Function at 0x1001b950
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xd60
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0xd5c], eax
mov eax, dword [esp + 0xd64]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x1001be90
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebx, eax
test ebx, ebx
je 0x1001be90
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
cmp eax, 0x26
jle 0x1001be90
push str._nmare_cock.li_
call esi
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push eax
push str._nmare_cock.li_
push ebx
call ebp
test eax, eax
je 0x1001b9fe
push str._evopro_protonmail.com_
call esi
push eax
push str._evopro_protonmail.com_
push ebx
call ebp
test eax, eax
je 0x1001b9fe
push str._satan_pro_mail.ru_
call esi
push eax
push str._satan_pro_mail.ru_
push ebx
call ebp
test eax, eax
je 0x1001b9fe
push str._nmare_protonmail.com_
call esi
push eax
push str._nmare_protonmail.com_
push ebx
call ebp
test eax, eax
jne 0x1001be90
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push edi
call esi
test eax, eax
je 0x1001be90
push str..lucky
push edi
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
call ebp
test eax, eax
je 0x1001ba64
push str..evopro
push edi
call esi
push eax
call ebp
test eax, eax
je 0x1001ba64
push str..satan_pro
push edi
call esi
push eax
call ebp
test eax, eax
je 0x1001ba64
push str..appro
push edi
call esi
push eax
call ebp
test eax, eax
je 0x1001ba64
push str..nmare
push edi
call esi
push eax
call ebp
test eax, eax
jne 0x1001be90
xor eax, eax
push 0x56c
push eax
lea ecx, [esp + 0x31]
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov byte [esp + 0x34], al
call fcn.100d4cc0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001baf5
lea edx, [esp + 0x20]
push edx
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push 0
sub eax, 0x56d
push 0
sbb ecx, 0
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [esp + 0x1c]
push eax
push 0x56d
lea ecx, [esp + 0x34]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
test eax, eax
jl 0x1001be90
jg 0x1001bb13
cmp edi, 0x56d
jbe 0x1001bc98
mov dl, 0x5b
cmp byte [esp + 0x28], dl
jne 0x1001bc98
mov cl, 0x5d
cmp byte [esp + 0x581], cl
jne 0x1001bc98
cmp byte [esp + 0x582], 0x3a
jne 0x1001bc98
cmp byte [esp + 0x583], dl
jne 0x1001bc98
cmp byte [esp + 0x594], cl
jne 0x1001bc98
mov eax, ebx
mov ecx, 0x3e8
lea edx, [esp + 0x598]
call fcn.10003cf0
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea edx, [esp + 0x598]
push edx
call edi
lea eax, [esp + 0x598]
push eax
call edi
mov edi, dword [esp + 0x1c]
cmp byte [edi + 0xc9], 0
jne 0x1001bc91
lea ecx, [esp + 0x598]
push ecx
call esi
test eax, eax
je 0x1001bc91
push 0x1012a050
lea edx, [esp + 0x59c]
push edx
call esi
push eax
call ebp
test eax, eax
je 0x1001bc85
push 0x1012a05c
lea eax, [esp + 0x59c]
push eax
call esi
push eax
call ebp
test eax, eax
je 0x1001bc85
push 0x1012a068
lea ecx, [esp + 0x59c]
push ecx
call esi
push eax
call ebp
test eax, eax
je 0x1001bc85
push 0x1012a07c
lea edx, [esp + 0x59c]
push edx
call esi
push eax
call ebp
test eax, eax
je 0x1001bc72
push 0x1012a088
lea eax, [esp + 0x59c]
push eax
call esi
push eax
call ebp
test eax, eax
je 0x1001bc72
push 0x1012a0a0
lea ecx, [esp + 0x59c]
push ecx
call esi
push eax
call ebp
test eax, eax
jne 0x1001bc49
mov edx, dword [esp + 0x14]
push edi
xor ecx, ecx
call fcn.1001cce0
mov al, 1
jmp 0x1001be92
push 0x1012a0b4
lea edx, [esp + 0x59c]
push edx
call esi
push eax
call ebp
test eax, eax
jne 0x1001bc91
mov edx, dword [esp + 0x14]
push edi
xor ecx, ecx
call fcn.1001cf90
mov al, 1
jmp 0x1001be92
mov edx, dword [esp + 0x14]
push edi
xor ecx, ecx
call fcn.1001ca30
mov al, 1
jmp 0x1001be92
mov edx, dword [esp + 0x14]
push edi
xor ecx, ecx
call fcn.1001c780
mov al, 1
jmp 0x1001be92
test eax, eax
jl 0x1001be90
jg 0x1001bcae
cmp edi, 0x200
jbe 0x1001be90
mov eax, ebx
mov ecx, 0x3e8
lea edx, [esp + 0x598]
call fcn.10003cf0
lea eax, [esp + 0x598]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [esp + 0x598]
push ecx
call esi
test eax, eax
je 0x1001bd08
lea edx, [esp + 0x598]
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call edi
cmp eax, 0x11
jne 0x1001bd0e
lea eax, [esp + 0x598]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
jmp 0x1001bb83
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x598]
push eax
call esi
test eax, eax
je 0x1001be90
lea ecx, [esp + 0x598]
push ecx
call esi
push eax
call edi
cmp eax, 0x29
jne 0x1001be90
push str._evopro_protonmail.com_
mov dword [esp + 0x1c], 1
call edi
push eax
push str._evopro_protonmail.com_
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x1001bd6e
push str._satan_pro_mail.ru_
call edi
push eax
push str._satan_pro_mail.ru_
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x1001bd75
mov ebx, 3
jmp 0x1001bd79
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x598]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov edi, dword [esp + 0x1c]
cmp byte [edi + 0xc9], 0
jne 0x1001be8c
lea eax, [esp + 0x598]
push eax
call esi
test eax, eax
je 0x1001be8c
push 0x1012a050
lea ecx, [esp + 0x59c]
push ecx
call esi
push eax
call ebp
test eax, eax
je 0x1001be80
push 0x1012a05c
lea edx, [esp + 0x59c]
push edx
call esi
push eax
call ebp
test eax, eax
je 0x1001be80
push 0x1012a068
lea eax, [esp + 0x59c]
push eax
call esi
push eax
call ebp
test eax, eax
je 0x1001be80
push 0x1012a07c
lea ecx, [esp + 0x59c]
push ecx
call esi
push eax
call ebp
test eax, eax
je 0x1001be70
push 0x1012a088
lea edx, [esp + 0x59c]
push edx
call esi
push eax
call ebp
test eax, eax
je 0x1001be70
push 0x1012a0a0
lea eax, [esp + 0x59c]
push eax
call esi
push eax
call ebp
test eax, eax
jne 0x1001be4a
mov edx, dword [esp + 0x14]
push edi
mov ecx, ebx
call fcn.1001cce0
mov al, 1
jmp 0x1001be92
push 0x1012a0b4
lea ecx, [esp + 0x59c]
push ecx
call esi
push eax
call ebp
test eax, eax
jne 0x1001be8c
mov edx, dword [esp + 0x14]
push edi
mov ecx, ebx
call fcn.1001cf90
mov al, 1
jmp 0x1001be92
mov edx, dword [esp + 0x14]
push edi
mov ecx, ebx
call fcn.1001ca30
mov al, 1
jmp 0x1001be92
mov edx, dword [esp + 0x14]
push edi
mov ecx, ebx
call fcn.1001c780
mov al, 1
jmp 0x1001be92
xor al, al
mov ecx, dword [esp + 0xd6c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0xd60
ret 4