Function at 0x406350
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, esp
jmp 0x406360
push eax
mov dword [esi + 0xc], esp
push eax
mov edi, esp
sub esp, 0x14
mov ebx, esp
push eax
mov dword [esi + 4], esp
push eax
sub esp, 0xffc
mov dword [esi + 0x1c], esp
push eax
mov dword [esi + 8], esp
sub esp, 8
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x10], eax
mov esp, eax
push eax
mov dword [esi + 0x24], esp
push eax
mov dword [esi + 0x20], esp
lea eax, [0x4741a0]
mov dword [edi], eax
mov eax, dword [edi]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0x1c
mov dword [esp + 8], ebx
call fcn.004078f0
add esp, 0xc
mov dword [esi + 0x14], edi
mov eax, dword [edi]
add eax, 0x1c
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 8], 0x14
call fcn.00450b4e
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x4063e5
jmp 0x4063f7
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [esi + 0x14]
mov eax, dword [edi]
cmp dword [eax], 1
jne 0x406418
mov edi, dword [esi + 0xc]
mov dword [edi], 1
mov eax, dword [esi + 4]
mov dword [eax], 1
jmp 0x4065d7
xor eax, eax
sub esp, 0xc
mov dword [esp], 0
mov ebx, dword [esi + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x800
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
sub esp, 0x1c
mov dword [esp], ebx
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 3
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [esi + 8]
mov dword [ecx], eax
mov eax, 0xffffffff
cmp dword [ecx], eax
jne 0x40649e
jmp 0x406487
mov edi, dword [esi + 0xc]
mov dword [edi], 1
mov eax, dword [esi + 4]
mov dword [eax], 1
jmp 0x4065d7
mov eax, dword [ecx]
sub esp, 8
mov ebx, dword [esi + 0x10]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
call eax
mov eax, dword [ebx]
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov edx, ecx
xor edx, 0x30
xor edx, 0xffffffff
mov ebx, ecx
or ebx, 0x30
and ebx, edx
or ecx, 0x30
add ebx, ecx
cmp eax, ebx
jae 0x4064fb
mov eax, dword [esi + 8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 0xc]
mov dword [edi], 1
mov eax, dword [esi + 4]
mov dword [eax], 1
jmp 0x4065d7
mov edi, dword [esi + 0x10]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00457c74
add esp, 4
mov ebx, dword [esi + 0x24]
mov dword [ebx], eax
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [edi]
mov dword [esi + 0x18], ecx
mov ecx, dword [ebx]
mov edx, dword [esi + 8]
mov edx, dword [edx]
xor edi, edi
sub esp, 0x14
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esi + 0x18]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi + 0x14]
mov eax, dword [edx]
add eax, 8
mov ecx, dword [ebx]
mov edx, dword [edx]
add ecx, dword [edx + 4]
add ecx, 8
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0x14
call fcn.00450b4e
add esp, 0xc
cmp eax, 0
mov edi, dword [esi + 0xc]
jne 0x4065b8
call fcn.004065f0
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
mov dword [edi], 0
mov eax, dword [esi + 4]
mov dword [eax], 1
jmp 0x4065d7
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
mov dword [edi], 1
mov eax, dword [esi + 4]
mov dword [eax], 1
mov eax, dword [edi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret