Function at 0x1000e1a0
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10025407
push eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x114
mov dword [0x10040558], ecx
push ebx
xor ebx, ebx
push ebp
push esi
sub eax, ebx
push edi
je 0x1000e53e
dec eax
jne 0x1000e58d
push ecx
push ebx
push 0x10040490
mov dword [0x10040500], 0x10039388
mov dword [0x1003f42c], 0x10040490
mov dword [0x10040490], 0x84
mov dword [0x100404f4], 0x300
call fcn.1000f160
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push 0xc
mov dword [0x10040514], eax
mov dword [0x10040518], ebx
call fcn.1001a636
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x12c], ebx
je 0x1000e245
mov ecx, eax
call fcn.10019460
jmp 0x1000e247
xor eax, eax
or edi, 0xffffffff
cmp eax, ebx
mov dword [esp + 0x12c], edi
mov dword [0x10040518], eax
je 0x1000e260
mov dword [0x1004051c], ebx
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.1000e180
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
push 8
call fcn.1001a636
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x12c], 1
je 0x1000e29e
mov ecx, eax
call fcn.10004970
mov esi, eax
jmp 0x1000e2a0
xor esi, esi
mov ecx, esi
mov dword [esp + 0x12c], edi
call fcn.100049b0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.10004d20
mov ecx, esi
mov edi, eax
call fcn.10004a00
cmp esi, ebx
je 0x1000e2d4
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
cmp edi, ebx
jne 0x1000e537
mov eax, dword [0x10040538]
cmp dword [eax - 8], ebx
je 0x1000e337
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
cmp edx, ebx
jl 0x1000e328
mov edx, dword [0x10039084]
add eax, 0xfffffff4
cmp eax, edx
je 0x1000e337
push ecx
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000e31a
mov ecx, dword [0x10040538]
lea eax, [ecx - 0xc]
push eax
call fcn.1001a644
add esp, 4
mov edx, dword [0x10039080]
mov dword [0x10040538], edx
jmp 0x1000e337
push 0x1003d5c0
mov ecx, 0x10040538
call fcn.10001ac0
mov eax, dword [esp + 0x18]
push eax
push 0x100391e8
push 0x10040538
call fcn.100084e0
mov ecx, 0x100
xor eax, eax
mov edi, 0x1003ebc4
add esp, 0xc
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x1003e7c4
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x1003e3c4
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x1003dfc4
rep stosd dword es:[edi], eax
mov ecx, 0x1003a410
test ecx, ecx
jne 0x1000e38d
xor ebp, ebp
jmp 0x1000e39a
push 0x1003a410
call dword [sym.imp.kernel32.dll_lstrlen]
mov ebp, eax
push ebp
mov ecx, 0x10040530
call fcn.10001940
test eax, eax
je 0x1000e3d6
mov edi, dword [0x10040530]
mov ecx, ebp
mov edx, ecx
mov esi, 0x1003a410
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x10040530]
mov dword [eax - 8], ebp
mov ecx, dword [0x10040530]
mov byte [ecx + ebp], 0
push ebx
push 0x8000027
push 3
push ebx
push 1
lea edx, [esp + 0x34]
push 0x80000000
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000e400
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
push 0x20000
call fcn.1001a636
add esp, 4
mov edi, eax
lea eax, [esp + 0x1c]
push 0
push eax
push 0x20000
push edi
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [0x10040534]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x1000e480
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
jl 0x1000e471
mov edx, dword [0x10039084]
add eax, 0xfffffff4
cmp eax, edx
je 0x1000e480
push ecx
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000e463
mov ecx, dword [0x10040534]
lea eax, [ecx - 0xc]
push eax
call fcn.1001a644
add esp, 4
mov edx, dword [0x10039080]
mov dword [0x10040534], edx
jmp 0x1000e480
push 0x1003d5c0
mov ecx, 0x10040534
call fcn.10001ac0
xor esi, esi
mov ebp, 2
mov al, byte [edi + esi + 0x1c824]
mov ecx, dword [0x10039080]
mov byte [esp + 0x14], al
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
and edx, 0xff
mov dword [esp + 0x12c], ebp
push edx
push 0x1003a408
push eax
call fcn.100084e0
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [eax - 8]
push eax
push ecx
mov ecx, 0x10040534
call fcn.10001b90
mov ecx, dword [0x10039084]
mov dword [esp + 0x12c], 0xffffffff
mov eax, dword [esp + 0x10]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x1000e50d
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000e50d
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.1001a644
add esp, 4
inc esi
cmp esi, 0x10
jl 0x1000e487
push edi
call fcn.1001a644
add esp, 4
test ebx, ebx
je 0x1000e52b
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0
call fcn.100168f0
add esp, 4
jmp 0x1000e58d
push ebx
call dword [sym.imp.kernel32.dll_ExitProcess]
mov esi, dword [0x1004051c]
cmp esi, ebx
je 0x1000e572
cmp dword [esi + 4], ebx
jle 0x1000e55e
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.DLL_DestroyWindow]
mov esi, dword [0x1004051c]
cmp esi, ebx
je 0x1000e572
mov ecx, esi
call fcn.1001a0b0
push esi
call fcn.1001a644
add esp, 4
mov ecx, dword [0x10040518]
cmp ecx, ebx
je 0x1000e583
push 1
call fcn.10011450
push 0x10040490
call fcn.1000f680
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret 0xc