Function at 0x40e9fd
Capabilities:
Bypass windows file protection
Get file attributes
Read file on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov eax, 0xb3cc
call fcn.0041c240
push ebx
push ebp
push esi
push edi
push 0x42f79c
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x40ea72
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42f7b0
push esi
call edi
mov bl, byte [esp + 0xb3e0]
test eax, eax
je 0x40ea4a
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 0x42f5dc
push ecx
call eax
push 0x42f7c4
push esi
call edi
test eax, eax
je 0x40ea72
xor ecx, ecx
test bl, bl
sete cl
dec ecx
and ecx, 0xfffff800
add ecx, 0x1000
push ecx
call eax
mov byte [esp + 0x13], 1
mov eax, dword [0x439080]
or ebp, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x800
mov dword [esp + 0x18], 0x42f7e0
mov dword [esp + 0x1c], 0x42f7f8
cmp byte [eax], 0x78
mov dword [esp + 0x20], 0x42f814
mov dword [esp + 0x24], 0x42f82c
mov dword [esp + 0x28], 0x42f844
mov dword [esp + 0x2c], 0x42f85c
mov dword [esp + 0x30], 0x42f874
mov dword [esp + 0x34], 0x42f88c
mov dword [esp + 0x38], 0x42f8a8
mov dword [esp + 0x3c], 0x42f8b8
mov dword [esp + 0x40], 0x42f8cc
mov dword [esp + 0x44], 0x42f8e4
mov dword [esp + 0x48], 0x42f8fc
mov dword [esp + 0x4c], 0x42f914
mov dword [esp + 0x50], 0x42f92c
mov dword [esp + 0x54], 0x42f940
mov dword [esp + 0x58], 0x42f958
mov dword [esp + 0x5c], 0x42f970
mov dword [esp + 0x60], 0x42f980
mov dword [esp + 0x64], 0x42f99c
mov dword [esp + 0x68], 0x42f9b4
mov dword [esp + 0x6c], 0x42f9cc
mov dword [esp + 0x70], 0x42f9e8
mov dword [esp + 0x74], 0x42fa00
mov dword [esp + 0x78], 0x42fa18
mov dword [esp + 0x7c], 0x42fa30
mov dword [esp + 0x80], 0x42fa48
mov dword [esp + 0x84], 0x42fa64
mov dword [esp + 0x88], 0x42fa7c
mov dword [esp + 0x8c], 0x42fa94
mov dword [esp + 0x90], 0x42faac
mov dword [esp + 0x94], 0x42fac8
mov dword [esp + 0x98], 0x42fae0
mov dword [esp + 0x9c], 0x42faf8
mov dword [esp + 0xa0], 0x42fb1c
mov dword [esp + 0xa4], 0x42fb34
mov dword [esp + 0xa8], 0x42fb4c
mov dword [esp + 0xac], 0x42fb5c
mov dword [esp + 0xb0], 0x42fb78
mov dword [esp + 0xb4], 0x42fb90
mov dword [esp + 0xb8], 0x42fbac
mov dword [esp + 0xbc], 0x42fbc4
mov dword [esp + 0xc0], 0x42fbe0
mov dword [esp + 0xc4], 0x42fbf0
mov dword [esp + 0xc8], 0x42fc08
mov dword [esp + 0xcc], 0x42fc20
mov dword [esp + 0xd0], 0x42fc34
mov dword [esp + 0xd4], 0x42fc4c
mov dword [esp + 0xd8], 0x42fc64
mov dword [esp + 0xdc], 0x42fc7c
mov dword [esp + 0xe0], 0x42fc94
mov dword [esp + 0xe4], 0x42fcac
mov dword [esp + 0xe8], 0x42fcc8
mov dword [esp + 0xec], 0x42fce4
mov dword [esp + 0xf0], 0x42fd00
mov dword [esp + 0xf4], 0x42fd18
mov dword [esp + 0xf8], 0x42fd34
mov dword [esp + 0xfc], 0x42fd4c
mov dword [esp + 0x100], 0x42fd6c
mov dword [esp + 0x104], 0x42fd80
mov dword [esp + 0x108], 0x42fd98
je 0x40eda7
push eax
call fcn.00423eea
mov edi, eax
pop ecx
test edi, edi
je 0x40eda7
push esi
lea eax, [esp + 0x1318]
push eax
push 0
call ebx
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 0x80000000
lea eax, [esp + 0x132c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebp
je 0x40ed9b
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, edi
jne 0x40ed9b
push 0
lea eax, [esp + 0x18]
push eax
push 0x7ffe
lea eax, [esp + 0x33e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40ed9b
mov eax, dword [esp + 0x14]
shr eax, 1
xor ecx, ecx
push 0x104
mov word [esp + eax*2 + 0x33e0], cx
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x33e4]
push eax
jmp 0x40ed90
lea eax, [esp + 0x10c]
push eax
call fcn.0040e9b3
push 0x104
lea eax, [esp + 0x110]
push eax
push edi
call fcn.0040e63c
mov edi, eax
test edi, edi
jne 0x40ed75
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x800
push esi
lea eax, [esp + 0x318]
push eax
push 0
call ebx
push esi
lea eax, [esp + 0x318]
push eax
call fcn.0040b1d0
push eax
lea eax, [esp + 0x23e4]
push eax
call fcn.0040e847
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edi, edi
xor esi, esi
call fcn.0040a2fa
cmp eax, 0x600
jb 0x40edf1
push dword [esp + esi*4 + 0x18]
call fcn.0040e9b3
jmp 0x40edf3
xor eax, eax
test eax, eax
je 0x40ee17
push ebp
push 0x42f7f8
push ebp
push dword [esp + esi*4 + 0x24]
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x40ee3b
push 0x800
push dword [esp + esi*4 + 0x1c]
lea eax, [esp + 0x31c]
push eax
call fcn.0040b23f
lea eax, [esp + 0x314]
push eax
call ebx
cmp eax, ebp
jne 0x40ee43
inc esi
cmp esi, 8
jb 0x40edda
jmp 0x40ee47
mov edi, dword [esp + esi*4 + 0x18]
cmp byte [esp + 0x13], 0
jne 0x40ee80
xor esi, esi
push 0x800
push dword [esp + esi*4 + 0x3c]
lea eax, [esp + 0x31c]
push eax
call fcn.0040b23f
lea eax, [esp + 0x314]
push eax
call ebx
cmp eax, ebp
jne 0x40ee7c
inc esi
cmp esi, 0x35
jb 0x40ee50
jmp 0x40ee80
mov edi, dword [esp + esi*4 + 0x38]
test edi, edi
je 0x40ef8f
lea eax, [esp + 0x314]
push eax
call fcn.0040b213
call fcn.0040a2fa
cmp eax, 0x600
jb 0x40ef07
push 0x42f874
call fcn.0040e9b3
push 0x42fdb4
call fcn.0040e9b3
lea eax, [esp + 0x23dc]
push eax
lea eax, [esp + 0x318]
push eax
push edi
push 0xf1
call fcn.0040cd14
push eax
lea eax, [esp + 0x1324]
push 0x864
push eax
call fcn.00403ce2
add esp, 0x18
push 0x30
push 0xf0
call fcn.0040cd14
push eax
lea eax, [esp + 0x131c]
push eax
push 0
call fcn.004181fe
jmp 0x40ef87
lea eax, [esp + 0x23dc]
push eax
lea eax, [esp + 0x318]
push eax
push edi
push 0x42fdd0
lea eax, [esp + 0x1324]
push 0x864
push eax
call fcn.00403ce2
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x40ef87
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x131c]
push eax
call fcn.004216b5
pop ecx
push eax
lea eax, [esp + 0x1320]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb3cc
ret 4