Function at 0x1001da20
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x10724
call fcn.10010280
mov edx, dword [esp + 0x10728]
push ebx
push ebp
push esi
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0x12c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [edx + 0x104]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0x230]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [edx + 0x214]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x230]
test al, al
jne 0x1001dac6
mov ecx, edx
call fcn.1001f4a0
test eax, eax
je 0x1001dce5
lea ecx, [esp + 0x28]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x1001dce5
lea edx, [esp + 0x18]
lea edi, [esp + 0x334]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
push 0
push 3
push 0
push 1
lea eax, [esp + 0x3c]
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
test ebp, ebp
je 0x1001dce5
cmp ebp, 0xffffffff
je 0x1001dce5
lea ecx, [esp + 0x14]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xf00000
mov dword [esp + 0x10], eax
jae 0x1001db5d
mov ecx, dword [esp + 0x14]
test ecx, ecx
ja 0x1001db5d
cmp eax, 0x200000
jbe 0x1001db78
lea edx, [esp + 0x12c]
push str.Recent
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x1001db74
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10724
ret
mov eax, dword [esp + 0x10]
cmp eax, 0x10000
jbe 0x1001db8f
add eax, 0x400
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x28]
push eax
push str.filename:__s_r_n
push edi
call ebx
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2e]
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x20]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x22]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x22]
push eax
mov eax, dword [esp + 0x24]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esi + edi]
push str.time:__04d_02d_02d_02d_02d_02d_r_n
push ecx
call ebx
mov edx, dword [esp + 0x30]
add esp, 0x20
add esi, eax
push edx
push str.content_length:__d_r_n
lea eax, [esi + edi]
push eax
call ebx
add esp, 0xc
add esi, eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esi + edi]
push str.ackno:__s_r_n
push edx
call ebx
add esp, 0xc
add esi, eax
lea eax, [esp + 0x12c]
push eax
lea ecx, [esi + edi]
push str.monitortype:__s_r_n
push ecx
call ebx
add esp, 0xc
add esi, eax
lea edx, [esp + 0x12c]
push edx
lea eax, [esi + edi]
push str.content_type:__s_r_n_r_n
push eax
call ebx
mov edx, dword [esp + 0x1c]
add esp, 0xc
add esi, eax
lea ecx, [esp + 0x10]
push 0
push ecx
lea eax, [esi + edi]
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [esp + 0x10]
push ebp
add esi, ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1003db5c]
mov ebx, 1
test eax, eax
je 0x1001dcbf
mov ecx, dword [esp + 0x10740]
mov edx, dword [esp + 0x1073c]
push ecx
push edx
push esi
push edi
call eax
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1001dcaa
push 0x493e0
jmp 0x1001dcb9
cmp ebx, 3
jbe 0x1001dcbf
cmp ebx, 2
jbe 0x1001dcbf
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x334]
cmp edi, eax
je 0x1001dcd3
push edi
call fcn.10010220
add esp, 4
xor eax, eax
pop edi
test ebx, ebx
pop esi
pop ebp
setne al
pop ebx
add esp, 0x10724
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10724
ret