Function at 0x10001000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10006b68
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x3a]
mov byte [esp + 0x13], 0
xor edi, edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x68], edi
push 0x10009864
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x10009890], 0
je 0x10001096
push 0x10009864
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x3a]
cmp eax, ecx
je 0x100012d2
cmp eax, edi
jmp 0x100012c7
lea eax, [esp + 0x2c]
call fcn.100015b0
cmp byte [esp + 0x38], 0
jge 0x100010af
lea esi, [esp + 0x2c]
call fcn.10004fd0
mov edx, dword [esp + 0x2c]
push 0x1000719c
push edx
call sub.msvcrt.dll_fopen
mov esi, eax
add esp, 8
cmp esi, edi
setne bl
mov dword [esp + 0x20], esi
test bl, bl
je 0x1000128d
push esi
push 1
lea eax, [esp + 0x1c]
push 5
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
je 0x100012f5
mov cl, byte [esp + 0x13]
mov al, byte [esp + 0x14]
test cl, cl
jne 0x10001102
cmp al, 0x99
jne 0x10001289
movzx eax, al
add eax, 0xffffff67
cmp eax, 0x5c
ja case.0x1000111a.154
movzx edx, byte [eax + 0x10001384]
jmp dword [edx*4 + 0x10001364]
test cl, cl
jne 0x10001289
push esi
push 1
lea eax, [esp + 0x44]
push 0x1a
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x10001289
mov eax, 8
xor ecx, ecx
jmp 0x10001150
mov edx, dword [esp + ecx + 0x3c]
cmp edx, dword [ecx + str.IDMFTYPE]
jne 0x10001289
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x10001150
cmp byte [esp + 0x44], 1
jne 0x10001289
mov eax, dword [esp + 0x46]
mov bl, 1
shr eax, 1
and al, bl
mov byte [0x10009891], al
mov byte [esp + 0x13], bl
jmp 0x100010d4
mov edx, dword [esp + 0x15]
push 0
lea ecx, [esp + 0x28]
push ecx
push 0x10009880
push edx
push esi
mov ebx, 0x10009898
call fcn.10001490
add esp, 0x14
mov bl, al
jmp 0x10001281
mov ecx, dword [esp + 0x15]
push 0
lea eax, [esp + 0x28]
push eax
push 0x10009884
push ecx
push esi
mov ebx, 0x1000989c
call fcn.10001490
add esp, 0x14
mov bl, al
jmp 0x10001281
mov eax, dword [esp + 0x15]
push 0
lea edx, [esp + 0x28]
push edx
push 0x10009888
push eax
push esi
mov ebx, 0x100098a0
call fcn.10001490
add esp, 0x14
mov bl, al
jmp 0x10001281
mov edx, dword [esp + 0x15]
push 1
lea ecx, [esp + 0x2c]
push ecx
push 0x1000988c
push edx
push esi
lea ebx, [esp + 0x30]
call fcn.10001490
add esp, 0x14
mov bl, al
jmp 0x10001281
mov eax, dword [esp + 0x15]
mov ecx, eax
push eax
shr ecx, 1
push esi
mov edi, 0x100098a4
mov dword [0x100098a8], ecx
call fcn.100013f0
add esp, 8
mov bl, al
jmp 0x10001281
call 0x10004400
mov ecx, dword [esp + 0x15]
mov edi, eax
mov eax, ecx
xor edx, edx
div edi
push ecx
push esi
mov edi, 0x100098ac
mov dword [0x100098b0], eax
call fcn.100013f0
add esp, 8
mov bl, al
jmp 0x10001281
mov edx, dword [esp + 0x15]
push 1
push edx
push esi
call sub.msvcrt.dll_fseek
add esp, 0xc
test eax, eax
sete bl
test bl, bl
jne 0x100010d4
mov edi, dword [esp + 0x1c]
mov byte [0x10009890], 0
push 0x10009864
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x100012ac
push esi
call sub.msvcrt.dll_fclose
add esp, 4
test edi, edi
je 0x100012b9
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x3a]
cmp eax, ecx
je 0x100012d2
test eax, eax
je 0x100012d2
push eax
call sub.msvcrt.dll_free
add esp, 4
mov al, byte [0x10009890]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.10005b20
mov esp, ebp
pop ebp
ret
test bl, bl
je 0x10001289
cmp dword [0x10009898], 0
je 0x10001289
cmp dword [0x1000989c], 0
je 0x10001289
cmp dword [0x100098a0], 0
je 0x10001289
cmp dword [0x100098a4], 0
je 0x10001289
cmp dword [0x100098ac], 0
je 0x10001289
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x1000128d
mov esi, dword [esp + 0x28]
call fcn.10004410
mov esi, dword [esp + 0x20]
test al, al
je 0x1000128d
mov byte [0x10009890], 1
jmp 0x10001294