Function at 0x405fb8
Capabilities:
Create process on windows
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40649f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
dec eax
je 0x406000
dec eax
je 0x406015
dec eax
je 0x40602a
dec eax
je 0x40603f
jmp 0x406052
lea eax, [ebp - 0x24]
mov ecx, 0x4064b4
mov edx, dword [0x40a678]
call fcn.00403da0
jmp 0x406052
lea eax, [ebp - 0x24]
mov ecx, 0x4064cc
mov edx, dword [0x40a678]
call fcn.00403da0
jmp 0x406052
lea eax, [ebp - 0x24]
mov ecx, 0x4064e8
mov edx, dword [0x40a678]
call fcn.00403da0
jmp 0x406052
lea eax, [ebp - 0x24]
mov ecx, 0x406508
mov edx, dword [0x40a678]
call fcn.00403da0
push 0
push 0x82
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x24]
call fcn.00403d24
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x406356
xor eax, eax
push ebp
push 0x40634f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x406338
xor eax, eax
push ebp
push 0x406331
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40631a
xor eax, eax
push ebp
push 0x406313
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 2
jg 0x4062f8
push 1
push dword [ebp - 4]
push 8
push 0x4090e0
push 0x4090d8
push 0x4090d0
push 0x4090c8
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0xa
push 0x40910c
push 0x409100
push 0x4090f4
push 0x4090e8
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0xd
push 0x409148
push 0x409138
push 0x409128
push 0x409118
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 9
push 0x40917c
push 0x409170
push 0x409164
push 0x409158
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 9
push 0x40917c
push 0x409170
push 0x409164
push 0x409158
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x24
push 0x4091f4
push 0x4091d0
push 0x4091ac
push 0x409188
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x24
push 0x4091f4
push 0x4091d0
push 0x4091ac
push 0x409188
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x1e
push 0x409278
push 0x409258
push 0x409238
push 0x409218
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x11
push 0x409324
push 0x409310
push 0x4092fc
push 0x4092e8
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 7
push 0x409350
push 0x409348
push 0x409340
push 0x409338
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x47
push 0x409430
push 0x4093e8
push 0x4093a0
push 0x409358
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x47
push 0x409430
push 0x4093e8
push 0x4093a0
push 0x409358
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
cmp byte [0x40a670], 1
jne 0x4062fc
push 1
push dword [ebp - 4]
push 0x12
push 0x4092d4
push 0x4092c0
push 0x4092ac
push 0x409298
push dword [ebp - 8]
call fcn.00404f00
or dword [ebp - 0xc], eax
jmp 0x4062fc
cmp dword [ebp - 0x14], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40631a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406338
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406356
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle
ret
call sub.kernel32.dll_GetLastError
mov dword [0x40a674], eax
cmp dword [0x40a674], 0
je 0x4063e7
lea edx, [ebp - 0x18]
mov eax, dword [0x40a674]
call fcn.00405198
cmp dword [0x40a674], 2
jne 0x40638d
lea eax, [ebp - 0x18]
mov edx, dword [0x4090b0]
call fcn.00403860
cmp dword [0x40a674], 0x20
jne 0x4063a4
lea eax, [ebp - 0x18]
mov edx, dword [0x4090b4]
call fcn.00403860
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
call fcn.00405134
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00404e24
push dword [ebp - 0x28]
push 0x406530
lea edx, [ebp - 0x30]
mov eax, dword [0x40a674]
call fcn.00404dfc
push dword [ebp - 0x30]
push 0x406544
push dword [ebp - 0x18]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.0040390c
mov eax, 0x406550
call fcn.00405b44
test al, al
jne 0x406469
cmp dword [ebp - 0x14], 1
jne 0x40642a
cmp dword [0x40a674], 0
je 0x406469
push 0x40010
push 0x406558
mov eax, dword [ebp - 0x18]
call fcn.00403a4c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x40a674]
mov dword [ebp - 0xc], eax
jmp 0x406469
cmp dword [ebp - 0x14], 2
jne 0x406469
cmp dword [0x40a674], 0
jne 0x406469
cmp dword [ebp - 0xc], 1
jne 0x406469
push 0x40134
push 0x406558
mov eax, dword [0x4090b8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x406469
push 0
push 0x406568
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064a6
lea eax, [ebp - 0x30]
call fcn.00403658
lea eax, [ebp - 0x2c]
call fcn.00403b78
lea eax, [ebp - 0x28]
call fcn.00403658
lea eax, [ebp - 0x24]
call fcn.00403b78
lea eax, [ebp - 0x18]
call fcn.00403658
ret