Function at 0x40b508
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1068
call fcn.00448580
mov dword [esp], 0xa29a29d5
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp]
cmp eax, 0x19db63ff
jg 0x40b5ac
cmp eax, 0xc576a704
jg 0x40b63f
cmp eax, 0xa943c30e
jle 0x40b6e5
cmp eax, 0xb245516b
jle 0x40b7ee
cmp eax, 0xb245516c
je 0x40b974
cmp eax, 0xb480bf9c
je 0x40b980
cmp eax, 0xbab41131
jne 0x40b53e
shl edi, 8
add edi, 0xece7
call fcn.0040b508
mov eax, 0x4daee6e9
cmp edi, 0x52
jge 0x40bb19
mov eax, 0x14debb1b
jmp 0x40bb19
cmp eax, 0x3fdbf742
jle 0x40b695
cmp eax, 0x58300900
jle 0x40b712
cmp eax, 0x5e2f3262
jle 0x40b826
cmp eax, 0x5e2f3263
je 0x40b9bd
cmp eax, 0x75f2564e
je 0x40b9e1
cmp eax, 0x790d5859
jne 0x40b53e
push 0x800
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x40], ebx
mov ebx, edi
mov edi, esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push 0x80
mov eax, 3
push eax
push esi
mov esi, edi
mov edi, ebx
mov ebx, dword [esp + 0x48]
push eax
push 0x80000000
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0xc], eax
mov dword [esp], 0xab7efe50
jmp 0x40b53e
cmp eax, 0xd062ab76
jle 0x40b75b
cmp eax, 0xfe24f2fe
jle 0x40b84c
cmp eax, 0xfe24f2ff
je 0x40ba14
cmp eax, 0x6b584ae
je 0x40ba2c
cmp eax, 0x14debb1b
jne 0x40b53e
imul edi, edi, 0x180a
add edi, 0x8135c
mov eax, 0x5e2f3263
cmp edi, 0x16
jb 0x40ba44
jmp 0x40bb19
cmp eax, 0x3146f307
jle 0x40b798
cmp eax, 0x369212a7
jle 0x40b89a
cmp eax, 0x369212a8
je 0x40ba4e
cmp eax, 0x36a77d40
je 0x40ba76
cmp eax, 0x38fc521a
jne 0x40b53e
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0x19db6400
xor esi, esi
inc esi
jmp 0x40b53e
cmp eax, 0x8e5fff47
jle 0x40b8c8
cmp eax, 0x8e5fff48
je 0x40baac
cmp eax, 0xa29a29d5
jne 0x40bc28
mov dword [esp], 0x29885649
jmp 0x40b53e
cmp eax, 0x4af1adba
jle 0x40b8ea
cmp eax, 0x4d8532fd
je 0x40bab8
cmp eax, 0x4daee6e9
jne 0x40bc35
shr edi, 0x10
call fcn.0040bc88
call fcn.0040b508
mov eax, 0xfe24f2ff
and edi, 0xffc0
je 0x40bb19
mov eax, 0x5e2f3263
jmp 0x40bb19
cmp eax, 0xcd3bc671
jg 0x40b918
cmp eax, 0xc576a705
je 0x40bae3
cmp eax, 0xc81225e2
jne 0x40b53e
push dword [esp + 0x14]
call fcn.0045b614
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp], 0x8e5fff48
jmp 0x40b53e
cmp eax, 0x29885648
jg 0x40b942
cmp eax, 0x19db6400
je 0x40baef
cmp eax, 0x249c2c31
jne 0x40b53e
mov eax, dword [esp + 4]
shr eax, 7
lea ecx, [eax - 0x88]
imul ecx, ecx
imul edx, ecx, 0x4dc3
dec edx
add eax, 0xffffffa8
mov dword [esp + 4], eax
mov eax, 0x2a7a1c87
cmp ecx, edx
je 0x40bb19
mov eax, 0x6b584ae
jmp 0x40bb19
cmp eax, 0xa943c30f
je 0x40baff
cmp eax, 0xab7efe50
jne 0x40b53e
mov ecx, dword [esp + 0xc]
mov eax, 0xcd3e54ed
cmp ecx, 0xffffffff
je 0x40b817
mov eax, 0xc576a705
mov dword [esp], eax
xor eax, eax
inc eax
mov dword [esp + 8], eax
jmp 0x40b53e
cmp eax, 0x58300901
je 0x40bb21
cmp eax, 0x599439bf
jne 0x40b53e
mov dword [esp + 0x44], ebx
mov dword [esp], 0x4ac7fc23
jmp 0x40b53e
cmp eax, 0xd062ab77
je 0x40bb42
cmp eax, 0xd683e227
jne 0x40b53e
mov eax, dword [esp + 4]
add eax, 0xffffffc8
imul ecx, eax, 0x1a20000
imul eax, eax
imul edx, eax, 0x6807
dec edx
add ecx, 0xffffff48
mov dword [esp + 4], ecx
mov ecx, 0x29885649
cmp eax, edx
je 0x40ba0c
mov ecx, 0x5e2f3263
jmp 0x40ba0c
cmp eax, 0x3146f308
je 0x40bb78
cmp eax, 0x3400d932
jne 0x40b53e
imul edi, edi, 0x10a8
add edi, 0xc4
mov dword [esp], 0x2a7a1c87
jmp 0x40b53e
cmp eax, 0x8330342a
je 0x40bba0
cmp eax, 0x839ecce6
jne 0x40b53e
mov dword [esp], 0xb245516c
jmp 0x40b53e
cmp eax, 0x3fdbf743
je 0x40bbda
cmp eax, 0x4ac7fc23
jne 0x40b53e
push dword [esp + 0x18]
call fcn.0045b269
add esp, 4
mov dword [esp], 0x8330342a
jmp 0x40b53e
cmp eax, 0xcd3bc672
je 0x40bbeb
cmp eax, 0xcd3e54ed
jne 0x40b53e
mov dword [esp], 0xa8d65b34
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
jmp 0x40b53e
cmp eax, 0x29885649
je 0x40bc08
cmp eax, 0x2a7a1c87
jne 0x40b53e
cmp dword [0x47cbc0], 1
mov eax, 0x58300901
je 0x40bb19
mov eax, 0x3146f308
jmp 0x40bb19
mov dword [esp], 0x790d5859
jmp 0x40b53e
xor eax, eax
mov dword [esp + 0x3c], eax
push eax
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x47cbc4]
mov dword [esp + 0x40], eax
mov dword [esp], 0x36a77d40
jmp 0x40b53e
push 0x14
push 0x47cbdc
lea eax, [esp + 0x58]
push eax
call fcn.004495ad
add esp, 0xc
mov ecx, 0x2a7a1c87
test eax, eax
je 0x40ba0c
mov ecx, 0x4af1adbb
jmp 0x40ba0c
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 0xc
shr ecx, 0x18
imul eax, eax
imul edx, eax, 0x1123
dec edx
add ecx, 0x55
mov dword [esp + 4], ecx
mov ecx, 0x5e2f3263
cmp eax, edx
je 0x40ba0c
mov ecx, 0xfe24f2ff
mov dword [esp], ecx
jmp 0x40b53e
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov dword [esp], 0x249c2c31
jmp 0x40b53e
mov ecx, dword [0x47cbc4]
add ecx, 0x30
mov eax, 0x38fc521a
cmp ecx, dword [esp + 0x14]
ja 0x40bb19
mov eax, 0xc81225e2
jmp 0x40bb19
shr edi, 8
and edi, 0xfffff
call fcn.0040b508
mov eax, 0xab7efe50
cmp edi, 0x132
jae 0x40ba6e
mov eax, 0x3400d932
add edi, 0xffffffc6
jmp 0x40bb19
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
add eax, ecx
add eax, 8
push 0x14
push 0x47cbc8
push eax
call fcn.004495ad
add esp, 0xc
mov ecx, 0xcd3bc672
test eax, eax
je 0x40baa1
mov ecx, 0x599439bf
mov dword [esp], ecx
xor ebx, ebx
inc ebx
jmp 0x40b53e
mov dword [esp], 0xb480bf9c
jmp 0x40b53e
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov dword [esp], 0x75f2564e
jmp 0x40b53e
mov dword [esp], 0x4d8532fd
jmp 0x40b53e
mov dword [esp], 0xcd3e54ed
mov dword [esp + 8], esi
jmp 0x40b53e
add edi, 0x12c
call fcn.0040bc88
mov eax, 0xbab41131
cmp edi, 0x23
je 0x40bb19
mov eax, 0x369212a8
mov dword [esp], eax
jmp 0x40b53e
mov eax, dword [esp + 4]
shl eax, 0x1d
add eax, 0xffffffd9
mov dword [esp + 4], eax
mov dword [esp], 0xa8d65b34
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
jmp 0x40b53e
mov eax, dword [esp + 4]
shr eax, 0x12
imul ecx, eax, 0x6e
imul eax, eax
imul edx, eax, 0x3b69
dec edx
add ecx, 0x4fa6
mov dword [esp + 4], ecx
mov ecx, 0x4d8532fd
cmp eax, edx
je 0x40bb6e
mov ecx, 0x599439bf
mov dword [esp], ecx
xor ebx, ebx
jmp 0x40b53e
mov eax, dword [esp + 4]
lea eax, [eax + eax*2]
add eax, eax
add eax, 0xffffffa5
shr eax, 0x15
imul eax, eax, 0xdb
add eax, 0x37
mov dword [esp + 4], eax
mov dword [esp], 0x839ecce6
jmp 0x40b53e
mov eax, dword [esp + 4]
lea ecx, [eax - 0xaf]
imul ecx, ecx
imul edx, ecx, 0x57a9
dec edx
shl eax, 5
add eax, 0xffffeea0
mov dword [esp + 4], eax
mov eax, 0xa943c30f
cmp edx, ecx
je 0x40bbce
mov eax, 0x19db6400
mov dword [esp], eax
mov esi, dword [esp + 0x44]
jmp 0x40b53e
call fcn.0040bc88
mov dword [esp], 0xd062ab77
jmp 0x40b53e
imul eax, dword [esp + 4], 0x27310
add eax, 0xfffffad0
mov dword [esp + 4], eax
mov dword [esp], 0x3fdbf743
jmp 0x40b53e
lea eax, [esp + 0x50]
push eax
push 0x1c
push 0x47cbc0
call fcn.0040cd70
add esp, 0xc
mov dword [esp], 0xd683e227
jmp 0x40b53e
cmp eax, 0xa8d65b34
jne 0x40b53e
jmp 0x40bc64
cmp eax, 0x4af1adbb
jne 0x40b53e
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret