Function at 0x40cf38
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov esi, esp
mov dword [esi + 4], 0xaa937b77
mov ebx, dword [esi + 0x44]
mov eax, dword [esi + 0x34]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x38]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x10], eax
mov edi, dword [esi + 0x40]
mov eax, dword [esi + 4]
cmp eax, 0x6f0d1ec
jg 0x40cfd1
cmp eax, 0xc71cd4c9
jg 0x40d036
cmp eax, 0xaa937b76
jle 0x40d13a
cmp eax, 0xb244b70b
jle 0x40d224
cmp eax, 0xbf8677a5
jg 0x40d3e2
cmp eax, 0xb244b70c
je 0x40d4b1
cmp eax, 0xbcf08c18
jne 0x40cf65
imul ebx, ebx, 0x69000
add ebx, 0xa54b000
mov eax, 0xaf97212b
cmp ebx, 0x6c
jge 0x40d7eb
mov eax, 0x895cf966
jmp 0x40d7eb
cmp eax, 0x4157743e
jle 0x40d088
cmp eax, 0x5f257484
jle 0x40d17a
cmp eax, 0x65a2ab42
jle 0x40d267
cmp eax, 0x724743a2
jg 0x40d425
cmp eax, 0x65a2ab43
je 0x40d4c6
cmp eax, 0x6c9a1993
jne 0x40cf65
imul ebx, ebx, 0x3368
add ebx, 0x72
mov eax, 0x241b1475
cmp ebx, 0xa000
jae 0x40d02e
mov eax, 0x3179aa02
shr ebx, 9
jmp 0x40d7eb
cmp eax, 0xe26df8f1
jg 0x40d0d9
cmp eax, 0xd85c26d5
jle 0x40d294
cmp eax, 0xe02f4fe1
jg 0x40d451
cmp eax, 0xd85c26d6
je 0x40d4e1
cmp eax, 0xdd27e91b
jne 0x40cf65
mov ecx, dword [esi + 0x54]
mov eax, 0x5f257485
cmp ecx, 1
je 0x40d7eb
mov eax, 0x7e43d795
jmp 0x40d7eb
cmp eax, 0x1ceb96f0
jg 0x40d1d6
cmp eax, 0xa3fe075
jg 0x40d2d0
cmp eax, 0x6f0d1ed
je 0x40d515
cmp eax, 0x76d9ca6
je 0x40d53b
cmp eax, 0x80ea686
jne 0x40cf65
push dword [esi + 0x30]
call fcn.0045e17d
add esp, 4
mov eax, dword [esi + 0x28]
mov dword [esi + 4], 0xe7dc6a3e
jmp 0x40cf65
cmp eax, 0xf247de0e
jg 0x40d30d
cmp eax, 0xeb227f64
jg 0x40d46b
cmp eax, 0xe26df8f2
je 0x40d573
cmp eax, 0xe7dc6a3e
jne 0x40cf65
mov eax, dword [esi + 8]
mov ecx, 0xffffff75
add eax, ecx
mov dword [esi + 8], eax
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x1eed
dec edx
mov eax, 0x8927a85f
cmp edx, ecx
je 0x40d12c
mov eax, 0xf247de0f
mov dword [esi + 4], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x10], eax
jmp 0x40cf65
cmp eax, 0x90fbe530
jg 0x40d33d
cmp eax, 0x88be01a0
je 0x40d5ab
cmp eax, 0x8927a85f
je 0x40d5d7
cmp eax, 0x895cf966
jne 0x40cf65
mov eax, dword [0x47fc34]
mov dword [esi + 0x54], eax
mov dword [esi + 4], 0xdd27e91b
jmp 0x40cf65
cmp eax, 0x47b9c608
jg 0x40d36d
cmp eax, 0x4157743f
je 0x40d5ec
cmp eax, 0x4431cd5b
je 0x40d618
cmp eax, 0x459792f2
jne 0x40cf65
mov eax, dword [esi + 8]
lea ecx, [eax - 0x31]
imul ecx, ecx
imul edx, ecx, 0xb59
dec edx
add eax, 0xffffff34
mov dword [esi + 8], eax
mov eax, 0xbcf08c18
cmp edx, ecx
je 0x40d1cc
mov eax, 0xe04cd1ec
mov dword [esi + 4], eax
xor edi, edi
jmp 0x40cf65
cmp eax, 0x3179aa01
jg 0x40d3a6
cmp eax, 0x1ceb96f1
je 0x40d649
cmp eax, 0x241b1475
je 0x40d66a
cmp eax, 0x2aba2a05
jne 0x40cf65
imul ebx, ebx, 0x2b
call fcn.0040cf38
mov eax, 0x4157743f
cmp ebx, 0x9b00000
jae 0x40d21c
mov eax, 0x6f0d1ed
shr ebx, 0x14
jmp 0x40d7eb
cmp eax, 0xaa937b77
je 0x40d688
cmp eax, 0xaf97212b
je 0x40d6a9
cmp eax, 0xb2409be6
jne 0x40cf65
mov eax, dword [esi + 8]
shl eax, 0xe
and eax, 0x7fffc000
add eax, 0xffc80000
shr eax, 4
mov dword [esi + 8], eax
mov dword [esi + 4], 0x8927a85f
jmp 0x40cf65
cmp eax, 0x5f257485
je 0x40d6c8
cmp eax, 0x602deeaf
je 0x40d6e6
cmp eax, 0x64ee4232
jne 0x40cf65
