Function at 0x40a1c8
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1078
call fcn.00446800
mov esi, esp
mov dword [esi + 4], 0xaa937b77
mov ebx, dword [esi + 0x3c]
mov eax, dword [esi + 0x30]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x34]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x38]
mov dword [esi + 0xc], eax
xor edi, edi
inc edi
mov eax, dword [esi + 4]
cmp eax, 0xf6c5cd5a
jle 0x40a261
cmp eax, 0x3bc3b378
jg 0x40a2ab
cmp eax, 0x12caeac4
jg 0x40a31f
cmp eax, 0x6f0d1ec
jle 0x40a418
cmp eax, 0x6f0d1ed
je 0x40a5a9
cmp eax, 0x76d9ca6
je 0x40a602
cmp eax, 0xa3fe076
jne 0x40a202
push dword [esi + 0x24]
call fcn.00459aa4
add esp, 4
mov dword [esi + 0x28], eax
mov dword [esi + 4], 0x4da77fde
jmp 0x40a202
cmp eax, 0xc3501d21
jle 0x40a2e7
cmp eax, 0xd85c26d5
jle 0x40a355
cmp eax, 0xe04cd1eb
jle 0x40a443
cmp eax, 0xe04cd1ec
je 0x40a622
cmp eax, 0xeb227f65
je 0x40a646
cmp eax, 0xeee9bf99
jne 0x40a202
mov dword [esi + 4], 0x724743a3
jmp 0x40a202
cmp eax, 0x602deeae
jle 0x40a3a8
cmp eax, 0x65a2ab42
jle 0x40a47e
cmp eax, 0x65a2ab43
je 0x40a67b
cmp eax, 0x724743a3
je 0x40a7f7
cmp eax, 0x7e43d795
je 0x40a846
jmp 0x40a202
cmp eax, 0xa076448c
jg 0x40a3f2
cmp eax, 0x90fbe530
jg 0x40a4b1
cmp eax, 0x88be01a0
je 0x40a698
cmp eax, 0x895cf966
jne 0x40a7d7
mov dword [esi + 4], 0xdd27e91b
jmp 0x40a202
cmp eax, 0x1ceb96f0
jle 0x40a503
cmp eax, 0x1ceb96f1
je 0x40a6b7
cmp eax, 0x3a09e3b4
jne 0x40a7e7
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0x9d1fe6d8
jmp 0x40a202
cmp eax, 0xc7b8ff6c
jg 0x40a530
cmp eax, 0xc3501d22
je 0x40a6c9
cmp eax, 0xc71cd4ca
jne 0x40a202
mov eax, dword [esi + 8]
mov ecx, 0xa0
add eax, ecx
mov dword [esi + 8], eax
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x263
dec edx
mov eax, 0x724743a3
cmp ecx, edx
je 0x40a39d
mov eax, 0xc7b8ff6d
mov dword [esi + 4], eax
mov dword [esi + 0x10], edi
jmp 0x40a202
cmp eax, 0x459792f1
jg 0x40a552
cmp eax, 0x3bc3b379
je 0x40a6e4
cmp eax, 0x4431cd5b
jne 0x40a202
shl ebx, 0x17
add ebx, 0xe1800000
call fcn.0040a1c8
mov eax, 0xbf8677a6
cmp ebx, 0xb5
jl 0x40a763
mov eax, 0xe04cd1ec
jmp 0x40a763
cmp eax, 0xb2409be5
jg 0x40a577
cmp eax, 0xa076448d
je 0x40a715
cmp eax, 0xaa937b77
je 0x40a87c
jmp 0x40a202
cmp eax, 0xf6c5cd5b
je 0x40a733
cmp eax, 0x845a74
jne 0x40a202
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
mov dword [esi + 0x24], eax
mov dword [esi + 4], 0xc3501d22
jmp 0x40a202
cmp eax, 0xd85c26d6
je 0x40a8b5
cmp eax, 0xdd27e91b
jne 0x40a202
lea eax, [esi + 0x58]
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x44], ecx
mov dword [esi + 0x40], eax
mov dword [esi + 4], 0x7e43d795
jmp 0x40a202
cmp eax, 0x602deeaf
je 0x40a73f
cmp eax, 0x64ee4232
jne 0x40a202
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x50]
mov eax, 0x3a09e3b4
cmp edx, ecx
ja 0x40a763
mov eax, 0xa3fe076
jmp 0x40a763
cmp eax, 0x90fbe531
je 0x40a751
cmp eax, 0x9d1fe6d8
jne 0x40a202
mov ecx, dword [esi + 8]
lea eax, [ecx + 0xc9]
imul eax, eax
imul edx, eax, 0x2457
lea ecx, [ecx*4 + 0x324]
and ecx, 0x3ffffffc
dec edx
mov dword [esi + 8], ecx
mov ecx, 0xa076448d
cmp edx, eax
je 0x40a4f8
mov ecx, 0x602deeaf
mov dword [esi + 4], ecx
mov dword [esi + 0x14], edi
jmp 0x40a202
cmp eax, 0x12caeac5
je 0x40a76b
cmp eax, 0x13d0c0b8
jne 0x40a202
mov eax, dword [0x47abc4]
add eax, 0x30
mov dword [esi + 0x50], eax
mov dword [esi + 4], 0x3bc3b379
jmp 0x40a202
cmp eax, 0xc7b8ff6d
je 0x40a783
cmp eax, 0xccb8bb14
jne 0x40a202
mov dword [esi + 4], 0x76d9ca6
jmp 0x40a202
cmp eax, 0x459792f2
je 0x40a795
cmp eax, 0x4da77fde
jne 0x40a202
mov eax, dword [esi + 0x20]
mov dword [esi + 4], 0x6f0d1ed
jmp 0x40a202
cmp eax, 0xb2409be6
je 0x40a7bd
cmp eax, 0xbf8677a6
jne 0x40a202
imul ebx, ebx, 0x2c00
call fcn.0040a1c8
call fcn.0040a1c8
mov dword [esi + 4], 0xaa937b77
jmp 0x40a202
mov eax, dword [esi + 0x20]
xor ecx, ecx
mov dword [eax], ecx
push ecx
push dword [esi + 0x20]
push dword [esi + 0x24]
push dword [esi + 0x28]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x47abc4]
mov ecx, dword [esi + 0x28]
add eax, ecx
add eax, 8
push 0x14
push 0x47abc8
push eax
call fcn.0044782d
add esp, 0xc
mov ecx, 0x12caeac5
test eax, eax
je 0x40a5f7
mov ecx, 0x1ceb96f1
mov dword [esi + 4], ecx
mov dword [esi + 0xc], edi
jmp 0x40a202
push dword [esi + 0x28]
call fcn.004596fc
add esp, 4
mov eax, dword [esi + 0x20]
mov dword [esi + 4], 0x602deeaf
mov eax, dword [esi + 0x54]
mov dword [esi + 0x14], eax
jmp 0x40a202
shl ebx, 4
add ebx, 0xffffff6e
mov eax, 0x724743a3
cmp ebx, 0x92
jae 0x40a763
mov eax, 0xdd27e91b
jmp 0x40a763
mov ecx, dword [esi + 8]
imul eax, ecx, 0x2fd3
imul eax, eax
imul ecx, ecx, 0xd6ffb2a
imul edx, eax, 0x621
dec edx
shr ecx, 0xe
mov dword [esi + 8], ecx
mov ecx, 0xb2409be6
cmp edx, eax
je 0x40a673
mov ecx, 0xeee9bf99
mov dword [esi + 4], ecx
jmp 0x40a202
imul ebx, ebx, 0xe10000
mov eax, 0xaa937b77
test ebx, ebx
je 0x40a763
mov eax, 0x4431cd5b
jmp 0x40a763
shl ebx, 0xa
or ebx, 0xbc
mov eax, 0xa076448d
cmp ebx, 0xe9
jl 0x40a75e
jmp 0x40a763
mov eax, dword [esi + 0xc]
mov dword [esi + 0x54], eax
mov dword [esi + 4], 0xccb8bb14
jmp 0x40a202
imul eax, dword [esi + 8], 0x5100
add eax, 0xffffefd3
mov dword [esi + 8], eax
mov dword [esi + 4], 0x13d0c0b8
jmp 0x40a202
mov eax, dword [esi + 8]
add eax, 0x79
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x9a9
and eax, 0xfffff800
dec edx
add eax, eax
add eax, 0xffffff77
mov dword [esi + 8], eax
mov eax, 0xa076448d
cmp ecx, edx
je 0x40a763
mov eax, 0x64ee4232
jmp 0x40a763
cmp dword [0x47abc0], 1
mov eax, 0x8927a85f
je 0x40a728
mov eax, 0xeb227f65
mov dword [esi + 4], eax
mov dword [esi + 0x1c], edi
jmp 0x40a202
mov dword [esi + 4], 0x895cf966
jmp 0x40a202
mov dword [esi + 4], 0xc7b8ff6d
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], eax
jmp 0x40a202
shl ebx, 0x17
mov eax, 0xa076448d
cmp ebx, 0x48
jge 0x40a763
mov eax, 0xaa937b77
mov dword [esi + 4], eax
jmp 0x40a202
call fcn.0040a937
mov dword [esi + 4], 0x1ceb96f1
mov dword [esi + 0xc], 0
jmp 0x40a202
mov dword [esi + 4], 0x8927a85f
mov eax, dword [esi + 0x10]
mov dword [esi + 0x1c], eax
jmp 0x40a202
add ebx, 0xffffff8a
shr ebx, 0x19
imul ebx, ebx, 0xbf
add ebx, 0xffff0cc6
call fcn.0040a1c8
call fcn.0040a937
mov dword [esi + 4], 0x845a74
jmp 0x40a202
shl ebx, 8
or ebx, 0xc2
call fcn.0040a937
mov dword [esi + 4], 0xa076448d
jmp 0x40a202
cmp eax, 0x8927a85f
jne 0x40a202
jmp 0x40a8f1
cmp eax, 0x241b1475
jne 0x40a202
jmp 0x40a914
mov dword [esi + 0x4c], ebx
push 0x800
lea ebx, [esi + 0x74]
push ebx
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x80
mov eax, 3
push eax
push edi
push eax
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
mov ecx, dword [esi + 0x18]
mov eax, 0xc71cd4ca
cmp ecx, 0xffffffff
je 0x40a83b
mov eax, 0xf6c5cd5b
mov dword [esi + 4], eax
mov ebx, dword [esi + 0x4c]
jmp 0x40a1ff
mov eax, dword [esi + 8]
shr eax, 4
lea ecx, [eax + eax*4]
lea ecx, [eax + ecx*4]
add ecx, eax
mov edx, eax
imul edx, eax
imul edi, edx, 0x518d
dec edi
shr ecx, 6
mov dword [esi + 8], ecx
mov eax, 0x65a2ab43
cmp edx, edi
je 0x40a874
mov eax, 0x845a74
mov dword [esi + 4], eax
jmp 0x40a1ff
push eax
mov eax, esp
mov dword [esi + 0x20], eax
lea edi, [esi + 0x60]
push edi
push 0x1c
push 0x47abc0
call fcn.0040b38c
add esp, 0xc
push 0x14
push 0x47abdc
push edi
call fcn.0044782d
add esp, 0xc
mov ecx, 0xd85c26d6
test eax, eax
je 0x40a8e9
mov ecx, 0x241b1475
jmp 0x40a8e9
mov edi, dword [esi + 8]
mov eax, 0xffffff55
add edi, eax
imul ecx, edi, 0x86
imul edi, edi
lea edx, [edi + edi*2]
mov eax, edi
not eax
lea eax, [eax + edx*8]
add ecx, 0xffffff4d
mov dword [esi + 8], ecx
mov ecx, 0xaa937b77
cmp edi, eax
je 0x40a8e9
mov ecx, 0xa076448d
mov dword [esi + 4], ecx
jmp 0x40a1ff
mov dword [esi + 0x3c], ebx
mov eax, dword [esi + 0x10]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x2c], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x3c], ebx
mov eax, dword [esi + 0x10]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]