Function at 0x10003df1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [ecx + 8]
shr eax, 1
and eax, 1
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0xc]
push esi
push edi
mov dword [esp + 0x14], ecx
test eax, eax
je 0x10004156
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x60], eax
cmp eax, 0xffffffff
je 0x10004156
push 4
push 0x3000
push 0x11300
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x10004146
lea edx, [eax + 0x1000]
mov ebx, edx
xor esi, esi
lea edi, [ebx + 0x100]
mov dword [esp + 0x54], edi
lea eax, [edi + 0x200]
mov dword [esp + 0x24], edi
xor edi, edi
mov ecx, edx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x44], esi
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea esi, [edi + 2]
mov dword [esp + 0x28], edi
lea ecx, [ecx]
cmp dword [esp + 0x28], 0
jne 0x10004138
cmp ecx, edx
jb 0x10003da0
push 0
lea ecx, [esp + 0x68]
push ecx
push 0x1000
push eax
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10003d90
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x64]
mov ecx, edx
add eax, edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x4c], eax
jmp 0x10003d98
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x4c]
cmp ecx, eax
jb 0x10003da0
xor dl, dl
jmp 0x10003da7
mov dl, byte [ecx]
inc ecx
mov dword [esp + 0x2c], ecx
movzx eax, dl
lea ecx, [esi + esi*8]
mov al, byte [eax + 0x1003c4d8]
mov esi, dword [esp + 0x30]
movzx eax, al
mov dh, byte [ecx + eax + 0x1003c480]
mov al, byte [ecx + eax + 0x1003c5d8]
mov byte [esp + 0x13], dh
cmp dh, 0xff
je 0x10003ddd
test dh, dh
jns 0x10003ddd
test esi, esi
je 0x10004134
movzx eax, al
dec eax
cmp eax, 9
ja case.default.0x10003dea
jmp dword [eax*4 + 0x10004160]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x34], esi
xor esi, esi
mov dword [esp + 0x38], 0
mov dword [esp + 0x20], esi
jmp case.default.0x10003dea
mov ecx, dword [esp + 0x20]
cmp ecx, 0xff
jb 0x10003e25
mov dword [esp + 0x38], 1
jmp case.default.0x10003dea
mov eax, dword [esp + 0x34]
inc eax
mov byte [eax - 1], dl
inc ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x20], ecx
jmp case.default.0x10003dea
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x10003e6b
cmp dword [esp + 0x38], 0
jne 0x10003e6b
mov eax, dword [esp + 0x50]
push 1
mov byte [ecx + eax], 0
mov ecx, dword [esp + 0x18]
mov edx, eax
call fcn.10003810
add esp, 4
mov dword [esp + 0x3c], eax
jmp case.default.0x10003dea
mov dword [esp + 0x3c], 0
jmp case.default.0x10003dea
mov esi, dword [esp + 0x54]
xor eax, eax
mov byte [esi], dl
inc esi
inc eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], eax
jmp case.default.0x10003dea
mov eax, dword [esp + 0x18]
cmp eax, 0x1ff
jb 0x10003eaf
mov dword [esp + 0x40], 1
jmp case.default.0x10003dea
mov esi, dword [esp + 0x24]
inc esi
mov byte [esi - 1], dl
inc eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], eax
jmp case.default.0x10003dea
mov edx, dword [esp + 0x18]
test edx, edx
je 0x10003eea
mov esi, dword [esp + 0x24]
movsx eax, byte [esi - 1]
cmp byte [eax + 0x1003c4d8], 8
jne 0x10003ee6
dec esi
mov dword [esp + 0x24], esi
dec edx
jne 0x10003ed1
mov dword [esp + 0x18], edx
mov ebx, dword [esp + 0x58]
mov dword [esp + 0x44], 0
xor edi, edi
jmp case.default.0x10003dea
cmp edi, 0xffff
jb 0x10003f12
mov dword [esp + 0x44], 1
jmp case.default.0x10003dea
mov byte [ebx], dl
inc ebx
inc edi
jmp case.default.0x10003dea
test edi, edi
je case.0x10003dea.10
nop
movsx eax, byte [ebx - 1]
cmp byte [eax + 0x1003c4d8], 8
jne case.0x10003dea.10
dec ebx
dec edi
jne 0x10003f20
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x100040fa
cmp dword [esp + 0x40], 0
jne 0x100040fa
cmp dword [esp + 0x44], 0
jne 0x100040fa
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x18]
push 1
mov byte [eax + edx], 0
mov byte [edi + edx + 0x200], 0
call fcn.10003a60
add esp, 4
mov dword [esp + 0x48], eax
test eax, eax
je case.default.0x10003dea
test edi, edi
je 0x10004068
mov eax, dword [esp + 0x14]
push dword [esp + 0x58]
push dword [eax]
call fcn.10003040
mov ecx, eax
add esp, 8
mov dword [esp + 0x6c], ecx
test ecx, ecx
je 0x10004053
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x1000403c
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
test esi, esi
jne 0x10003fe4
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x6c]
mov dword [ecx + 0x20], eax
mov ecx, dword [esp + 0x14]
inc dword [ecx + 4]
jmp case.default.0x10003dea
mov eax, dword [esi + 0x1c]
and eax, 1
mov dword [esp + 0x68], eax
je 0x10003ffc
mov eax, dword [ecx - 4]
sub ecx, 4
mov dword [esp + 0x5c], eax
jmp 0x10004004
mov dword [esp + 0x5c], 0
push ecx
push 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x68], 0
je 0x1000403c
test byte [esi + 0x1c], 2
je 0x10004024
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x5c]
sub dword [esi + 0x28], eax
add dword [esi + 0x2c], 0xfffffffc
test byte [esi + 0x1c], 2
je 0x1000403c
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x6c]
mov dword [ecx + 0x20], eax
mov ecx, dword [esp + 0x14]
inc dword [ecx + 4]
jmp case.default.0x10003dea
test esi, esi
jne case.default.0x10003dea
mov dword [esp + 0x28], 1
jmp case.default.0x10003dea
mov eax, dword [eax + 0x20]
test eax, eax
je 0x100040f1
mov esi, dword [esp + 0x14]
mov esi, dword [esi]
test esi, esi
jne 0x1000408e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100040e6
mov ecx, dword [esi + 0x1c]
and ecx, 1
mov dword [esp + 0x6c], ecx
je 0x100040a6
mov ecx, dword [eax - 4]
sub eax, 4
mov dword [esp + 0x5c], ecx
jmp 0x100040ae
mov dword [esp + 0x5c], 0
push eax
push 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x6c], 0
je 0x100040e6
test byte [esi + 0x1c], 2
je 0x100040ce
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x5c]
sub dword [esi + 0x28], eax
add dword [esi + 0x2c], 0xfffffffc
test byte [esi + 0x1c], 2
je 0x100040e6
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x48]
mov dword [eax + 0x20], 0
mov eax, dword [esp + 0x14]
inc dword [eax + 4]
jmp case.default.0x10003dea
mov ecx, dword [esp + 0x28]
test esi, esi
mov eax, 1
cmove ecx, eax
mov dword [esp + 0x28], ecx
mov al, byte [esp + 0x13]
cmp al, 0xff
je 0x10004134
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x4c]
movzx esi, al
mov eax, dword [esp + 0x1c]
and esi, 0xffffff7f
cmp esi, 0xffffffff
jne 0x10003d50
jmp 0x10004138
mov eax, dword [esp + 0x1c]
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [esp + 0x60]
cmp eax, 0xffffffff
je 0x10004156
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret