Function at 0x6c394c7d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x6c3a70b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x80c], 0
push ebx
push esi
push edi
mov esi, 0x10000
push esi
mov dword [ebp - 0x818], eax
mov eax, dword [ebp + 0xc]
push 0x51a
push 0x6c372c94
mov dword [ebp - 0x808], eax
call fcn.6c375051
mov edi, eax
xor eax, eax
mov dword [ebp - 0x81c], edi
mov ebx, 0xc0000bca
cmp edi, eax
je 0x6c394d47
push eax
push 0x80
push 3
push eax
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x808]
push 3
push 0x80000000
add eax, 0x878
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x814], eax
test eax, eax
je 0x6c394d3f
cmp eax, 0xffffffff
je 0x6c394d3f
push 0
lea ecx, [ebp - 0x810]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x6c394d2b
cmp dword [ebp - 0x810], esi
je 0x6c394d31
mov dword [ebp - 0x80c], ebx
push dword [ebp - 0x814]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6c394d51
mov dword [ebp - 0x80c], ebx
jmp 0x6c394d51
mov dword [ebp - 0x80c], 0xc0000bbb
cmp dword [ebp - 0x80c], 0
jne 0x6c394f02
cmp dword [edi + 0x8c], 1
jbe 0x6c394ea5
mov eax, dword [ebp - 0x808]
lea esi, [edi + 0x178]
push esi
push 0x400
add eax, 0x78
push eax
call fcn.6c3738f9
push esi
push 9
lea eax, [ebp - 0x804]
push eax
call fcn.6c3738f9
xor eax, eax
mov word [ebp - 0x7f4], ax
lea eax, [ebp - 0x804]
push eax
call fcn.6c39231a
mov ecx, dword [ebp - 0x808]
mov dword [ecx + 0x1078], eax
lea eax, [esi + 0x12]
push eax
push 5
lea eax, [ebp - 0x804]
push eax
call fcn.6c3738f9
xor eax, eax
mov word [ebp - 0x7fc], ax
lea eax, [ebp - 0x804]
push eax
call fcn.6c39231a
mov ecx, dword [ebp - 0x808]
mov word [ecx + 0x107c], ax
lea eax, [esi + 0x1c]
push eax
push 5
lea eax, [ebp - 0x804]
push eax
call fcn.6c3738f9
xor eax, eax
mov word [ebp - 0x7fc], ax
lea eax, [ebp - 0x804]
push eax
call fcn.6c39231a
mov ecx, dword [ebp - 0x808]
mov word [ecx + 0x107e], ax
xor edi, edi
lea ebx, [esi + 0x26]
push ebx
push 3
lea eax, [ebp - 0x804]
push eax
call fcn.6c3738f9
xor eax, eax
mov word [ebp - 0x800], ax
lea eax, [ebp - 0x804]
push eax
call fcn.6c39231a
mov ecx, dword [ebp - 0x808]
mov byte [ecx + edi + 0x1080], al
inc edi
add ebx, 4
cmp edi, 2
jb 0x6c394e23
push 2
pop edi
add esi, 0x30
push esi
push 3
lea eax, [ebp - 0x804]
push eax
call fcn.6c3738f9
xor eax, eax
mov word [ebp - 0x800], ax
lea eax, [ebp - 0x804]
push eax
call fcn.6c39231a
mov ecx, dword [ebp - 0x808]
mov byte [ecx + edi + 0x1080], al
inc edi
add esi, 4
cmp edi, 8
jb 0x6c394e63
mov edi, dword [ebp - 0x81c]
jmp 0x6c394f02
mov eax, dword [0x6c3a7048]
and al, 0xf
mov dword [ebp - 0x80c], ebx
cmp al, 2
jb 0x6c394f02
mov eax, dword [ebp - 0x808]
push 0
add eax, 0x878
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x808]
add eax, 0x878
push eax
push 4
lea eax, [ebp - 0x808]
push eax
push 4
lea eax, [ebp - 0x818]
push eax
push ebx
push 0x144
push 0x2e
push 0x566
call fcn.6c3774d9
add esp, 0x2c
push edi
push 0x569
push 0x6c372c94
call fcn.6c3750c2
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x80c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6c371640
leave
ret 8