Function at 0x40bc10
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, esp
mov dword [esi], 0xa29a29d5
mov eax, dword [esi + 0x38]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x34]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 0xc], eax
mov ebx, dword [esi + 0x40]
mov eax, dword [esi]
cmp eax, 0x68a4f95
jle 0x40bc91
cmp eax, 0x3fdbf742
jg 0x40bd0c
cmp eax, 0x29885648
jle 0x40bdd2
cmp eax, 0x3400d931
jle 0x40bf06
cmp eax, 0x36a77d3f
jle 0x40c0f8
cmp eax, 0x36a77d40
je 0x40c142
cmp eax, 0x38fc521a
jne 0x40bc39
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0x58300901
jmp 0x40bc39
cmp eax, 0xc81225e1
jg 0x40bd7c
cmp eax, 0xa943c30e
jg 0x40be2b
cmp eax, 0xa29a29d4
jg 0x40bf35
cmp eax, 0x8330342a
je 0x40c15c
cmp eax, 0x839ecce6
je 0x40c195
cmp eax, 0x8e5fff48
jne 0x40bc39
mov eax, dword [esi + 8]
mov ecx, 0xb3
add eax, ecx
mov ecx, eax
shr ecx, 6
imul eax, eax
imul edx, eax, 0x7aa1
add ecx, 0x9b
dec edx
mov dword [esi + 8], ecx
mov ecx, 0x68a4f96
cmp edx, eax
je 0x40c221
mov ecx, 0xc81225e2
jmp 0x40c221
cmp eax, 0x58300900
jle 0x40be8d
cmp eax, 0x75f2564d
jg 0x40bf6a
cmp eax, 0x5e2f3262
jg 0x40c123
cmp eax, 0x58300901
je 0x40c1b5
cmp eax, 0x599439bf
jne 0x40bc39
mov ecx, dword [esi + 8]
lea eax, [ecx + 0xb2]
imul eax, eax
imul edx, eax, 0x46c3
dec edx
imul ecx, ecx, 0x1a44
add ecx, 0xfff588e8
mov dword [esi + 8], ecx
mov ecx, 0x3fdbf743
cmp edx, eax
je 0x40c221
mov ecx, 0xcd3bc672
jmp 0x40c221
cmp eax, 0xd83bbc2a
jg 0x40bebe
cmp eax, 0xd062ab76
jg 0x40bfb9
cmp eax, 0xc81225e2
je 0x40c1dd
cmp eax, 0xcd3bc672
je 0x40c1f6
cmp eax, 0xcd3e54ed
jne 0x40bc39
push dword [esi + 0x30]
call fcn.0045809c
add esp, 4
mov eax, dword [esi + 0x28]
mov dword [esi], 0xa8d65b34
mov eax, dword [esi + 0x4c]
mov dword [esi + 0xc], eax
jmp 0x40bc39
cmp eax, 0x16e84695
jg 0x40bff6
cmp eax, 0x68a4f96
je 0x40c228
cmp eax, 0x6b584ae
je 0x40c248
cmp eax, 0x14debb1b
jne 0x40bc39
imul edi, dword [esi + 4], 0x33cd
shr edi, 7
mov dword [esi + 4], edi
call fcn.0040bc10
mov eax, 0xeff86910
cmp edi, 0xd7
je 0x40c537
mov eax, 0xd83bbc2b
jmp 0x40c537
cmp eax, 0xb480bf9b
jg 0x40c047
cmp eax, 0xa943c30f
je 0x40c266
cmp eax, 0xab7efe50
je 0x40c27a
cmp eax, 0xb245516c
jne 0x40bc39
mov ecx, dword [esi + 8]
lea eax, [ecx - 0x22]
add ecx, 0xffffffc6
imul eax, eax
imul edx, eax, 0x5367
dec edx
shr ecx, 9
and ecx, 0x7ff800
mov dword [esi + 8], ecx
mov ecx, 0xdd6e6eab
cmp edx, eax
je 0x40c221
mov ecx, 0x3146f308
jmp 0x40c221
cmp eax, 0x4d8532fc
jg 0x40c07a
cmp eax, 0x3fdbf743
je 0x40c288
cmp eax, 0x4ac7fc23
je 0x40c2b6
cmp eax, 0x4af1adbb
je 0x40c0b9
jmp 0x40bc39
cmp eax, 0xf2b293a8
jg 0x40c0c4
cmp eax, 0xd83bbc2b
je 0x40c2e5
cmp eax, 0xdd6e6eab
je 0x40c300
cmp eax, 0xeff86910
jne 0x40bc39
mov eax, dword [esi + 4]
shl eax, 0x1a
lea ecx, [eax + 0xa4]
lea ecx, [ecx + ecx*8]
lea eax, [eax + ecx*2]
add eax, 0xa4
jmp 0x40c4f1
cmp eax, 0x29885649
je 0x40c311
cmp eax, 0x2a7a1c87
je 0x40c32a
cmp eax, 0x3146f308
jne 0x40bc39
mov eax, dword [esi + 0x20]
mov dword [esi], 0x790d5859
jmp 0x40bc39
cmp eax, 0xa29a29d5
je 0x40c34b
cmp eax, 0xa833e4a5
je 0x40c3a7
cmp eax, 0xa8d65b34
jne 0x40bc39
mov eax, dword [esi + 0x24]
mov dword [esi], 0xa943c30f
mov eax, dword [esi + 0xc]
mov dword [esi + 0x10], eax
jmp 0x40bc39
cmp eax, 0x75f2564e
je 0x40c3ce
cmp eax, 0x790d5859
je 0x40c3e7
cmp eax, 0x79e1c4ba
jne 0x40bc39
mov eax, dword [esi + 4]
lea eax, [eax + eax*8]
lea ecx, [eax*8 - 0x3fc0]
shr ecx, 2
add ecx, 0xffffff80
mov dword [esi + 4], ecx
mov eax, 0x29885649
cmp ecx, 3
jae 0x40c537
mov eax, 0x51983183
jmp 0x40c537
cmp eax, 0xd062ab77
je 0x40c432
cmp eax, 0xd2fce398
je 0x40c444
cmp eax, 0xd683e227
jne 0x40bc39
mov eax, dword [esi + 8]
shl eax, 7
add eax, 0xffffde3a
shr eax, 0x1e
mov dword [esi + 8], eax
mov dword [esi], 0x5e2f3263
jmp 0x40bc39
cmp eax, 0x16e84696
je 0x40c455
cmp eax, 0x19db6400
je 0x40c48c
cmp eax, 0x249c2c31
jne 0x40bc39
mov eax, dword [esi + 8]
shr eax, 9
imul ecx, eax, 0xf3
imul eax, eax
imul edx, eax, 0x11b
dec edx
mov dword [esi + 8], ecx
mov ecx, 0x29885649
cmp eax, edx
je 0x40c221
mov ecx, 0x6b584ae
jmp 0x40c221
cmp eax, 0xb480bf9c
je 0x40c49a
cmp eax, 0xbab41131
je 0x40c4a8
cmp eax, 0xc576a705
jne 0x40bc39
mov dword [esi + 8], 0
mov dword [esi], 0xab7efe50
jmp 0x40bc39
cmp eax, 0x4d8532fd
je 0x40c4c6
cmp eax, 0x4daee6e9
je 0x40c4e5
cmp eax, 0x51983183
jne 0x40bc39
mov eax, dword [esi + 4]
shl eax, 0xe
add eax, 0xffffff2e
shr eax, 0xc
add eax, 0x94
shr eax, 0xe
mov dword [esi + 4], eax
call fcn.0040c5c3
mov dword [esi], 0x839ecce6
jmp 0x40bc39
cmp eax, 0xf2b293a9
je 0x40c4ff
cmp eax, 0xf7765a04
je 0x40c53e
cmp eax, 0xfe24f2ff
jne 0x40bc39
mov eax, dword [0x479c50]
mov dword [esi + 0x48], eax
mov dword [esi], 0x249c2c31
jmp 0x40bc39
cmp eax, 0x369212a8
jne 0x40c56f
imul eax, dword [esi + 8], 0x2f940
add eax, 0xfffff17a
mov dword [esi + 8], eax
mov dword [esi], 0xa943c30f
xor eax, eax
inc eax
mov dword [esi + 0x10], eax
jmp 0x40bc39
cmp eax, 0x6bc68f2b
jne 0x40c57b
mov eax, dword [esi + 4]
lea eax, [eax*4 - 0x598]
and eax, 0xfffffc00
jmp 0x40c3bb
imul eax, dword [esi + 8], 0xe6200000
add eax, 0xfffae000
mov dword [esi + 8], eax
mov dword [esi], 0xb480bf9c
jmp 0x40bc39
mov ecx, dword [esi + 8]
shr ecx, 3
mov eax, ecx
imul eax, ecx
