Function at 0x4061ec
Capabilities:
Create process on windows
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4066d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
dec eax
je 0x406234
dec eax
je 0x406249
dec eax
je 0x40625e
dec eax
je 0x406273
jmp 0x406286
lea eax, [ebp - 0x24]
mov ecx, 0x4066e8
mov edx, dword [0x40a678]
call fcn.00403da0
jmp 0x406286
lea eax, [ebp - 0x24]
mov ecx, 0x406700
mov edx, dword [0x40a678]
call fcn.00403da0
jmp 0x406286
lea eax, [ebp - 0x24]
mov ecx, 0x40671c
mov edx, dword [0x40a678]
call fcn.00403da0
jmp 0x406286
lea eax, [ebp - 0x24]
mov ecx, 0x40673c
mov edx, dword [0x40a678]
call fcn.00403da0
push 0
push 0x82
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x24]
call fcn.00403d24
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x40658a
xor eax, eax
push ebp
push 0x406583
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40656c
xor eax, eax
push ebp
push 0x406565
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40654e
xor eax, eax
push ebp
push 0x406547
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 2
jg 0x40652c
push 1
push dword [ebp - 4]
push 8
push 0x4090e0
push 0x4090d8
push 0x4090d0
push 0x4090c8
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0xa
push 0x40910c
push 0x409100
push 0x4090f4
push 0x4090e8
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0xd
push 0x409148
push 0x409138
push 0x409128
push 0x409118
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 9
push 0x40917c
push 0x409170
push 0x409164
push 0x409158
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 9
push 0x40917c
push 0x409170
push 0x409164
push 0x409158
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x24
push 0x4091f4
push 0x4091d0
push 0x4091ac
push 0x409188
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x24
push 0x4091f4
push 0x4091d0
push 0x4091ac
push 0x409188
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x1e
push 0x409278
push 0x409258
push 0x409238
push 0x409218
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x11
push 0x409324
push 0x409310
push 0x4092fc
push 0x4092e8
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 7
push 0x409350
push 0x409348
push 0x409340
push 0x409338
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x47
push 0x409430
push 0x4093e8
push 0x4093a0
push 0x409358
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
push 0x47
push 0x409430
push 0x4093e8
push 0x4093a0
push 0x409358
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
cmp byte [0x40a670], 1
jne 0x406530
push 1
push dword [ebp - 4]
push 0x12
push 0x4092d4
push 0x4092c0
push 0x4092ac
push 0x409298
push dword [ebp - 8]
call fcn.00404f5c
or dword [ebp - 0xc], eax
jmp 0x406530
cmp dword [ebp - 0x14], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40654e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40656c
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40658a
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle
ret
call sub.kernel32.dll_GetLastError
mov dword [0x40a674], eax
cmp dword [0x40a674], 0
je 0x40661b
lea edx, [ebp - 0x18]
mov eax, dword [0x40a674]
call fcn.004051f4
cmp dword [0x40a674], 2
jne 0x4065c1
lea eax, [ebp - 0x18]
mov edx, dword [0x4090b0]
call fcn.00403860
cmp dword [0x40a674], 0x20
jne 0x4065d8
lea eax, [ebp - 0x18]
mov edx, dword [0x4090b4]
call fcn.00403860
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
call fcn.00405190
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00404e80
push dword [ebp - 0x28]
push 0x406764
lea edx, [ebp - 0x30]
mov eax, dword [0x40a674]
call fcn.00404e58
push dword [ebp - 0x30]
push 0x406778
push dword [ebp - 0x18]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.0040390c
mov eax, 0x406784
call fcn.00405cc8
test al, al
jne 0x40669d
cmp dword [ebp - 0x14], 1
jne 0x40665e
cmp dword [0x40a674], 0
je 0x40669d
push 0x40010
push 0x40678c
mov eax, dword [ebp - 0x18]
call fcn.00403a4c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x40a674]
mov dword [ebp - 0xc], eax
jmp 0x40669d
cmp dword [ebp - 0x14], 2
jne 0x40669d
cmp dword [0x40a674], 0
jne 0x40669d
cmp dword [ebp - 0xc], 1
jne 0x40669d
push 0x40134
push 0x40678c
mov eax, dword [0x4090b8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x40669d
push 0
push 0x40679c
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066da
lea eax, [ebp - 0x30]
call fcn.00403658
lea eax, [ebp - 0x2c]
call fcn.00403b78
lea eax, [ebp - 0x28]
call fcn.00403658
lea eax, [ebp - 0x24]
call fcn.00403b78
lea eax, [ebp - 0x18]
call fcn.00403658
ret