Function at 0x10016a0
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0x9ac], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
push 0x1014080
push 0x10140f8
push 0x1002a71
push 0x1001cfc
call fcn.01002abb
mov esi, 0x8000
mov edi, 0x80000000
cmp dword [0x101411c], ebx
je 0x1001724
mov al, byte [0x1014120]
cmp al, 4
jb 0x1001ccc
mov eax, dword [0x1014108]
mov ecx, dword [0x101410c]
and eax, esi
and ecx, edi
or eax, ecx
jne 0x10058a7
push 0x1001d1c
push 0xffffffffffffffff
call fcn.01002da8
call fcn.01003463
push 2
call fcn.010033be
test eax, eax
jl 0x1001cd9
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.MSSHooks.dll_LoadMSSearchHooks]
call fcn.01002ddd
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001c85
xor eax, eax
cmp dword [ebp + 8], 7
lea edi, [ebp - 0x9d4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x9c0], ebx
mov dword [ebp - 0x9c8], ebx
mov dword [ebp - 0x9b8], ebx
jne 0x10058ee
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9c4], ebx
jl 0x1001879
push 0x60
call dword [0x1014498]
cmp eax, ebx
je 0x1001ce0
mov ecx, eax
call fcn.01002bfe
push eax
lea ecx, [ebp - 0x9c4]
call fcn.01001458
cmp dword [ebp - 0x9c4], ebx
je 0x10058fd
cmp dword [ebp - 0x9a4], ebx
jl 0x1001879
push 1
push ebx
lea ecx, [ebp - 0x9e8]
mov dword [ebp - 0x9e8], ebx
mov dword [ebp - 0x9e4], ebx
mov dword [ebp - 0x9e0], ebx
mov dword [ebp - 0x9dc], ebx
mov dword [ebp - 0x9d8], ebx
call fcn.01003659
lea eax, [ebp - 0x9a8]
push eax
push 0x11
mov dword [ebp - 0x9a8], ebx
call fcn.01002295
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x100185a
push 1
push dword [ebp - 0x9a8]
lea ecx, [ebp - 0x9e8]
call fcn.01002570
push ebx
push ebx
push ebx
push 2
push 2
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x9e8]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x9a4], eax
cmp dword [ebp - 0x9a8], ebx
je 0x100186e
push dword [ebp - 0x9a8]
call dword [0x1014494]
lea ecx, [ebp - 0x9e8]
call fcn.0100275d
cmp dword [ebp - 0x9a4], ebx
mov esi, dword [sym.imp.msvcrt.dll__wtoi]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [ebp - 0x9cc], ebx
jl 0x100190f
mov eax, dword [ebp - 0x9ac]
push dword [eax + 8]
call esi
pop ecx
lea ecx, [ebp - 0x9cc]
push ecx
push eax
mov dword [ebp - 0x9d4], eax
call edi
test eax, eax
je 0x100590c
cmp dword [ebp - 0x9a4], ebx
jl 0x100190f
mov eax, dword [ebp - 0x9ac]
push dword [eax + 0xc]
call esi
pop ecx
lea ecx, [ebp - 0x9cc]
push ecx
push eax
mov dword [ebp - 0x9c0], eax
call edi
test eax, eax
je 0x100591c
cmp dword [ebp - 0x9a4], ebx
jl 0x100190f
mov eax, dword [ebp - 0x9ac]
push dword [eax + 0x10]
call esi
pop ecx
lea ecx, [ebp - 0x9cc]
push ecx
push eax
mov dword [ebp - 0x9c8], eax
call edi
test eax, eax
je 0x100592c
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9bc], ebx
jl 0x10019c0
mov eax, dword [ebp - 0x9ac]
push dword [eax + 0x14]
call esi
pop ecx
mov dword [ebp - 0x9bc], eax
cmp eax, 0x10000
ja 0x100593c
cmp dword [ebp - 0x9a4], ebx
jl 0x10019c0
mov eax, dword [ebp - 0x9ac]
push dword [eax + 0x18]
call esi
pop ecx
lea ecx, [ebp - 0x9cc]
push ecx
push eax
mov dword [ebp - 0x9d0], eax
call edi
test eax, eax
je 0x100594b
cmp dword [ebp - 0x9a4], ebx
jl 0x10019c0
lea eax, [ebp - 0x9a8]
push eax
push 0x1001d0c
push 1
push ebx
push 0x1001d44
mov dword [ebp - 0x9a8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov eax, dword [ebp - 0x9a8]
jl 0x10019b0
cmp eax, ebx
je 0x10019b0
mov ecx, dword [eax]
push 2
push 1
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x9a4], ebx
cmp eax, ebx
je 0x10019c0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9a8], ebx
jl 0x1001a19
lea eax, [ebp - 0x9ac]
push eax
call fcn.01002800
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001a19
mov esi, dword [ebp - 0x9ac]
mov eax, dword [esi]
push esi
call dword [eax + 4]
push dword [ebp - 0x9c4]
mov ecx, esi
call fcn.010026fc
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001a13
push esi
lea ecx, [ebp - 0x9a8]
call fcn.0100149b
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9b4], ebx
mov esi, 0x1001d34
jl 0x1001a60
push 1
push ebx
push ebx
push dword [ebp - 0x9a8]
lea eax, [ebp - 0x9b4]
push esi
push eax
call dword [sym.imp.ole32.dll_CoGetMarshalSizeMax]
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001a60
mov eax, dword [ebp - 0x9b4]
cmp eax, dword [ebp - 0x9bc]
ja 0x100595b
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9ac], ebx
jl 0x1001ab6
push dword [ebp - 0x9b4]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x9ac], edi
cmp edi, ebx
je 0x100596a
cmp dword [ebp - 0x9a4], ebx
jl 0x1001ce7
lea eax, [ebp - 0x9b8]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001ce7
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9bc], ebx
jl 0x1001bdc
xor edi, edi
inc edi
push edi
push ebx
push ebx
push dword [ebp - 0x9a8]
push esi
push dword [ebp - 0x9b8]
call dword [sym.imp.ole32.dll_CoMarshalInterface]
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001bdc
mov eax, dword [ebp - 0x9b4]
add eax, 4
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x9c8]
mov dword [ebp - 0x9bc], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x1005986
cmp dword [ebp - 0x9a4], ebx
jl 0x1001bdc
push dword [ebp - 0x9ac]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
cmp edi, ebx
je 0x1005996
cmp dword [ebp - 0x9a4], ebx
jl 0x1001b7c
mov eax, dword [ebp - 0x9b4]
mov dword [esi], eax
push dword [ebp - 0x9b4]
lea eax, [esi + 4]
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 0x9ac]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x1001b7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10059a6
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x9a4], ebx
jl 0x1001bdc
lea ecx, [ebp - 0x9b0]
call fcn.01002891
push dword [ebp - 0x9c0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x10059b6
cmp dword [ebp - 0x9a4], ebx
jl 0x10059d6
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x9d4]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
je 0x10059c6
lea ecx, [ebp - 0x9b0]
call fcn.01001f08
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, dword [ebp + edi*4 - 0x9d4]
cmp eax, ebx
je 0x1001bf2
push eax
call esi
inc edi
cmp edi, 2
jb 0x1001be4
mov ecx, dword [ebp - 0x9b8]
cmp ecx, ebx
je 0x1001c26
cmp dword [ebp - 0x9bc], ebx
je 0x1001c26
mov edx, dword [ecx]
push ebx
push ebx
push ebx
xor eax, eax
push eax
push ecx
call dword [edx + 0x14]
test eax, eax
jl 0x1001c26
push dword [ebp - 0x9b8]
call dword [sym.imp.ole32.dll_CoReleaseMarshalData]
cmp dword [ebp - 0x9c0], ebx
je 0x1001c36
push dword [ebp - 0x9c0]
call esi
cmp dword [ebp - 0x9c8], ebx
je 0x1001c46
push dword [ebp - 0x9c8]
call esi
mov eax, dword [ebp - 0x9a8]
cmp eax, ebx
je 0x1001c56
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x9c4]
cmp ecx, ebx
je 0x1001c65
call fcn.010013d5
mov eax, dword [ebp - 0x9b8]
cmp eax, ebx
je 0x1001c75
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 0x8000
mov edi, 0x80000000
cmp dword [0x101411c], ebx
je 0x1001cad
mov al, byte [0x1014120]
cmp al, 4
jb 0x1001cf4
mov eax, dword [0x1014108]
mov ecx, dword [0x101410c]
and eax, esi
and ecx, edi
or eax, ecx
jne 0x1005a32
push 0x1014080
call fcn.01001ec1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x9a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010012fd
leave
ret
cmp al, bl
je 0x100170d
jmp 0x1001724
push 3
jmp 0x1001746
xor eax, eax
jmp 0x10017bc
cmp edi, ebx
jne 0x100597a
jmp 0x1001ab6
cmp al, bl
jne 0x1001cad
jmp 0x1001c96
mov eax, dword [0x1014110]
mov edx, dword [0x1014114]
mov ecx, eax
and ecx, esi
and edx, edi
cmp ecx, eax
jne 0x1001724
cmp edx, dword [0x1014114]
jne 0x1001724
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1005a78
push dword [0x1014084]
push dword [0x1014080]
call fcn.010094e9
jmp 0x1001724
mov dword [ebp - 0x9a4], 0x80070667
jmp 0x1001793
mov dword [ebp - 0x9a4], 0x8007000e
jmp 0x10017d4
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x10018b7
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x10018e3
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x100190f
mov dword [ebp - 0x9a4], 0x80070057
jmp 0x100193e
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x100196a
mov dword [ebp - 0x9a4], 0x80028016
jmp 0x1001a60
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x1001a8c
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1001ab6
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x1001b19
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x1001b3b
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x1001b7c
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x1001baa
call fcn.01003252
mov dword [ebp - 0x9a4], eax
jmp 0x1001bd1
push 3
push 0x10063c0
lea ecx, [ebp - 0x60]
call fcn.0100db90
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x9a0]
call fcn.01009684
push dword [ebp - 0x9a4]
lea ecx, [ebp - 0x9a0]
call fcn.0100cb75
push ebx
lea eax, [ebp - 0x9a0]
push 0xc0000c1c
push eax
call fcn.010094cc
add esp, 0xc
lea ecx, [ebp - 0x9a0]
call fcn.010096bb
lea ecx, [ebp - 0x60]
call fcn.0100dbb8
jmp 0x1001bd1
mov eax, dword [0x1014110]
mov ecx, eax
and ecx, esi
mov esi, dword [0x1014114]
mov edx, esi
and edx, edi
cmp ecx, eax
jne 0x1001cad
cmp edx, esi
jne 0x1001cad
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1005a88
push dword [0x1014084]
push dword [0x1014080]
call fcn.010094e9
jmp 0x1001cad