add ecx, 0x15
imul edx, eax, 0x7e83
dec edx
shr ecx, 5
imul ecx, ecx, 0xd1
mov dword [esi + 8], ecx
mov ecx, 0x3fdbf743
cmp edx, eax
je 0x40c18b
mov ecx, 0x19db6400
mov dword [esi], ecx
xor ebx, ebx
inc ebx
jmp 0x40bc39
cmp dword [0x479c4c], 1
mov eax, 0x3400d932
je 0x40c1a8
mov eax, 0xb245516c
mov dword [esi], eax
xor eax, eax
inc eax
mov dword [esi + 0x18], eax
jmp 0x40bc39
mov eax, dword [esi + 8]
shl eax, 0xd
add eax, 0x7e000
shr eax, 0xf
add eax, 0x3e
shr eax, 8
mov dword [esi + 8], eax
mov dword [esi], 0xa8d65b34
xor eax, eax
inc eax
mov dword [esi + 0xc], eax
jmp 0x40bc39
push dword [esi + 0x2c]
call fcn.00458444
add esp, 4
mov dword [esi + 0x30], eax
mov dword [esi], 0x36a77d40
jmp 0x40bc39
mov eax, dword [0x479c50]
mov ecx, dword [esi + 0x30]
add eax, ecx
add eax, 8
push 0x14
push 0x479c54
push eax
call fcn.004461cd
add esp, 0xc
mov ecx, 0x4ac7fc23
test eax, eax
je 0x40c221
mov ecx, 0x8330342a
mov dword [esi], ecx
jmp 0x40bc39
mov eax, dword [esi + 4]
shl eax, 9
add eax, 0x34800
and eax, 0x3fc00
imul eax, eax, 0x10c000
add eax, 0xffe34000
jmp 0x40c4f1
mov ecx, dword [esi + 0x48]
add ecx, 0x30
mov eax, 0x38fc521a
cmp ecx, dword [esi + 0x2c]
ja 0x40c537
mov eax, 0x8e5fff48
jmp 0x40c537
mov eax, dword [esi + 0x20]
mov dword [esi], 0x3400d932
mov eax, dword [esi + 0x10]
mov dword [esi + 0x18], eax
jmp 0x40bc39
mov eax, dword [esi + 0x24]
mov dword [esi], 0x4d8532fd
jmp 0x40bc39
mov eax, dword [esi + 0x28]
xor ecx, ecx
mov dword [eax], ecx
push ecx
push dword [esi + 0x28]
push dword [esi + 0x2c]
push dword [esi + 0x30]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0x599439bf
jmp 0x40bc39
mov eax, dword [esi + 8]
lea ecx, [eax - 0x4f]
imul ecx, ecx
imul edx, ecx, 0x287b
dec edx
add eax, 0xffffff4c
mov dword [esi + 8], eax
mov eax, 0xfe24f2ff
cmp ecx, edx
je 0x40c537
mov eax, 0xd062ab77
jmp 0x40c537
imul eax, dword [esi + 4], 0x83
add eax, 0xffffff29
shr eax, 1
mov dword [esi + 4], eax
call fcn.0040c5c3
jmp 0x40c3be
imul eax, dword [esi + 4], 0x9c
add eax, 0xffff97dc
jmp 0x40c4f1
cmp dword [esi + 0x44], 0
mov eax, 0x2a7a1c87
je 0x40c537
mov eax, 0xd683e227
jmp 0x40c537
imul eax, dword [esi + 8], 0x3dc00
shr eax, 0xe
imul eax, eax, 0xcd
add eax, 0x67
mov dword [esi + 8], eax
mov dword [esi], 0x4af1adbb
jmp 0x40bc39
push eax
sub esp, 0x10
mov eax, esp
mov dword [esi + 0x1c], eax
push eax
sub esp, 0xffc
mov eax, esp
mov dword [esi + 0x20], eax
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x24], eax
push eax
mov eax, esp
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x1c]
push dword [esi + 0x1c]
push 0x1c
push 0x479c4c
call fcn.0040d330
