Function at 0x40ab5c
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, esp
mov dword [esi + 4], 0xaa937b77
mov eax, dword [esi + 0x38]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x14], eax
mov ebx, dword [esi + 0x44]
mov eax, dword [esi + 4]
cmp eax, 0x6f0d1ec
jle 0x40abf8
cmp eax, 0x4431cd5a
jg 0x40ac69
cmp eax, 0x1ceb96f0
jg 0x40ad28
cmp eax, 0xa3fe075
jle 0x40ae7c
cmp eax, 0x12caeac4
jg 0x40b069
cmp eax, 0xa3fe076
je 0x40b264
cmp eax, 0xbcb9fe6
jne 0x40ab86
imul edi, dword [esi + 8], 0x6a
add edi, 0x692c
mov dword [esi + 8], edi
call fcn.0040b6a6
call fcn.0040b6a6
mov eax, 0x724743a3
cmp edi, 0x76
jb 0x40b5f4
jmp 0x40b648
cmp eax, 0xc7b8ff6c
jg 0x40acb8
cmp eax, 0xaf97212a
jg 0x40ad68
cmp eax, 0x90fbe530
jle 0x40aeb2
cmp eax, 0xa076448c
jg 0x40b099
cmp eax, 0x90fbe531
je 0x40b293
cmp eax, 0x9d1fe6d8
jne 0x40ab86
mov eax, dword [esi + 0x2c]
xor ecx, ecx
mov dword [eax], ecx
push ecx
push dword [esi + 0x2c]
push dword [esi + 0x30]
push dword [esi + 0x34]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xc71cd4ca
jmp 0x40ab86
cmp eax, 0x602deeae
jg 0x40ada3
cmp eax, 0x4da77fdd
jle 0x40af05
cmp eax, 0x5ad917fb
jg 0x40b0e5
cmp eax, 0x4da77fde
je 0x40b2aa
cmp eax, 0x4f223572
jne 0x40ab86
mov dword [esi + 8], 0xffffffb8
call fcn.0040ab5c
mov dword [esi + 4], 0xf0d8d6c9
jmp 0x40ab86
cmp eax, 0xeb227f64
jle 0x40adf9
cmp eax, 0xf247de0e
jle 0x40af4d
cmp eax, 0xf6c5cd5a
jg 0x40b122
cmp eax, 0xf247de0f
je 0x40b2cb
cmp eax, 0xf3916fd5
jne 0x40ab86
mov eax, dword [esi + 8]
shl eax, 0xf
add eax, 0xc18000
shr eax, 9
imul edi, eax, 0x65
mov dword [esi + 8], edi
call fcn.0040ab5c
call fcn.0040ab5c
mov eax, 0x724743a3
cmp edi, 0xa6
jb 0x40b648
mov eax, 0x9d1fe6d8
jmp 0x40b648
cmp eax, 0x3179aa01
jle 0x40af93
cmp eax, 0x3bc3b378
jg 0x40b174
cmp eax, 0x3179aa02
je 0x40b2e0
cmp eax, 0x3a09e3b4
jne 0x40ab86
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x30], eax
mov dword [esi + 4], 0x6f0d1ed
jmp 0x40ab86
cmp eax, 0xbcf08c17
jle 0x40afdc
cmp eax, 0xc3501d21
jg 0x40b1b8
cmp eax, 0xbcf08c18
je 0x40b312
cmp eax, 0xbf8677a6
jne 0x40ab86
mov dword [esi + 0x54], ebx
mov dword [esi + 4], 0x90fbe531
jmp 0x40ab86
cmp eax, 0x6c9a1992
jle 0x40b037
cmp eax, 0x724743a2
jg 0x40b20b
cmp eax, 0x6c9a1993
je 0x40b33c
cmp eax, 0x6de2b0ce
jne 0x40ab86
mov eax, dword [esi + 8]
shl eax, 8
and eax, 0x7fffff00
or eax, 0x1f
imul eax, eax, 0x74
mov dword [esi + 8], eax
call fcn.0040b6a6
call fcn.0040b6a6
mov dword [esi + 4], 0xf3916fd5
jmp 0x40ab86
cmp eax, 0xe02f4fe1
jle 0x40ae40
cmp eax, 0xe26df8f1
jg 0x40b22d
cmp eax, 0xe02f4fe2
je 0x40b370
cmp eax, 0xe04cd1ec
jne 0x40ab86
mov eax, dword [esi + 0xc]
shl eax, 8
and eax, 0x1fffff00
add eax, 0xffffffb2
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0xbf8677a6
xor ebx, ebx
jmp 0x40ab86
cmp eax, 0xd85c26d5
jg 0x40b24d
cmp eax, 0xc7b8ff6d
je 0x40b3a8
cmp eax, 0xccb8bb14
jne 0x40ab86
imul eax, dword [esi + 0xc], 0xd8
add eax, 0xd7d8
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x1ceb96f1
jmp 0x40ab86
cmp eax, 0x6f0d1ed
je 0x40b3c4
cmp eax, 0x76d9ca6
je 0x40b3f4
cmp eax, 0x80ea686
jne 0x40ab86
mov eax, dword [esi + 0x2c]
mov dword [esi + 4], 0xf247de0f
mov eax, dword [esi + 0x54]
mov dword [esi + 0x14], eax
jmp 0x40ab86
cmp eax, 0x88be01a0
je 0x40b411
cmp eax, 0x8927a85f
je 0x40b42a
cmp eax, 0x895cf966
jne 0x40ab86
mov ecx, dword [esi + 0xc]
mov eax, ecx
shr eax, 3
shr ecx, 7
imul eax, eax
imul edx, eax, 0x685b
dec edx
add ecx, 0xffffff97
mov dword [esi + 0xc], ecx
mov ecx, 0x724743a3
cmp edx, eax
je 0x40b5c1
mov ecx, 0xf6c5cd5b
jmp 0x40b5c1
cmp eax, 0x4431cd5b
je 0x40b44b
cmp eax, 0x459792f2
je 0x40b481
cmp eax, 0x47b9c609
jne 0x40ab86
mov ecx, dword [esi + 8]
shl ecx, 0x13
add ecx, 0xfa68008a
mov dword [esi + 8], ecx
mov eax, 0x2aba2a05
cmp ecx, 0x60
jl 0x40b648
mov eax, 0xbcf08c18
jmp 0x40b648
cmp eax, 0xeb227f65
je 0x40b4be
cmp eax, 0xeee9bf99
je 0x40b4d2
cmp eax, 0xf0d8d6c9
jne 0x40ab86
imul ecx, dword [esi + 8], 0x530
mov dword [esi + 8], ecx
mov eax, 0xa076448d
cmp ecx, 0xd1
jae 0x40b648
mov eax, 0x88be01a0
jmp 0x40b648
cmp eax, 0x1ceb96f1
je 0x40b4f0
cmp eax, 0x241b1475
je 0x40b1ac
cmp eax, 0x2aba2a05
jne 0x40ab86
imul edi, dword [esi + 8], 0xd7
shr edi, 0x17
mov dword [esi + 8], edi
call fcn.0040b6a6
mov eax, 0x4157743f
cmp edi, 0xd9
jne 0x40b5f4
jmp 0x40b648
cmp eax, 0xaf97212b
je 0x40b4fc
cmp eax, 0xb2409be6
je 0x40b533
cmp eax, 0xb244b70c
jne 0x40ab86
imul eax, dword [esi + 0xc], 0x72
shr eax, 0xf
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x3335
dec edx
shl eax, 8
add eax, 0xffff2e00
mov dword [esi + 0xc], eax
mov eax, 0x845a74
cmp ecx, edx
je 0x40b029
mov eax, 0xe7dc6a3e
mov dword [esi + 4], eax
xor eax, eax
inc eax
mov dword [esi + 0x10], eax
jmp 0x40ab86
cmp eax, 0x602deeaf
je 0x40b559
cmp eax, 0x64ee4232
je 0x40b565
cmp eax, 0x65a2ab43
jne 0x40ab86
call fcn.0040b6a6
mov dword [esi + 4], 0xe04cd1ec
jmp 0x40ab86
cmp eax, 0x12caeac5
je 0x40b574
cmp eax, 0x13d0c0b8
jne 0x40ab86
mov eax, dword [esi + 0xc]
shl eax, 0xd
or eax, 0xb0
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x7e43d795
jmp 0x40ab86
cmp eax, 0xa076448d
je 0x40b58f
cmp eax, 0xaa937b77
jne 0x40ab86
push eax
sub esp, 0x10
mov eax, esp
mov dword [esi + 0x20], eax
push eax
sub esp, 0xffc
mov eax, esp
mov dword [esi + 0x24], eax
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x28], eax
push eax
mov eax, esp
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 4], 0x241b1475
jmp 0x40ab86
cmp eax, 0x5ad917fc
je 0x40b5c9
cmp eax, 0x5f257485
jne 0x40ab86
mov eax, dword [esi + 8]
and eax, 0xfffffffe
shl eax, 8
add eax, 0xfffffee2
mov dword [esi + 8], eax
call fcn.0040ab5c
call fcn.0040b6a6
mov dword [esi + 4], 0x724743a3
jmp 0x40ab86
cmp eax, 0xf6c5cd5b
je 0x40b5fb
cmp eax, 0x845a74
jne 0x40ab86
push 0x800
push dword [esi + 0x24]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x80
mov eax, 3
push eax
push edi
push eax
push 0x80000000
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
mov dword [esi + 4], 0x13d0c0b8
jmp 0x40ab86
cmp eax, 0x3bc3b379
je 0x40b60a
cmp eax, 0x4157743f
jne 0x40ab86
mov eax, dword [esi + 8]
shl eax, 0xf
add eax, 0xf8680000
and eax, 0xfff80000
or eax, 0x300
mov dword [esi + 8], eax
call fcn.0040b6a6
call fcn.0040b6a6
mov dword [esi + 4], 0xa076448d
jmp 0x40ab86
cmp eax, 0xc3501d22
je 0x40b622
cmp eax, 0xc71cd4ca
jne 0x40ab86
mov eax, dword [esi + 0xc]
shr eax, 0xc
add eax, 0x62
shr eax, 8
lea ecx, [eax + eax*4]
mov edx, eax
imul edx, eax
imul edi, edx, 0x139d
lea eax, [ecx + ecx]
add eax, 0x24e
dec edi
mov dword [esi + 0xc], eax
mov eax, 0x47b9c609
cmp edx, edi
je 0x40b648
mov eax, 0xc7b8ff6d
jmp 0x40b648
cmp eax, 0x724743a3
je 0x40b636
cmp eax, 0x7e43d795
jne 0x40ab86
mov dword [esi + 4], 0xc3501d22
jmp 0x40ab86
cmp eax, 0xe7dc6a3e
jne 0x40b650
mov eax, dword [esi + 0x24]
mov dword [esi + 4], 0xe26df8f2
mov eax, dword [esi + 0x10]
mov dword [esi + 0x1c], eax
jmp 0x40ab86
cmp eax, 0xdd27e91b
jne 0x40b65c
mov dword [esi + 4], 0x845a74
jmp 0x40ab86
mov eax, dword [esi + 0xc]
shr eax, 0xb
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x2e99
shl eax, 9
dec edx
mov dword [esi + 0xc], eax
mov eax, 0xa076448d
cmp ecx, edx
je 0x40b648
mov eax, 0x3a09e3b4
jmp 0x40b648
push dword [esi + 0x34]
call fcn.0045b0dc
add esp, 4
mov dword [esi + 4], 0x80ea686
jmp 0x40ab86
mov ecx, dword [0x47cbe4]
add ecx, 0x30
mov eax, 0x12caeac5
cmp ecx, dword [esi + 0x30]
ja 0x40b648
mov eax, 0xccb8bb14
jmp 0x40b648
mov eax, dword [esi + 0x28]
mov dword [esi + 4], 0xe7dc6a3e
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], eax
jmp 0x40ab86
mov eax, dword [esi + 8]
lea eax, [eax + eax*2]
lea ecx, [eax + eax]
add ecx, 0x27c
mov eax, ecx
shr eax, 6
mov dword [esi + 8], eax
mov eax, 0xc3501d22
cmp ecx, 0x3440
jae 0x40b648
mov eax, 0x4da77fde
jmp 0x40b648
mov eax, dword [esi + 8]
shr eax, 0xa
imul eax, eax, 0x2c40
add eax, 0xffb2e7c0
mov dword [esi + 8], eax
call fcn.0040b6a6
call fcn.0040b6a6
mov dword [esi + 4], 0x4da77fde
jmp 0x40ab86
imul edi, dword [esi + 8], 0x8f000
mov eax, edi
shr eax, 0xf
mov dword [esi + 8], eax
call fcn.0040ab5c
call fcn.0040ab5c
mov eax, 0x3a09e3b4
cmp edi, 0x2e0000
jb 0x40b648
mov eax, 0x3179aa02
jmp 0x40b648
imul ecx, dword [esi + 0xc], 0x107f
mov eax, ecx
shr eax, 0xb
imul eax, eax
imul edx, eax, 0x665b
dec edx
shr ecx, 0x13
mov dword [esi + 0xc], ecx
mov ecx, 0x5f257485
cmp eax, edx
je 0x40b39a
mov ecx, 0xe26df8f2
mov dword [esi + 4], ecx
xor eax, eax
inc eax
mov dword [esi + 0x1c], eax
jmp 0x40ab86
mov eax, dword [0x47cbe4]
mov ecx, dword [esi + 0x34]
add eax, ecx
add eax, 8
mov dword [esi + 0x4c], eax
mov dword [esi + 4], 0xb2409be6
jmp 0x40ab86
mov eax, dword [esi + 0xc]
shr eax, 0xe
imul ecx, eax, 0x910
imul eax, eax
imul edx, eax, 0x45b9
dec edx
mov dword [esi + 0xc], ecx
mov ecx, 0xa076448d
cmp edx, eax
je 0x40b5c1
mov ecx, 0x4da77fde
jmp 0x40b5c1
push dword [esi + 0x30]
call fcn.0045b484
add esp, 4
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 4], 0x602deeaf
jmp 0x40ab86
cmp dword [esi + 0x50], 0
mov eax, 0x4431cd5b
je 0x40b648
mov eax, 0x459792f2
jmp 0x40b648
push 0x14
push 0x47cbe8
push dword [esi + 0x4c]
call fcn.0044920d
add esp, 0xc
mov dword [esi + 0x50], eax
mov dword [esi + 4], 0x88be01a0
jmp 0x40ab86
imul eax, dword [esi + 0xc], 0x45
add eax, 0x3855
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x86bb
dec edx
shr eax, 1
and eax, 0x1ffff
mov dword [esi + 0xc], eax
mov eax, 0x3bc3b379
cmp edx, ecx
je 0x40b648
mov eax, 0x65a2ab43
jmp 0x40b648
mov eax, dword [esi + 0xc]
mov ecx, 0xffffff15
add eax, ecx
shr eax, 2
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x86b7
dec edx
shl eax, 0xc
add eax, 0xfff45000
mov dword [esi + 0xc], eax
mov eax, 0x4f223572
cmp edx, ecx
je 0x40b4b3
mov eax, 0xbf8677a6
mov dword [esi + 4], eax
xor ebx, ebx
inc ebx
jmp 0x40ab86
mov eax, dword [0x47cbe0]
mov dword [esi + 0x48], eax
mov dword [esi + 4], 0x724743a3
jmp 0x40ab86
imul eax, dword [esi + 0xc], 0x2640
add eax, 0xffffb86f
shr eax, 4
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0xd85c26d6
jmp 0x40ab86
mov dword [esi + 4], 0x76d9ca6
jmp 0x40ab86
imul eax, dword [esi + 8], 0x53f000
add eax, 0x29502000
shr eax, 0xf
imul edi, eax, 0x2b
mov dword [esi + 8], edi
call fcn.0040ab5c
call fcn.0040ab5c
mov eax, 0xbcb9fe6
cmp edi, 0x60
jae 0x40b648
mov eax, 0x6de2b0ce
jmp 0x40b648
mov eax, dword [esi + 0xc]
add eax, 0x60
imul ecx, eax, 0x65
imul eax, eax
imul edx, eax, 0x50d1
dec edx
mov dword [esi + 0xc], ecx
mov ecx, 0xaf97212b
cmp edx, eax
je 0x40b5c1
mov ecx, 0x8927a85f
jmp 0x40b5c1
mov dword [esi + 4], 0x9d1fe6d8
jmp 0x40ab86
mov eax, dword [esi + 0x28]
mov dword [esi + 4], 0x3bc3b379
jmp 0x40ab86
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xf247de0f
xor eax, eax
inc eax
mov dword [esi + 0x14], eax
jmp 0x40ab86
push dword [esi + 0x20]
push 0x1c
push 0x47cbe0
call fcn.0040c454
add esp, 0xc
push 0x14
push 0x47cbfc
push dword [esi + 0x20]
call fcn.0044920d
add esp, 0xc
mov ecx, 0xeb227f65
test eax, eax
je 0x40b5c1
mov ecx, 0xeee9bf99
mov dword [esi + 4], ecx
jmp 0x40ab86
mov edi, dword [esi + 8]
shl edi, 0xa
add edi, 0xfffc3000
mov eax, edi
shr eax, 0x10
add eax, 0xfffffe92
mov dword [esi + 8], eax
call fcn.0040ab5c
mov eax, 0x845a74
cmp edi, 0x2340000
jae 0x40b648
mov eax, 0xa076448d
jmp 0x40b648
mov eax, dword [esi + 0x24]
mov dword [esi + 4], 0xdd27e91b
jmp 0x40ab86
push dword [esi + 0x28]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [esi + 4], 0xa3fe076
jmp 0x40ab86
mov ecx, dword [esi + 0x18]
mov eax, 0xb244b70c
cmp ecx, 0xffffffff
je 0x40b648
mov eax, 0x64ee4232
jmp 0x40b648
mov ecx, dword [esi + 0x48]
mov eax, 0xe02f4fe2
cmp ecx, 1
je 0x40b648
mov eax, 0x895cf966
mov dword [esi + 4], eax
jmp 0x40ab86
cmp eax, 0xe26df8f2
je 0x40b684
jmp 0x40ab86
cmp eax, 0xd85c26d6
jne 0x40ab86
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x38], ecx
mov eax, dword [esi + 0x10]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
mov eax, dword [esi + 0x20]
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret