebp
jne 0x4107fd
inc esi
cmp esi, 8
jb 0x410790
jmp 0x410801
mov edi, dword [esp + esi*4 + 0x14]
test bh, bh
jne 0x41083b
xor esi, esi
push 0x800
push dword [esp + esi*4 + 0x38]
lea eax, [esp + 0x318]
push eax
call fcn.0040beff
lea eax, [esp + 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebp
jne 0x410837
inc esi
cmp esi, 0x35
jb 0x410807
jmp 0x41083b
mov edi, dword [esp + esi*4 + 0x34]
test edi, edi
je 0x41094a
lea eax, [esp + 0x310]
push eax
call fcn.0040bed3
call fcn.0040aee5
cmp eax, 0x600
jb 0x4108c2
push 0x433c38
call fcn.00410360
push 0x434178
call fcn.00410360
lea eax, [esp + 0x23d8]
push eax
lea eax, [esp + 0x314]
push eax
push edi
push 0xf1
call fcn.0040e0ac
push eax
lea eax, [esp + 0x1320]
push 0x864
push eax
call fcn.00403f8f
add esp, 0x18
push 0x30
push 0xf0
call fcn.0040e0ac
push eax
lea eax, [esp + 0x1318]
push eax
push 0
call fcn.0041a195
jmp 0x410942
lea eax, [esp + 0x23d8]
push eax
lea eax, [esp + 0x314]
push eax
push edi
push 0x434190
lea eax, [esp + 0x1320]
push 0x864
push eax
call fcn.00403f8f
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x410942
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1318]
push eax
call fcn.00423883
pop ecx
push eax
lea eax, [esp + 0x131c]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb3c8
ret 4