add esp, 0xc
push 0x14
push 0x479c68
push dword [esi + 0x1c]
call fcn.004461cd
add esp, 0xc
mov dword [esi + 0x44], eax
mov dword [esi], 0x29885649
jmp 0x40bc39
mov eax, dword [esi + 4]
shr eax, 9
and eax, 0x1ffff
imul eax, eax, 0x6f
shr eax, 0xd
add eax, 0x5f
mov dword [esi + 4], eax
call fcn.0040bc10
mov dword [esi], 0x29885649
jmp 0x40bc39
mov eax, dword [esi + 8]
shl eax, 0x1d
add eax, 0xffa00000
mov dword [esi + 8], eax
mov dword [esi], 0xfe24f2ff
jmp 0x40bc39
push 0x800
push dword [esi + 0x20]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x80
mov eax, 3
push eax
push edi
push eax
push 0x80000000
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x14], eax
mov ecx, dword [esi + 0x14]
mov eax, 0x369212a8
cmp ecx, 0xffffffff
je 0x40c537
mov eax, 0xc576a705
jmp 0x40c537
call fcn.0040c5c3
mov dword [esi], 0x19db6400
xor ebx, ebx
jmp 0x40bc39
imul eax, dword [esi + 4], 0x21c8c000
add eax, 0x3d68c56a
jmp 0x40c4f1
mov eax, dword [esi + 4]
add eax, 7
shr eax, 3
imul edi, eax, 0xb6
add edi, 0x3c
mov dword [esi + 4], edi
call fcn.0040c5c3
call fcn.0040c5c3
mov eax, 0xd2fce398
cmp edi, 0x7d
jb 0x40c537
mov eax, 0xa833e4a5
jmp 0x40c537
mov dword [esi + 0x4c], ebx
mov dword [esi], 0xcd3e54ed
jmp 0x40bc39
mov eax, dword [esi + 0x28]
mov dword [esi], 0x3fdbf743
jmp 0x40bc39
imul ecx, dword [esi + 4], 0xef00
mov eax, 0x14debb1b
add ecx, 0xffaa1400
mov dword [esi + 4], ecx
je 0x40c537
mov eax, 0x4daee6e9
jmp 0x40c537
push dword [esi + 0x24]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi + 0x24]
mov eax, dword [eax]
mov dword [esi + 0x2c], eax
mov dword [esi], 0x75f2564e
jmp 0x40bc39
imul eax, dword [esi + 4], 0x700000
add eax, 0xaf998000
mov dword [esi + 4], eax
mov dword [esi], 0x29885649
jmp 0x40bc39
mov edi, dword [esi + 4]
shl edi, 0xa
add edi, 0xffffff3e
mov eax, edi
shr eax, 4
add eax, 0x82
shr eax, 8
mov dword [esi + 4], eax
call fcn.0040c5c3
call fcn.0040c5c3
mov eax, 0x839ecce6
cmp edi, 0x7b7e0
jae 0x40c537
mov eax, 0xc81225e2
mov dword [esi], eax
jmp 0x40bc39
imul eax, dword [esi + 4], 0x1a000
add eax, 0xffc8c000
mov edi, 0x29885649
and eax, 0xffffc000
mov dword [esi + 4], eax
je 0x40c55e
mov edi, 0x16e84696
call fcn.0040c5c3
call fcn.0040bc10
mov dword [esi], edi
jmp 0x40bc39
cmp eax, 0x3400d932
je 0x40c5a3
jmp 0x40bc39
cmp eax, 0x5e2f3263
jne 0x40bc39
mov eax, dword [esi + 0x10]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x10]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x34], eax
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ebx
mov ecx, dword [esi + 0x1c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret