Function at 0x4027d0
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, 0x2a44
call fcn.00428360
push ebx
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0x10], 0
push edi
lea ecx, [esp + 0x58]
call fcn.00403775
push dword [ebp]
lea eax, [esp + 0x344]
mov dword [ebp + 0x370], 0
push 2
push 1
push eax
mov byte [esp + 0x90], 0
call fcn.0042e1d0
add esp, 0x10
cmp eax, 2
jne 0x403105
mov ebx, dword [esp + 0x18]
nop word [eax + eax]
movzx edi, byte [esp + 0x340]
movzx esi, byte [esp + 0x341]
cmp edi, 0x40
jb 0x402875
push dword [ebp]
lea eax, [esp + 0x344]
sub edi, 0x40
push 1
push 1
push eax
call fcn.0042e1d0
add esp, 0x10
cmp eax, 1
jne 0x403105
movzx eax, byte [esp + 0x340]
shl eax, 8
add esi, eax
cmp esi, 0x2710
ja case.0x4028b0.6
push dword [ebp]
lea eax, [esp + 0x344]
push esi
push 1
push eax
call fcn.0042e1d0
add esp, 0x10
cmp eax, esi
jne case.0x4028b0.6
dec edi
cmp edi, 0x2d
ja case.0x4028b0.6
movzx eax, byte [edi + 0x403228]
jmp dword [eax*4 + 0x4031f4]
cmp byte [ebp + 4], 0
jne 0x403120
xor edx, edx
cmp esi, 1
jb 0x4028d0
movzx edx, byte [esp + 0x340]
cmp esi, 2
jb 0x4028e2
movzx eax, byte [esp + 0x341]
shl edx, 8
or edx, eax
cmp esi, 3
jb 0x4028f4
movzx eax, byte [esp + 0x342]
shl edx, 8
or edx, eax
cmp esi, 4
jb 0x402906
movzx eax, byte [esp + 0x343]
shl edx, 8
or edx, eax
mov ecx, dword [ebp]
mov eax, edx
sar eax, 0x1f
and eax, 2
push eax
call fcn.00402740
add esp, 4
jmp case.0x4028b0.1
xor edi, edi
test esi, esi
je case.0x4028b0.1
nop dword [eax]
mov eax, dword [ebp + 0x118]
cmp eax, 0x20
je 0x40295f
cmp eax, 0x21
je 0x40295f
lea eax, [esp + 0x13]
mov byte [esp + 0x13], 0
push eax
push eax
push 1
lea ecx, [ebp + 0x228]
call fcn.0040445d
movzx ecx, byte [esp + 0x13]
jmp 0x40296c
lea ecx, [ebp + 0x11c]
call fcn.00426bfc
mov ecx, eax
movzx eax, byte [esp + edi + 0x340]
cmp eax, ecx
jne 0x403043
inc edi
cmp edi, esi
jl 0x402930
jmp case.0x4028b0.1
cmp byte [ebp + 4], 0
lea ecx, [ebp + 4]
jne 0x402997
mov eax, 0x2e
mov word [ecx], ax
lea edx, [esp + 0x80]
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x4029a0
lea ecx, [esp + 0x80]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4029b8
sub ecx, edx
cmp ecx, 3
jne 0x4029da
cmp byte [esp + 0x81], 0x3a
jne 0x4029da
cmp byte [esp + 0x82], 0x5c
je 0x4029f5
lea edi, [esp + 0x80]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4029e2
mov ax, word [0x4568cc]
mov word [edi], ax
lea ecx, [esp + 0x340]
mov byte [esp + esi + 0x340], 0
xor edx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402a10
sub ecx, esi
je 0x402a4d
nop dword [eax + eax]
cmp byte [esp + edx + 0x340], 0x5c
jne 0x402a32
mov byte [esp + edx + 0x340], 0x2f
lea ecx, [esp + 0x340]
inc edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402a40
sub ecx, esi
cmp edx, ecx
jb 0x402a20
lea edx, [esp + 0x340]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402a56
lea edi, [esp + 0x80]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402a67
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
nop
mov al, byte [esp + ecx + 0x340]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x20f], al
test al, al
jne 0x402a80
lea eax, [esp + 0x80]
push str.__msg_audits_bin.tmp
push eax
call fcn.004293e0
add esp, 8
test eax, eax
jne 0x402c8a
lea eax, [esp + 0x80]
push str.__msg_message_txt.tmp
push eax
call fcn.004293e0
add esp, 8
test eax, eax
jne 0x402c8a
nop
push 0
sub esp, 0xc
lea eax, [esp + 0x90]
mov ecx, esp
push eax
call fcn.00403745
lea eax, [esp + 0x38]
push eax
call fcn.0042686d
add esp, 0x14
lea ecx, [esp + 0x28]
push 0x465688
call fcn.00403878
push 0x4568c4
push 0
lea ecx, [esp + 0x30]
call fcn.004037fb
push eax
call fcn.0042df3d
add esp, 8
test eax, eax
je 0x402c73
push eax
call fcn.0042db5a
mov ax, word [0x456788]
lea edx, [esp + 0x84]
movq xmm0, qword [str.Overwrite]
add esp, 4
mov word [esp + 0x218], ax
mov esi, edx
mov al, byte [0x45678a]
movq qword [esp + 0x210], xmm0
mov byte [esp + 0x21a], al
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x402b60
lea edi, [esp + 0x210]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402b71
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x210]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402b90
mov ax, word [0x45678c]
mov word [ecx], ax
mov al, byte [0x45678e]
push 0
sub esp, 0xc
mov byte [ecx + 2], al
lea eax, [esp + 0x220]
mov ecx, esp
push eax
call fcn.00403745
lea eax, [esp + 0x50]
push eax
call fcn.0042686d
add esp, 0x14
lea ecx, [esp + 0x40]
push 0x465688
call fcn.00403878
push 0
sub esp, 0xc
mov ecx, esp
push str.SA_Self_Decrypting_Archive
call fcn.00403745
lea eax, [esp + 0x44]
push eax
call fcn.0042686d
add esp, 0x14
lea ecx, [esp + 0x34]
push 0x465688
call fcn.00403878
push 0
push 3
push 0
lea ecx, [esp + 0x40]
call fcn.004037fb
push eax
push 0
lea ecx, [esp + 0x50]
call fcn.004037fb
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov esi, eax
cmp esi, 2
je 0x403125
lea ecx, [esp + 0x34]
call fcn.0040377f
lea ecx, [esp + 0x40]
call fcn.0040377f
lea ecx, [esp + 0x28]
call fcn.0040377f
cmp esi, 6
je 0x402c7c
lea ecx, [esp + 0x80]
call fcn.004015c0
test eax, eax
je 0x402ad0
mov esi, 1
jmp 0x40310a
lea ecx, [esp + 0x28]
call fcn.0040377f
lea ecx, [esp + 0x80]
call fcn.00401d60
jmp 0x402c95
mov dword [esp + 0x80], 0x6c756e
push 0
sub esp, 0xc
lea eax, [esp + 0x90]
mov ecx, esp
push eax
call fcn.00403745
lea eax, [esp + 0x5c]
push eax
call fcn.0042686d
add esp, 0x14
lea ecx, [esp + 0x4c]
push 0x465688
call fcn.00403878
push 0x456900
push 0
lea ecx, [esp + 0x54]
call fcn.004037fb
push eax
call fcn.0042df3d
add esp, 8
lea ecx, [esp + 0x4c]
mov ebx, eax
call fcn.0040377f
jmp case.0x4028b0.1
mov eax, dword [ebp + 0x110]
cmp eax, 1
jne 0x402e0a
xor ecx, ecx
cmp esi, 4
jb 0x402dc4
movsd xmm3, qword [0x456908]
lea edx, [esi - 3]
xorps xmm2, xmm2
nop word [eax + eax]
movzx eax, byte [esp + ecx + 0x340]
xorps xmm1, xmm1
mulsd xmm2, xmm3
xorps xmm0, xmm0
cvtsi2sd xmm1, eax
movzx eax, byte [esp + ecx + 0x341]
cvtsi2sd xmm0, eax
movzx eax, byte [esp + ecx + 0x342]
addsd xmm2, xmm1
mulsd xmm2, xmm3
addsd xmm2, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
movzx eax, byte [esp + ecx + 0x343]
add ecx, 4
mulsd xmm2, xmm3
addsd xmm2, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
mulsd xmm2, xmm3
addsd xmm2, xmm0
cmp ecx, edx
jl 0x402d20
cmp ecx, esi
jge 0x402dad
nop word [eax + eax]
movzx eax, byte [esp + ecx + 0x340]
inc ecx
mulsd xmm2, xmm3
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm2, xmm0
cmp ecx, esi
jl 0x402d90
push ebx
push dword [ebp]
lea ecx, [ebp + 0x118]
movaps xmm3, xmm2
call fcn.00402390
jmp case.0x4028b0.1
cmp esi, 1
jb 0x402dd1
movzx ecx, byte [esp + 0x340]
cmp esi, 2
jb 0x402de3
movzx eax, byte [esp + 0x341]
shl ecx, 8
or ecx, eax
cmp esi, 3
jb 0x402df5
movzx eax, byte [esp + 0x342]
shl ecx, 8
or ecx, eax
push ebx
push ecx
push dword [ebp]
lea ecx, [ebp + 0x118]
call fcn.004022d0
jmp case.0x4028b0.1
cmp eax, 8
jne 0x40312d
push ebx
push dword [ebp]
lea ecx, [ebp + 0x118]
call fcn.004025e0
jmp case.0x4028b0.1
push ebx
call fcn.0042db5a
add esp, 4
cmp esi, 8
jne case.0x4028b0.1
push 0
sub esp, 0xc
lea eax, [esp + 0x90]
mov ecx, esp
push eax
call fcn.00403745
lea eax, [esp + 0x2c]
push eax
call fcn.0042686d
add esp, 0x14
lea ecx, [esp + 0x1c]
push 0x465688
call fcn.00403878
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push 0
lea ecx, [esp + 0x38]
call fcn.004037fb
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x402ead
lea eax, [esp + 0x340]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [esp + 0x1c]
call fcn.0040377f
jmp case.0x4028b0.1
cmp esi, 0x32
ja case.0x4028b0.6
push esi
lea eax, [esp + 0x344]
mov dword [esp + 0x1c], esi
push eax
lea eax, [esp + 0x194]
push eax
call fcn.0042aa50
add esp, 0xc
jmp case.0x4028b0.1
cmp esi, 2
je 0x402f03
cmp esi, 3
je 0x402f03
cmp esi, 0x1a
je 0x402f03
cmp esi, 0x22
je 0x402f03
cmp esi, 0x2a
jne case.0x4028b0.6
mov cl, byte [esp + 0x341]
mov edi, 1
shl edi, cl
cmp esi, 3
jb 0x402f28
mov cl, byte [esp + 0x342]
mov eax, 1
shl eax, cl
mov dword [esp + 0x14], eax
cmp esi, 4
jb 0x402f68
push 0
lea eax, [esp + 0x346]
push eax
lea eax, [esi - 2]
push eax
lea ecx, [esp + 0x80]
call fcn.0040372b
push eax
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x60]
call fcn.00403784
lea ecx, [esp + 0x68]
call fcn.0040377f
lea ecx, [esp + 0x74]
call fcn.0040377f
mov ecx, dword [ebp + 0x108]
test ecx, ecx
jne 0x402fc7
mov ecx, dword [ebp + 0x114]
test cl, 2
jne 0x402c69
lea eax, [esp + 0x1c0]
push eax
lea edx, [ebp + 4]
call fcn.004010f0
add esp, 4
test eax, eax
jne 0x402c69
lea eax, [esp + 0x1c0]
mov ecx, eax
mov dword [ebp + 0x10c], eax
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402fb0
sub ecx, edx
mov dword [ebp + 0x108], ecx
test ecx, ecx
je 0x402c69
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x194]
push eax
push dword [esp + 0x24]
movsx eax, byte [esp + 0x350]
push dword [ebp + 0x10c]
push ecx
push edi
push eax
lea ecx, [ebp + 0x118]
call fcn.00401e10
mov eax, dword [ebp + 0x118]
cmp eax, 0x1d
je 0x40300d
cmp eax, 0x1e
je 0x40300d
cmp eax, 0x1f
jne 0x40301c
lea ecx, [ebp + 0x228]
call fcn.00403813
test eax, eax
jne 0x403043
mov eax, dword [ebp + 0x118]
cmp eax, 0x20
je 0x403030
cmp eax, 0x21
jne case.0x4028b0.1
lea ecx, [ebp + 0x11c]
call fcn.00403813
test eax, eax
je case.0x4028b0.1
mov esi, 7
jmp 0x40310a
xor ecx, ecx
cmp esi, 1
jb 0x40305c
movzx ecx, byte [esp + 0x340]
cmp esi, 2
jb 0x40306e
movzx eax, byte [esp + 0x341]
shl ecx, 8
or ecx, eax
cmp esi, 3
jb 0x403080
movzx eax, byte [esp + 0x342]
shl ecx, 8
or ecx, eax
cmp esi, 4
jb 0x403092
movzx eax, byte [esp + 0x343]
shl ecx, 8
or ecx, eax
mov dword [ebp + 0x110], ecx
jmp case.0x4028b0.1
xor ecx, ecx
cmp esi, 1
jb 0x4030a9
movzx ecx, byte [esp + 0x340]
cmp esi, 2
jb 0x4030bb
movzx eax, byte [esp + 0x341]
shl ecx, 8
or ecx, eax
cmp esi, 3
jb 0x4030cd
movzx eax, byte [esp + 0x342]
shl ecx, 8
or ecx, eax
cmp esi, 4
jb 0x4030df
movzx eax, byte [esp + 0x343]
shl ecx, 8
or ecx, eax
mov dword [ebp + 0x114], ecx
push dword [ebp]
lea eax, [esp + 0x344]
push 2
push 1
push eax
call fcn.0042e1d0
add esp, 0x10
cmp eax, 2
je 0x402830
mov esi, 3
lea ecx, [esp + 0x58]
call fcn.0040377f
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x2a44
ret
or esi, 0xffffffff
jmp 0x40310a
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov esi, 2
jmp 0x40310a
xor ecx, ecx
cmp esi, 1
jb 0x403143
movzx ecx, byte [esp + 0x340]
cmp esi, 2
jb 0x403155
movzx eax, byte [esp + 0x341]
shl ecx, 8
or ecx, eax
cmp esi, 3
jb 0x403167
movzx eax, byte [esp + 0x342]
shl ecx, 8
or ecx, eax
cmp esi, 4
jb 0x403179
movzx eax, byte [esp + 0x343]
shl ecx, 8
or ecx, eax
cmp ecx, dword [ebp + 0x370]
je 0x4031ea
cmp byte [esp + 0x80], 0
je case.0x4028b0.6
cmp byte [0x465684], 0
jne case.0x4028b0.6
push 0
sub esp, 0xc
lea eax, [esp + 0x90]
mov ecx, esp
push eax
call fcn.00403745
lea eax, [esp + 0x2c]
push eax
call fcn.0042686d
add esp, 0x14
lea ecx, [esp + 0x1c]
push 0x465688
call fcn.00403878
push 0
lea ecx, [esp + 0x20]
call fcn.004037fb
push eax
call fcn.0042e333
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0040377f
mov esi, 5
jmp 0x40310a
xor esi, esi
jmp 0x40310a