Function at 0x10002732
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
cmp eax, 0xffffffff
je 0x100028ed
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push esi
push 0xfffffffffffffffc
push eax
call ebx
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
lea eax, [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
lea eax, [ebp - 0xc]
push 4
push eax
push dword [ebp + 8]
call esi
cmp dword [ebp - 0xc], 0xdd4a3308
je 0x100027b9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100028ed
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
push 2
push 0
push 0xfffffffffffffff8
push dword [ebp + 8]
call ebx
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 4]
push 4
push eax
push edi
call esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
cmp ecx, eax
jbe 0x100027fb
push edi
jmp 0x100027ae
push 2
push 0
neg ecx
push ecx
push edi
call ebx
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
je 0x100027ab
lea ecx, [ebp - 8]
push 0
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff8
push ecx
push eax
push dword [ebp + 8]
call esi
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
mov eax, dword [ebp - 4]
mov ebx, 0x8c
add eax, 0xfffffff8
xor edx, edx
mov ecx, ebx
xor edi, edi
div ecx
test eax, eax
jle 0x10002889
mov eax, dword [ebp - 0x10]
mov esi, 0x1000503c
mov dword [ebp - 0x14], eax
push esi
call sub.MSVCRT.dll_strlen
push eax
push esi
push ebx
push dword [ebp - 0x14]
call fcn.10002ddd
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0xfffffff8
mov ecx, ebx
div ecx
add dword [ebp - 0x14], ebx
add esp, 0x14
inc edi
cmp edi, eax
jl 0x10002861
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x1c], 0
cmp dword [eax], 0xffffffff
jne 0x100028be
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
div ebx
jmp 0x10002989
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
push 9
lea eax, [ebp - 0x2c]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 0x10
test esi, esi
mov dword [ebp - 0x20], esi
jne 0x100028f4
xor eax, eax
jmp 0x10002989
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0xfffffff8
mov ecx, ebx
div ecx
and dword [ebp - 0x18], 0
test eax, eax
jle 0x1000296e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
push 8
add eax, 0x84
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 0x14
test eax, eax
jne 0x10002957
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
inc dword [ebp - 0x1c]
add dword [ebp - 0x14], ebx
push 0x23
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0xfffffff8
mov ecx, ebx
div ecx
inc dword [ebp - 0x18]
add dword [ebp + 8], ebx
cmp dword [ebp - 0x18], eax
jl 0x10002911
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
push dword [ebp - 0x10]
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp + 0xc]
pop ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret