Function at 0x40a878
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, esp
mov dword [esi + 4], 0x78a13529
mov edi, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
cmp eax, 0xfae101d4
jle 0x40a8fd
cmp eax, 0x4034fc6b
jle 0x40a96b
cmp eax, 0x626988b7
jg 0x40aa10
cmp eax, 0x4d18c8ea
jg 0x40ab4c
cmp eax, 0x43f3a4c7
jg 0x40adad
cmp eax, 0x4034fc6c
je 0x40b0da
cmp eax, 0x4131dcee
jne 0x40a8a2
imul eax, dword [esi + 0xc], 0x1e2000
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0xedfbd3cf
jmp 0x40a8a2
cmp eax, 0xb8b656b7
jg 0x40a9bf
cmp eax, 0xa5ab1a74
jle 0x40aa4e
cmp eax, 0xb1345af8
jg 0x40ab9b
cmp eax, 0xaa3358af
jg 0x40adfe
cmp eax, 0xa5ab1a75
je 0x40b105
cmp eax, 0xa5ae260f
jne 0x40a8a2
mov eax, dword [esi + 0xc]
mov ecx, eax
shl ecx, 6
sub ecx, eax
sub ecx, eax
shr ecx, 3
imul eax, ecx, 0xb00
add eax, 0xbe0
shr eax, 4
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x626988b8
jmp 0x40a8a2
cmp eax, 0x1f5e02cc
jle 0x40aa9a
cmp eax, 0x327a55ac
jg 0x40ac09
cmp eax, 0x28c86b28
jg 0x40ae36
cmp eax, 0x1f5e02cd
je 0x40b4c3
cmp eax, 0x22eb69f6
jne 0x40a8a2
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x48]
mov eax, 0x6753933f
cmp edx, ecx
ja 0x40b43f
mov eax, 0x4d070cd3
jmp 0x40b43f
cmp eax, 0xd138e463
jle 0x40aaf7
cmp eax, 0xe4f922e8
jg 0x40ac47
cmp eax, 0xd462280f
jg 0x40ae5e
cmp eax, 0xd138e464
je 0x40b12c
cmp eax, 0xd2d87be9
jne 0x40a8a2
push dword [esi + 0x2c]
call fcn.0044cb24
add esp, 4
mov dword [esi + 0x30], eax
mov dword [esi + 4], 0x4131dcee
jmp 0x40a8a2
cmp eax, 0x6a667c0e
jle 0x40ac87
cmp eax, 0x7831e239
jg 0x40aea6
cmp eax, 0x6a667c0f
je 0x40b151
cmp eax, 0x75fa082a
jne 0x40a8a2
mov eax, dword [esi + 0x14]
mov dword [esi + 0x50], eax
mov dword [esi + 4], 0x87a2011e
jmp 0x40a8a2
cmp eax, 0x970e455d
jg 0x40acd1
cmp eax, 0x8b71f59b
jg 0x40aee0
cmp eax, 0x81fa49ba
je 0x40b16e
cmp eax, 0x87a2011e
jne 0x40a8a2
push dword [esi + 0x30]
call fcn.0044c77c
add esp, 4
mov eax, dword [esi + 0x28]
mov dword [esi + 4], 0x1cb59434
mov eax, dword [esi + 0x50]
mov dword [esi + 0x10], eax
jmp 0x40a8a2
cmp eax, 0x12ec38b1
jle 0x40ad16
cmp eax, 0x1cb59433
jg 0x40af12
cmp eax, 0x12ec38b2
je 0x40b183
cmp eax, 0x13203bff
jne 0x40a8a2
mov eax, dword [esi + 8]
shl eax, 4
add eax, 0xc80
mov ebx, 0x43f3a4c8
and eax, 0xffffc000
mov dword [esi + 8], eax
je 0x40aae5
mov ebx, 0xaeaab18d
call fcn.0040b528
call fcn.0040b528
mov dword [esi + 4], ebx
jmp 0x40a8a2
cmp eax, 0xc275a18e
jle 0x40ad50
cmp eax, 0xc9db41b3
jg 0x40af49
cmp eax, 0xc275a18f
je 0x40b1bf
cmp eax, 0xc37141f3
jne 0x40a8a2
push 0
push dword [esi + 0x28]
push dword [esi + 0x2c]
push dword [esi + 0x30]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xbbaf56f0
jmp 0x40a8a2
cmp eax, 0x53c42fa3
jg 0x40af99
cmp eax, 0x4d18c8eb
je 0x40b1f2
cmp eax, 0x51cc038d
jne 0x40a8a2
mov eax, dword [esi + 8]
shr eax, 1
imul ecx, eax, 0x89
mov eax, ecx
shr eax, 0xe
mov dword [esi + 8], eax
mov eax, 0xb8b656b8
cmp ecx, 0x78000
jae 0x40b43f
mov eax, 0x4d18c8eb
jmp 0x40b43f
cmp eax, 0xb2a1aad1
jg 0x40afe4
cmp eax, 0xb1345af9
je 0x40b222
cmp eax, 0xb1bedde3
jne 0x40a8a2
push 0x800
push dword [esi + 0x20]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x80
mov eax, 3
push eax
push edi
push eax
push 0x80000000
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
mov ecx, dword [esi + 0x18]
mov eax, 0x2c387bd3
cmp ecx, 0xffffffff
je 0x40abfe
mov eax, 0xaa3358b0
mov dword [esi + 4], eax
xor edi, edi
inc edi
jmp 0x40a8a2
cmp eax, 0x3de22965
jg 0x40b020
cmp eax, 0x327a55ad
je 0x40b24a
cmp eax, 0x37be87e8
jne 0x40a8a2
mov eax, dword [esi + 8]
shl eax, 0xb
add eax, 0xffffffc2
mov dword [esi + 8], eax
call fcn.0040b528
mov dword [esi + 4], 0xc37141f3
jmp 0x40a8a2
cmp eax, 0xed59c7bb
jg 0x40b042
cmp eax, 0xe4f922e9
je 0x40b256
cmp eax, 0xecb12a5f
jne 0x40a8a2
mov eax, dword [esi + 0xc]
shr eax, 0xd
and eax, 0x3ffff
add eax, 0xb6
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0xc37141f3
jmp 0x40a8a2
cmp eax, 0x6753933e
jg 0x40b067
cmp eax, 0x626988b8
je 0x40b276
cmp eax, 0x63c138c0
jne 0x40a8a2
mov eax, dword [esi + 0xc]
shl eax, 5
add eax, 0x33
shr eax, 3
and eax, 0xfffffff0
add eax, 0xffffff3e
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x1cb59434
xor eax, eax
inc eax
mov dword [esi + 0x10], eax
jmp 0x40a8a2
cmp eax, 0x9abe1bac
jle 0x40b0ab
cmp eax, 0x9abe1bad
je 0x40b282
cmp eax, 0xa3f991de
jne 0x40a8a2
mov ebx, dword [esi + 8]
and ebx, 0xfffffffc
shl ebx, 8
mov dword [esi + 8], ebx
call fcn.0040a878
mov eax, 0xaeaab18d
cmp ebx, 0x15
jge 0x40b3d0
jmp 0x40b43f
cmp eax, 0xfae101d5
je 0x40b2a2
cmp eax, 0xfbc3114d
je 0x40b2cf
cmp eax, 0x1249dc0b
jne 0x40a8a2
cmp dword [esi + 0x44], 0
mov eax, 0xa5ae260f
je 0x40b43f
mov eax, 0x3de22966
jmp 0x40b43f
cmp eax, 0xb8b656b8
je 0x40b2ee
cmp eax, 0xbbaf56f0
je 0x40b313
cmp eax, 0xc12d797a
jne 0x40a8a2
mov eax, dword [esi + 8]
add eax, 0x3f
shr eax, 0xf
imul ebx, eax, 0x1300
mov eax, ebx
shr eax, 0xd
mov dword [esi + 8], eax
call fcn.0040b528
call fcn.0040b528
mov eax, 0xaeaab18d
cmp ebx, 0x42000
jb 0x40b43f
mov eax, 0x970e455e
jmp 0x40b43f
cmp eax, 0x43f3a4c8
je 0x40b332
cmp eax, 0x4d070cd3
jne 0x40a8a2
mov ecx, dword [esi + 0xc]
add ecx, 0x61
mov eax, ecx
imul eax, ecx
imul edx, eax, 0x1081
shl ecx, 5
add ecx, 0x2bc000
dec edx
shr ecx, 0xf
imul ecx, ecx, 0x7c
mov dword [esi + 0xc], ecx
mov ecx, 0x1249dc0b
cmp eax, edx
je 0x40b487
mov ecx, 0xd2d87be9
jmp 0x40b487
cmp eax, 0xaa3358b0
je 0x40b35c
cmp eax, 0xaeaab18d
jne 0x40a8a2
push 0x14
push 0x46f1e4
lea eax, [esi + 0x54]
push eax
call fcn.0043f31d
add esp, 0xc
mov dword [esi + 0x44], eax
mov dword [esi + 4], 0xc275a18f
jmp 0x40a8a2
cmp eax, 0x28c86b29
je 0x40b36b
cmp eax, 0x2c387bd3
jne 0x40a8a2
mov eax, dword [esi + 0x20]
mov dword [esi + 4], 0x69962771
mov dword [esi + 0x1c], edi
jmp 0x40a8a2
cmp eax, 0xd4622810
je 0x40b39b
cmp eax, 0xe098560e
jne 0x40a8a2
mov eax, dword [esi + 8]
shr eax, 2
imul ebx, eax, 0xf1
add ebx, 0x75
mov dword [esi + 8], ebx
call fcn.0040b528
mov eax, 0x9abe1bad
cmp ebx, 0xf5
jb 0x40b43f
mov eax, 0xd138e464
jmp 0x40b43f
cmp eax, 0x7831e23a
je 0x40b3b3
cmp eax, 0x78a13529
jne 0x40a8a2
push eax
sub esp, 0xffc
mov eax, esp
mov dword [esi + 0x20], eax
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x24], eax
mov dword [esi + 4], 0xb8b656b8
jmp 0x40a8a2
cmp eax, 0x8b71f59c
je 0x40b3d7
cmp eax, 0x96f251ba
jne 0x40a8a2
mov eax, dword [0x46f1cc]
mov ecx, dword [esi + 0x30]
add eax, ecx
add eax, 8
mov dword [esi + 0x4c], eax
mov dword [esi + 4], 0x12ec38b2
jmp 0x40a8a2
cmp eax, 0x1cb59434
je 0x40b3ec
cmp eax, 0x1e35e006
jne 0x40a8a2
cmp dword [0x46f1c8], 1
mov eax, 0x69962771
je 0x40af3b
mov eax, 0x6a667c0f
mov dword [esi + 4], eax
xor eax, eax
inc eax
mov dword [esi + 0x1c], eax
jmp 0x40a8a2
cmp eax, 0xc9db41b4
je 0x40b3fe
cmp eax, 0xcce8375a
jne 0x40a8a2
mov eax, dword [esi + 8]
shr eax, 0xc
imul ebx, eax, 0x4dae
add ebx, 0xfff5fc65
mov dword [esi + 8], ebx
call fcn.0040a878
call fcn.0040a878
mov eax, 0xb8b656b8
cmp ebx, 0xdb
jae 0x40b43f
mov eax, 0xed59c7bc
jmp 0x40b43f
cmp eax, 0x53c42fa4
je 0x40b424
cmp eax, 0x6116253f
jne 0x40a8a2
imul ebx, dword [esi + 8], 0x50c
add ebx, 0x36436
mov eax, ebx
shr eax, 7
mov dword [esi + 8], eax
call fcn.0040b528
mov eax, 0xa5ab1a75
cmp ebx, 0x3180
jae 0x40b43f
mov eax, 0x78a13529
jmp 0x40b43f
cmp eax, 0xb2a1aad2
je 0x40b447
cmp eax, 0xb351f17d
jne 0x40a8a2
mov ebx, dword [esi + 8]
add ebx, 0x70
mov dword [esi + 8], ebx
call fcn.0040a878
mov eax, 0x1249dc0b
cmp ebx, 0x43
jb 0x40b43f
mov eax, 0x37be87e8
jmp 0x40b43f
cmp eax, 0x3de22966
je 0x40b456
cmp eax, 0x3e41e8cd
jne 0x40a8a2
mov dword [esi + 4], 0x81fa49ba
jmp 0x40a8a2
cmp eax, 0xed59c7bc
je 0x40b48f
cmp eax, 0xedfbd3cf
jne 0x40a8a2
mov eax, dword [esi + 0x28]
mov dword [esi + 4], 0x3e41e8cd
jmp 0x40a8a2
cmp eax, 0x6753933f
jne 0x40b4aa
mov ecx, dword [esi + 0xc]
lea eax, [ecx - 0x1e6]
imul eax, eax
imul edx, eax, 0x2bb3
dec edx
imul ecx, ecx, 0x31ac0000
add ecx, 0xb3780000
mov dword [esi + 0xc], ecx
mov ecx, 0x78a13529
cmp eax, edx
je 0x40b487
mov ecx, 0x8b71f59c
jmp 0x40b487
cmp eax, 0x970e455e
jne 0x40b4b6
mov ecx, dword [esi + 8]
shl ecx, 0x16
mov eax, 0xa3f991de
add ecx, 0xc800000
mov dword [esi + 8], ecx
je 0x40b43f
mov eax, 0xfbc3114d
jmp 0x40b43f
push dword [esi + 0x24]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 0x24]
mov eax, dword [eax]
mov dword [esi + 0x2c], eax
mov eax, dword [0x46f1cc]
add eax, 0x30
mov dword [esi + 0x48], eax
mov dword [esi + 4], 0x22eb69f6
jmp 0x40a8a2
mov ecx, dword [esi + 8]
shl ecx, 0xb
or ecx, 6
mov dword [esi + 8], ecx
mov eax, 0x1e35e006
cmp ecx, 0x9c
jge 0x40b43f
mov eax, 0xc37141f3
jmp 0x40b43f
mov eax, dword [esi + 8]
lea eax, [eax + eax*8]
lea eax, [eax + eax*2]
shr eax, 0xb
add eax, 0xee
mov dword [esi + 8], eax
call fcn.0040b528
mov dword [esi + 4], 0x78a13529
jmp 0x40a8a2
mov eax, dword [esi + 0xc]
shl eax, 0xf
add eax, 0x6100f8
shr eax, 0x17
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0xb2a1aad2
jmp 0x40a8a2
mov eax, dword [esi + 0x28]
mov dword [eax], 0
mov dword [esi + 4], 0xecb12a5f
jmp 0x40a8a2
mov ecx, dword [esi + 0xc]
imul eax, ecx, 0xe5
add eax, 0x20
imul eax, eax
imul edx, eax, 0x49fb
imul ecx, ecx, 0x3b0a
dec edx
add ecx, 0xffffeefb
mov dword [esi + 0xc], ecx
mov ecx, 0xcce8375a
cmp eax, edx
je 0x40b487
mov ecx, 0x1f5e02cd
jmp 0x40b487
mov eax, dword [esi + 0xc]
mov ecx, 0xf0
add eax, ecx
mov ecx, eax
imul ecx, eax
shr eax, 0x1a
imul edx, ecx, 0x1591
dec edx
mov dword [esi + 0xc], eax
mov eax, 0x28c86b29
cmp ecx, edx
je 0x40b43f
mov eax, 0x1249dc0b
jmp 0x40b43f
imul ecx, dword [esi + 8], 0x46590
add ecx, 0x3eee938
mov eax, ecx
shr eax, 2
mov dword [esi + 8], eax
mov eax, 0xd2d87be9
cmp ecx, 0xc9
jae 0x40b43f
mov eax, 0xb1bedde3
jmp 0x40b43f
mov eax, dword [esi + 8]
lea ecx, [eax*4 - 0x24c]
mov dword [esi + 8], ecx
mov eax, 0x51cc038d
cmp ecx, 0xd4
jge 0x40b43f
mov eax, 0xe098560e
jmp 0x40b43f
mov dword [esi + 4], 0xb1bedde3
jmp 0x40a8a2
imul eax, dword [esi + 8], 0xe8000
mov dword [esi + 8], eax
call fcn.0040a878
call fcn.0040a878
mov dword [esi + 4], 0x1249dc0b
jmp 0x40a8a2
mov dword [esi + 4], 0x1e35e006
jmp 0x40a8a2
imul eax, dword [esi + 8], 0xbc0000
add eax, 0xffffff53
mov dword [esi + 8], eax
call fcn.0040b528
mov dword [esi + 4], 0xd2d87be9
jmp 0x40a8a2
imul ebx, dword [esi + 8], 0x578
add ebx, 0xfffcf770
mov dword [esi + 8], ebx
call fcn.0040b528
mov eax, 0x6116253f
cmp ebx, 0x70
jae 0x40b43f
mov eax, 0xb351f17d
jmp 0x40b43f
mov eax, dword [esi + 8]
shl eax, 0xf
add eax, 0xff908000
mov dword [esi + 8], eax
call fcn.0040b528
mov dword [esi + 4], 0x1249dc0b
jmp 0x40a8a2
push eax
mov eax, esp
mov dword [esi + 0x28], eax
lea eax, [esi + 0x54]
push eax
push 0x1c
push 0x46f1c8
call fcn.0040c098
add esp, 0xc
mov dword [esi + 4], 0xaeaab18d
jmp 0x40a8a2
mov eax, dword [esi + 0xc]
shl eax, 8
and eax, 0xfffff00
or eax, 0xec
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x96f251ba
jmp 0x40a8a2
mov eax, dword [esi + 8]
shr eax, 5
imul eax, eax, 0x11800
add eax, 0xfffef800
mov dword [esi + 8], eax
call fcn.0040b528
call fcn.0040a878
mov dword [esi + 4], 0x78a13529
jmp 0x40a8a2
mov eax, dword [esi + 0x24]
mov dword [esi + 4], 0x4034fc6c
jmp 0x40a8a2
imul ebx, dword [esi + 8], 0x70000
add ebx, 0x37f808a
mov dword [esi + 8], ebx
call fcn.0040b528
mov eax, 0x13203bff
cmp ebx, 0xc6
jl 0x40b43f
mov eax, 0xaeaab18d
jmp 0x40b43f
call fcn.0040b528
mov dword [esi + 4], 0x75fa082a
mov dword [esi + 0x14], 0
jmp 0x40a8a2
mov ecx, dword [esi + 8]
shl ecx, 0xf
add ecx, 0xffd90000
mov eax, ecx
shr eax, 7
mov dword [esi + 8], eax
mov eax, 0x1e35e006
test ecx, ecx
je 0x40b43f
mov eax, 0x22eb69f6
jmp 0x40b43f
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0x63c138c0
jmp 0x40a8a2
mov eax, dword [esi + 0x24]
mov dword [esi + 4], 0x2c387bd3
mov edi, dword [esi + 0x10]
jmp 0x40a8a2
imul eax, dword [esi + 8], 0xb2000
shr eax, 8
and eax, 0xffffff80
add eax, 0xde00
mov dword [esi + 8], eax
call fcn.0040a878
mov dword [esi + 4], 0xe4f922e9
jmp 0x40a8a2
mov ecx, dword [esi + 8]
shl ecx, 0x12
mov eax, 0xd2d87be9
add ecx, 0x4840000
mov dword [esi + 8], ecx
je 0x40b43f
mov eax, 0x4034fc6c
mov dword [esi + 4], eax
jmp 0x40a8a2
mov eax, dword [esi + 0x20]
mov dword [esi + 4], 0x327a55ad
jmp 0x40a8a2
mov eax, dword [esi + 0xc]
mov ecx, 0xffffff34
add eax, ecx
imul ecx, eax, 0x5e8
imul eax, eax
imul edx, eax, 0x1679
dec edx
add ecx, 0xffff8dd0
mov dword [esi + 0xc], ecx
mov ecx, 0xc9db41b4
cmp eax, edx
je 0x40b487
mov ecx, 0x9978191a
mov dword [esi + 4], ecx
jmp 0x40a8a2
imul eax, dword [esi + 8], 0x6a0
add eax, 0xe49
mov dword [esi + 8], eax
mov dword [esi + 4], 0x22eb69f6
jmp 0x40a8a2
cmp eax, 0x69962771
je 0x40b4ee
jmp 0x40a8a2
cmp eax, 0x9978191a
jne 0x40a8a2
jmp 0x40b50b
push 0x14
push 0x46f1d0
push dword [esi + 0x4c]
call fcn.0043f31d
add esp, 0xc
mov ecx, 0xd4622810
test eax, eax
je 0x40b4e3
mov ecx, 0x75fa082a
mov dword [esi + 4], ecx
xor eax, eax
inc eax
jmp 0x40a89f
mov dword [esi + 0x38], edi
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x34], eax
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x3c], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x40], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x38], edi
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x40], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]