mov dword [esi + 4], 0x3bc3b379
jmp 0x40cf65
cmp eax, 0xc71cd4ca
je 0x40d700
cmp eax, 0xc7b8ff6d
je 0x40d726
cmp eax, 0xccb8bb14
jne 0x40cf65
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xf247de0f
xor eax, eax
inc eax
mov dword [esi + 0x10], eax
jmp 0x40cf65
cmp eax, 0xa3fe076
je 0x40d735
cmp eax, 0x12caeac5
je 0x40d753
cmp eax, 0x13d0c0b8
jne 0x40cf65
push 0x800
push dword [esi + 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esi + 4], 0xc3501d22
jmp 0x40cf65
cmp eax, 0xf247de0f
je 0x40d768
cmp eax, 0xf6c5cd5b
je 0x40d77d
cmp eax, 0x845a74
jne 0x40cf65
mov eax, dword [esi + 0x20]
mov dword [esi + 4], 0x13d0c0b8
jmp 0x40cf65
cmp eax, 0x90fbe531
je 0x40d798
cmp eax, 0x9d1fe6d8
je 0x40d7a4
cmp eax, 0xa076448d
jne 0x40cf65
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], 0xeee9bf99
jmp 0x40cf65
cmp eax, 0x47b9c609
je 0x40d7b0
cmp eax, 0x4da77fde
je 0x40d7c4
cmp eax, 0x5ad917fc
jne 0x40cf65
lea ebx, [ebx + ebx*4]
shl ebx, 0xb
add ebx, 0xfffff630
mov dword [esi + 4], 0xeee9bf99
jmp 0x40cf65
cmp eax, 0x3179aa02
je 0x40d7d0
cmp eax, 0x3a09e3b4
je 0x40d7f3
cmp eax, 0x3bc3b379
jne 0x40cf65
mov ecx, dword [esi + 0x14]
mov eax, 0xe26df8f2
cmp ecx, 0xffffffff
je 0x40d7eb
mov eax, 0xa3fe076
jmp 0x40d7eb
cmp eax, 0xbf8677a6
je 0x40d802
cmp eax, 0xc3501d22
jne 0x40cf65
xor eax, eax
push eax
push 0x80
mov ecx, 3
push ecx
push eax
push ecx
push 0x80000000
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x64ee4232
jmp 0x40cf65
cmp eax, 0x724743a3
je 0x40d813
cmp eax, 0x7e43d795
jne 0x40cf65
imul eax, dword [esi + 8], 0xca0000
mov dword [esi + 8], eax
mov dword [esi + 4], 0x845a74
jmp 0x40cf65
cmp eax, 0xe04cd1ec
jne 0x40d81f
mov dword [esi + 0x5c], edi
mov dword [esi + 4], 0x90fbe531
jmp 0x40cf65
cmp eax, 0xeee9bf99
jne 0x40d82b
push dword [esi + 0x1c]
push 0x1c
push 0x47fc34
call fcn.0040e5bc
add esp, 0xc
push 0x14
push 0x47fc50
push dword [esi + 0x1c]
call fcn.0044c43d
add esp, 0xc
mov ecx, 0xf6c5cd5b
test eax, eax
je 0x40d56b
mov ecx, 0xeb227f65
jmp 0x40d56b
mov eax, dword [esi + 0x20]
mov dword [esi + 4], 0xe02f4fe2
mov eax, dword [esi + 0xc]
mov dword [esi + 0x18], eax
jmp 0x40cf65
cmp dword [esi + 0x58], 0
mov eax, 0xbf8677a6
je 0x40d4d6
mov eax, 0xe04cd1ec
mov dword [esi + 4], eax
xor edi, edi
inc edi
jmp 0x40cf65
mov eax, dword [esi + 8]
shr eax, 0xb
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0xdb
dec edx
shl eax, 0xa
add eax, 0xdc00
mov dword [esi + 8], eax
mov eax, 0x241b1475
cmp ecx, edx
je 0x40d7eb
mov eax, 0xa076448d
jmp 0x40d7eb
push dword [esi + 0x24]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], eax
mov dword [esi + 4], 0x12caeac5
jmp 0x40cf65
mov ecx, dword [esi + 8]
lea eax, [ecx + 0xcf]
imul eax, eax
imul edx, eax, 0x85cb
dec edx
imul ecx, ecx, 0x4ab5
add ecx, 0x5cccd6
mov dword [esi + 8], ecx
mov ecx, 0x2aba2a05
cmp eax, edx
je 0x40d56b
mov ecx, 0xccb8bb14
mov dword [esi + 4], ecx
jmp 0x40cf65
mov eax, dword [esi + 8]
shr eax, 8
imul ecx, eax, 0x248000
imul eax, eax
imul edx, eax, 0x3cf3
dec edx
add ecx, 0xffffffb2
mov dword [esi + 8], ecx
mov ecx, 0x5ad917fc
cmp eax, edx
je 0x40d59d
mov ecx, 0xb244b70c
mov dword [esi + 4], ecx
xor eax, eax
inc eax
mov dword [esi + 0xc], eax
jmp 0x40cf65
mov eax, dword [0x47fc38]
mov ecx, dword [esi + 0x30]
add eax, ecx
add eax, 8
push 0x14
push 0x47fc3c
push eax
call fcn.0044c43d
add esp, 0xc
mov dword [esi + 0x58], eax
mov dword [esi + 4], 0x4431cd5b
jmp 0x40cf65
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0x88be01a0
jmp 0x40cf65
imul ebx, ebx, 0x6c3b8000
add ebx, 0x539e0000
call fcn.0040d879
mov eax, 0x895cf966
cmp ebx, 0xd2
jl 0x40d7eb
mov eax, 0xeee9bf99
jmp 0x40d7eb
mov eax, dword [esi + 8]
shr eax, 7
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x2f61
add eax, 0xffffff18
dec edx
mov dword [esi + 8], eax
mov eax, 0x6f0d1ed
cmp edx, ecx
je 0x40d7eb
mov eax, 0x65a2ab43
jmp 0x40d7eb
mov ecx, dword [0x47fc38]
add ecx, 0x30
mov eax, 0x76d9ca6
cmp ecx, dword [esi + 0x2c]
ja 0x40d7eb
mov eax, 0x602deeaf
jmp 0x40d7eb
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x24], eax
push eax
mov eax, esp
mov dword [esi + 0x28], eax
mov dword [esi + 4], 0xd85c26d6
jmp 0x40cf65
push eax
sub esp, 0x10
mov eax, esp
mov dword [esi + 0x1c], eax
push eax
sub esp, 0xffc
mov eax, esp
mov dword [esi + 0x20], eax
mov dword [esi + 4], 0x241b1475
jmp 0x40cf65
shl ebx, 5
add ebx, 0x10a0
call fcn.0040cf38
call fcn.0040cf38
mov dword [esi + 4], 0x241b1475
jmp 0x40cf65
mov eax, dword [esi + 8]
shl eax, 9
or eax, 0x15
mov dword [esi + 8], eax
mov dword [esi + 4], 0xe02f4fe2
xor eax, eax
inc eax
mov dword [esi + 0x18], eax
jmp 0x40cf65
push dword [esi + 0x2c]
call fcn.0045e524
add esp, 4
mov dword [esi + 0x30], eax
mov dword [esi + 4], 0x9d1fe6d8
jmp 0x40cf65
mov eax, dword [esi + 0x28]
xor ecx, ecx
mov dword [eax], ecx
push ecx
push dword [esi + 0x28]
push dword [esi + 0x2c]
push dword [esi + 0x30]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esi + 4], 0xb2409be6
jmp 0x40cf65
mov eax, dword [esi + 0x28]
mov dword [esi + 4], 0xc71cd4ca
jmp 0x40cf65
mov eax, dword [esi + 8]
shr eax, 3
and eax, 0xffffff80
imul eax, eax, 0x59d7
mov dword [esi + 8], eax
mov dword [esi + 4], 0x3a09e3b4
jmp 0x40cf65
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x2c], eax
mov dword [esi + 4], 0x1ceb96f1
jmp 0x40cf65
mov eax, dword [esi + 0x24]
mov dword [esi + 4], 0xb244b70c
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], eax
jmp 0x40cf65
imul eax, dword [esi + 8], 0x3536000
add eax, 0xffa87e32
mov dword [esi + 8], eax
mov dword [esi + 4], 0x724743a3
jmp 0x40cf65
mov dword [esi + 4], 0x80ea686
jmp 0x40cf65
mov dword [esi + 4], 0xc7b8ff6d
jmp 0x40cf65
add ebx, 0x64
mov eax, 0x895cf966
cmp ebx, 0x6a
jge 0x40d7eb
mov eax, 0x241b1475
jmp 0x40d7eb
mov dword [esi + 4], 0x6f0d1ed
jmp 0x40cf65
imul ebx, ebx, 0xa7
mov eax, 0xdd27e91b
cmp ebx, 0x7480000
jae 0x40d7e8
mov eax, 0x47b9c609
shr ebx, 0x13
mov dword [esi + 4], eax
jmp 0x40cf65
mov eax, dword [esi + 0x24]
mov dword [esi + 4], 0x4da77fde
jmp 0x40cf65
call fcn.0040d879
mov dword [esi + 4], 0x459792f2
jmp 0x40cf65
mov dword [esi + 4], 0x895cf966
jmp 0x40cf65
cmp eax, 0xe02f4fe2
je 0x40d856
jmp 0x40cf65
cmp eax, 0xeb227f65
jne 0x40cf65
mov dword [esi + 0x44], ebx
mov eax, dword [esi + 0x18]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esi + 0x44], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x34], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x1c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret