Function at 0x40a95c
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov esi, esp
mov dword [esi + 4], 0x78a13529
mov ebx, dword [esi + 0x48]
mov eax, dword [esi + 0x38]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x10], eax
xor edi, edi
inc edi
mov eax, dword [esi + 4]
cmp eax, 0x12ec38b1
jle 0x40a9fb
cmp eax, 0x4034fc6b
jg 0x40aa59
cmp eax, 0x22eb69f5
jle 0x40ab01
cmp eax, 0x327a55ac
jg 0x40ac29
cmp eax, 0x22eb69f6
je 0x40adeb
cmp eax, 0x28c86b29
je 0x40ae14
cmp eax, 0x2c387bd3
jne 0x40a98f
imul ebx, ebx, 0xdbc3
add ebx, 0xb28e7
mov eax, 0x1249dc0b
cmp ebx, 0x11
jb 0x40b152
mov eax, 0xc275a18f
jmp 0x40b152
cmp eax, 0xbbaf56ef
jle 0x40aab2
cmp eax, 0xd2d87be8
jle 0x40ab42
cmp eax, 0xecb12a5e
jg 0x40ac73
cmp eax, 0xd2d87be9
je 0x40ae37
cmp eax, 0xd4622810
je 0x40ae77
cmp eax, 0xe4f922e9
jne 0x40a98f
shr ebx, 6
and ebx, 0xffffffc0
call fcn.0040b1f1
call fcn.0040b1f1
mov dword [esi + 4], 0xc12d797a
jmp 0x40a98f
cmp eax, 0x63c138bf
jle 0x40ab94
cmp eax, 0x6a667c0e
jg 0x40acc7
cmp eax, 0x63c138c0
je 0x40b174
cmp eax, 0x6753933f
je 0x40ae8c
cmp eax, 0x69962771
jne 0x40a98f
add ebx, 0x11
call fcn.0040a95c
mov eax, 0xc275a18f
cmp ebx, 0x1e8000
jae 0x40aaaa
mov eax, 0x28c86b29
shr ebx, 0xd
jmp 0x40b152
cmp eax, 0xaa3358af
jg 0x40abdc
cmp eax, 0x96f251b9
jg 0x40acfe
cmp eax, 0x81fa49ba
je 0x40aeb1
cmp eax, 0x87a2011e
je 0x40aec2
cmp eax, 0x8b71f59c
jne 0x40a98f
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0x1f5e02cd
mov dword [esi + 0xc], edi
jmp 0x40a98f
cmp eax, 0x1cb59433
jle 0x40ad23
cmp eax, 0x1cb59434
je 0x40aee0
cmp eax, 0x1e35e006
je 0x40aef5
cmp eax, 0x1f5e02cd
jne 0x40a98f
mov eax, dword [esi + 0x28]
mov dword [esi + 4], 0xd4622810
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
jmp 0x40a98f
cmp eax, 0xc275a18e
jle 0x40ad56
cmp eax, 0xc275a18f
je 0x40af3b
cmp eax, 0xc37141f3
je 0x40af54
cmp eax, 0xc9db41b4
jne 0x40a98f
shr ebx, 0xb
imul ebx, ebx, 0xf6
call fcn.0040b1f1
call fcn.0040a95c
mov eax, 0xb8b656b8
cmp ebx, 3
jae 0x40af74
jmp 0x40b152
cmp eax, 0x43f3a4c7
jle 0x40ad99
cmp eax, 0x43f3a4c8
je 0x40af66
cmp eax, 0x4d070cd3
je 0x40af7e
cmp eax, 0x626988b8
jne 0x40a98f
cmp dword [0x472c58], 1
mov eax, 0x87a2011e
je 0x40b152
mov eax, 0xa5ae260f
jmp 0x40b152
cmp eax, 0xb1bedde2
jle 0x40adc9
cmp eax, 0xb1bedde3
je 0x40af92
cmp eax, 0xb2a1aad2
je 0x40afa1
cmp eax, 0xb8b656b8
jne 0x40a98f
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x28], eax
push eax
mov eax, esp
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 4], 0xaeaab18d
jmp 0x40a98f
cmp eax, 0x327a55ad
je 0x40afad
cmp eax, 0x3de22966
je 0x40afca
cmp eax, 0x3e41e8cd
jne 0x40a98f
push 0x14
push 0x472c60
push dword [esi + 0x58]
call fcn.00442b4d
add esp, 0xc
mov ecx, 0x81fa49ba
test eax, eax
je 0x40b048
mov ecx, 0x96f251ba
jmp 0x40b048
cmp eax, 0xecb12a5f
je 0x40afee
cmp eax, 0xedfbd3cf
je 0x40b019
cmp eax, 0x1249dc0b
jne 0x40a98f
push dword [esi + 0x20]
push 0x1c
push 0x472c58
call fcn.0040c038
add esp, 0xc
push 0x14
push 0x472c74
push dword [esi + 0x20]
call fcn.00442b4d
add esp, 0xc
mov dword [esi + 0x50], eax
mov dword [esi + 4], 0xc275a18f
jmp 0x40a98f
cmp eax, 0x6a667c0f
je 0x40b050
cmp eax, 0x78a13529
jne 0x40b15a
push eax
sub esp, 0x10
mov eax, esp
mov dword [esi + 0x20], eax
push eax
sub esp, 0xffc
mov eax, esp
mov dword [esi + 0x24], eax
mov dword [esi + 4], 0xb8b656b8
jmp 0x40a98f
cmp eax, 0x96f251ba
je 0x40b080
cmp eax, 0xa5ae260f
jne 0x40b167
mov eax, dword [esi + 0x24]
mov dword [esi + 4], 0x1e35e006
jmp 0x40a98f
cmp eax, 0x12ec38b2
je 0x40b0b4
cmp eax, 0x13203bff
jne 0x40a98f
imul ebx, ebx, 0x6c0
add ebx, 0x444b3
call fcn.0040a95c
mov dword [esi + 4], 0xb8b656b8
jmp 0x40a98f
cmp eax, 0xbbaf56f0
je 0x40b0f3
cmp eax, 0xc12d797a
jne 0x40a98f
imul ebx, ebx, 0x6100
add ebx, 0xffffd104
shr ebx, 0xf
add ebx, 0xffffffd3
mov eax, 0xc275a18f
cmp ebx, 0x88
jae 0x40b152
mov eax, 0x1249dc0b
jmp 0x40b152
cmp eax, 0x4034fc6c
je 0x40b10d
cmp eax, 0x4131dcee
jne 0x40a98f
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x54]
add eax, ecx
add eax, 8
mov dword [esi + 0x58], eax
mov dword [esi + 4], 0x3e41e8cd
jmp 0x40a98f
cmp eax, 0xaa3358b0
je 0x40b125
cmp eax, 0xaeaab18d
jne 0x40a98f
mov dword [esi + 4], 0x1249dc0b
jmp 0x40a98f
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x30], eax
mov ecx, dword [0x472c5c]
add ecx, 0x30
mov eax, 0x6753933f
cmp ecx, dword [esi + 0x30]
ja 0x40b152
mov eax, 0xd2d87be9
jmp 0x40b152
add ebx, 0xffffffd5
call fcn.0040a95c
mov eax, 0x13203bff
cmp ebx, 0xa2
jl 0x40b152
mov eax, 0xb8b656b8
jmp 0x40b152
push dword [esi + 0x30]
call fcn.004500f4
add esp, 4
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x2c]
mov eax, dword [esi + 0x2c]
xor ecx, ecx
mov dword [eax], ecx
push ecx
push dword [esi + 0x2c]
push dword [esi + 0x30]
push dword [esi + 0x34]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xedfbd3cf
jmp 0x40a98f
mov eax, dword [esi + 0x24]
mov dword [esi + 4], 0x75fa082a
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
jmp 0x40a98f
mov eax, dword [esi + 8]
and eax, 0xfffffff0
lea eax, [eax*8 + 4]
imul eax, eax, 0xfb
add eax, 0xfffffff8
mov dword [esi + 8], eax
mov dword [esi + 4], 0x8b71f59c
jmp 0x40a98f
call fcn.0040b1f1
mov dword [esi + 4], 0xecb12a5f
jmp 0x40a98f
imul eax, dword [esi + 8], 0x6c000
or eax, 0xc8
mov dword [esi + 8], eax
mov dword [esi + 4], 0x75fa082a
mov dword [esi + 0x1c], edi
jmp 0x40a98f
shl ebx, 0xd
add ebx, 0x1dbd59
mov dword [esi + 4], 0xb8b656b8
jmp 0x40a98f
push 0x800
push dword [esi + 0x24]
mov dword [esi + 0x4c], ebx
mov ebx, edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x80
mov eax, 3
push eax
push edi
mov edi, ebx
mov ebx, dword [esi + 0x4c]
push eax
push 0x80000000
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
mov dword [esi + 4], 0x6a667c0f
jmp 0x40a98f
cmp dword [esi + 0x50], 0
mov eax, 0x626988b8
je 0x40b152
mov eax, 0x3de22966
jmp 0x40b152
mov eax, dword [esi + 0x10]
mov dword [esi + 0x5c], eax
mov dword [esi + 4], 0xbbaf56f0
jmp 0x40a98f
shl ebx, 0xa
mov eax, 0x327a55ad
je 0x40b152
mov eax, 0x1e35e006
jmp 0x40b152
mov eax, dword [0x472c5c]
mov dword [esi + 0x54], eax
mov dword [esi + 4], 0x4131dcee
jmp 0x40a98f
mov eax, dword [esi + 0x28]
mov dword [esi + 4], 0x4034fc6c
jmp 0x40a98f
mov dword [esi + 4], 0x327a55ad
jmp 0x40a98f
mov ecx, dword [esi + 0x18]
mov eax, 0xd4622810
cmp ecx, 0xffffffff
je 0x40afbf
mov eax, 0xaa3358b0
mov dword [esi + 4], eax
mov dword [esi + 0x14], edi
jmp 0x40a98f
mov eax, dword [esi + 8]
shl eax, 0xb
and eax, 0x7ffff800
add eax, 0xfffeaa00
and eax, 0xffff8000
mov dword [esi + 8], eax
mov dword [esi + 4], 0x9978191a
jmp 0x40a98f
mov eax, dword [esi + 8]
add eax, eax
and eax, 0x7fffe
imul eax, eax, 0x87
add eax, 0xffff7ba3
mov dword [esi + 8], eax
mov dword [esi + 4], 0xc37141f3
mov dword [esi + 0x10], 0
jmp 0x40a98f
mov eax, dword [esi + 8]
shr eax, 0xe
add eax, 0xffffff72
imul ecx, eax, 0x37
imul eax, eax
shr ecx, 7
imul edx, eax, 0x4c7d
dec edx
add ecx, 0xffffffa7
mov dword [esi + 8], ecx
mov ecx, 0xc9db41b4
cmp eax, edx
je 0x40b048
mov ecx, 0x4d070cd3
mov dword [esi + 4], ecx
jmp 0x40a98f
mov eax, dword [esi + 8]
lea ecx, [eax - 0x9e]
add eax, 0x2e
imul ecx, ecx
imul edx, ecx, 0x82d1
dec edx
mov dword [esi + 8], eax
mov eax, 0x69962771
cmp ecx, edx
je 0x40b152
mov eax, 0xb2a1aad2
jmp 0x40b152
mov eax, dword [esi + 8]
lea ecx, [eax + 0xc7]
imul ecx, ecx
imul edx, ecx, 0x3811
dec edx
add eax, 0x128
mov dword [esi + 8], eax
mov eax, 0xe4f922e9
cmp ecx, edx
je 0x40b0a9
mov eax, 0xc37141f3
mov dword [esi + 4], eax
mov dword [esi + 0x10], edi
jmp 0x40a98f
mov ecx, dword [esi + 8]
mov eax, ecx
shr eax, 2
and eax, 0x7fffff
imul eax, eax
imul edx, eax, 0x4687
dec edx
shr ecx, 0xe
and ecx, 0x7f8
mov dword [esi + 8], ecx
mov ecx, 0x4131dcee
cmp edx, eax
je 0x40b0e5
mov ecx, 0x1f5e02cd
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x5c]
mov dword [esi + 0xc], eax
jmp 0x40a98f
push dword [esi + 0x34]
call fcn.0044fd4c
add esp, 4
mov eax, dword [esi + 0x2c]
mov dword [esi + 4], 0x12ec38b2
jmp 0x40a98f
push dword [esi + 0x28]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [esi + 4], 0x22eb69f6
jmp 0x40a98f
mov eax, dword [esi + 8]
mov ecx, 0xffffff44
add eax, ecx
mov ecx, eax
imul ecx, eax
shr eax, 2
imul edx, ecx, 0x2363
imul eax, eax, 0x3a
dec edx
mov dword [esi + 8], eax
mov eax, 0x43f3a4c8
cmp edx, ecx
je 0x40b152
mov eax, 0xb1bedde3
mov dword [esi + 4], eax
jmp 0x40a98f
cmp eax, 0x75fa082a
jne 0x40a98f
jmp 0x40b1a8
cmp eax, 0x9978191a
jne 0x40a98f
jmp 0x40b1ce
add ebx, 0xffffff37
mov edi, ebx
shr edi, 2
call fcn.0040b1f1
call fcn.0040a95c
mov eax, 0x2c387bd3
cmp ebx, 0x20c
jae 0x40b19b
mov eax, 0xc275a18f
add edi, 0xffffffb1
mov dword [esi + 4], eax
mov ebx, edi
jmp 0x40a98c
mov dword [esi + 0x48], ebx
mov eax, dword [esi + 0x14]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x44], ecx
mov ecx, dword [esi + 0x20]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x48], ebx
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x44], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]