Function at 0x1000a320
Capabilities:
Check for software breakpoints
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100df00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x2c
lea eax, [ebp - 0x30]
mov ebx, ecx
push 0
push eax
mov edi, edx
mov dword [ebp - 0x38], ebx
call sub.VCRUNTIME140.dll_memset
push 0x100c4354
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov esi, dword [ebp - 0x34]
add esp, 0x18
test esi, esi
je 0x1000a389
push esi
push 0x2c
lea eax, [ebp - 0x30]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, 0x2c
je 0x1000a39c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100be194
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov cx, word [ebp - 0x2e]
add esp, 4
mov dh, byte [ebp - 0x2f]
xor esi, esi
mov dl, byte [ebp - 0x30]
mov bl, cl
mov word [ebp - 0x32], cx
cmp esi, 7
ja case.default.0x1000a3c0
jmp dword [esi*4 + 0x1000a584]
movzx ecx, dh
shl ecx, 8
movzx eax, dl
or ecx, eax
cmp ecx, 0x4d42
je 0x1000a53e
cmp ecx, 0x4142
je 0x1000a53e
mov cx, word [ebp - 0x32]
jmp case.default.0x1000a3c0
mov ecx, dword [ebp - 0x38]
call fcn.10009f10
sub eax, 0x16
je 0x1000a574
sub eax, 1
je 0x1000a56d
sub eax, 1
je 0x1000a566
mov cx, word [ebp - 0x2e]
mov dh, byte [ebp - 0x2f]
mov bl, cl
mov dl, byte [ebp - 0x30]
mov word [ebp - 0x32], cx
jmp case.default.0x1000a3c0
movzx eax, dl
cmp eax, 0x49
je 0x1000a44a
cmp eax, 0x4d
jne case.default.0x1000a3c0
rol cx, 8
mov word [ebp - 0x32], cx
mov bl, cl
mov word [ebp - 0x2e], cx
cmp cx, 0x2a
jne case.default.0x1000a3c0
push 0x100c42f4
jmp 0x1000a543
cmp dl, 0xa
jne case.default.0x1000a3c0
cmp bl, 9
jae case.default.0x1000a3c0
push 0x100c42dc
jmp 0x1000a543
cmp dl, 0xd7
jne 0x1000a4a9
cmp dh, 0xcd
jne case.default.0x1000a3c0
cmp bl, 0xc6
jne case.default.0x1000a3c0
mov eax, dword [ebp - 0x2e]
shr eax, 8
cmp al, 0x9a
jne case.default.0x1000a3c0
push 0x100c4278
jmp 0x1000a543
cmp dl, 0xff
jne case.default.0x1000a3c0
cmp dh, 0xd8
jne case.default.0x1000a3c0
push 0x100c42c8
jmp 0x1000a543
cmp dword [ebp - 0x30], 1
jne case.default.0x1000a3c0
cmp dword [ebp - 8], 0x464d4520
jne case.default.0x1000a3c0
push 0x100c4280
jmp 0x1000a543
cmp dl, 0x89
jne 0x1000a4f3
cmp dh, 0x50
jne case.default.0x1000a3c0
cmp bl, 0x4e
jne case.default.0x1000a3c0
mov eax, dword [ebp - 0x2e]
shr eax, 8
cmp al, 0x47
jne case.default.0x1000a3c0
push 0x100c42e4
jmp 0x1000a543
cmp dl, 1
jne case.default.0x1000a3c0
test dh, dh
jne case.default.0x1000a3c0
cmp bl, 9
jne case.default.0x1000a3c0
mov eax, dword [ebp - 0x2e]
shr eax, 8
test al, al
jne case.default.0x1000a3c0
cmp byte [ebp - 0x2c], al
jne case.default.0x1000a3c0
cmp byte [ebp - 0x2b], 3
je 0x1000a49f
jmp case.default.0x1000a3c0
cmp dword [ebp - 0x30], 0xc6d3d0c5
je 0x1000a57b
inc esi
cmp esi, 8
jl 0x1000a3b7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100be194
mov esp, ebp
pop ebp
ret
push 0x100c42a8
push dword [ebp + 8]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.100be194
mov esp, ebp
pop ebp
ret
push 0x100c42c0
jmp 0x1000a543
push 0x100c4290
jmp 0x1000a543
push 0x100c42b8
jmp 0x1000a543
push 0x100c4238
jmp 0x1000a543