Function at 0x6106ac10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov eax, dword [edi + 0x18]
mov dword [esp + 4], 0
mov dword [esp], 0x40
mov dword [esp + 8], eax
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6106b0f0
mov dword [esp + 0x18], 2
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [0x610eda80]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x1d8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
jne 0x6106ace6
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x6106acc0
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov ebx, 0xffffffff
mov dword [edi + 0x1d0], ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x6106ab20
mov dword [esp + 8], 0x6106aae9
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6106ac9c
mov dword [esp + 0x18], 2
lea eax, [ebp - 0x18]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [0x610eda80]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x1d4]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
jne 0x6106ad6a
mov esi, dword [0x610f08a0]
test esi, esi
jne 0x6106ad44
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x6106ac9c
mov dword [esp + 0xc], 0x6106ab40
mov dword [esp + 8], 0x6106aae9
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6106ad31
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
xor ecx, ecx
lea eax, [ebp - 0x1c]
mov dword [edi + 0x1d0], ecx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x6106adb3
cmp dword [ebp - 0x1c], 4
je 0x6106ade2
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x6106add5
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x6106acb2
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x6106acb2
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x6106adba
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x6106aef2
cmp eax, 2
jne 0x6106adb3
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x6106adb3
cmp dword [ebp - 0x1c], 4
jne 0x6106adb3
movzx eax, word [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [0x610ed768]
add eax, 0x18c
mov dword [esp], eax
call fcn.6101e690
mov edi, eax
mov eax, dword [eax]
mov dword [esp], edi
call dword [eax + 0xc0]
mov ebx, dword [eax]
mov eax, dword [edi]
mov dword [esp], edi
call dword [eax + 0xc8]
mov esi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x30]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
jne 0x6106ae9e
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x6106aecc
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 4
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
jmp 0x6106adb3
mov dword [esp + 0xc], 0x6106ab60
mov dword [esp + 8], 0x6106aae9
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6106ae9e
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x14]
mov esi, esp
xor ebx, ebx
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov dword [ebp - 0x14], 0
mov ecx, dword [0x61110008]
sub esp, 4
lea edx, [ecx*4 + 0x13]
and edx, 0xfffffff0
mov eax, edx
call sym.cygwin1.dll__alloca
cmp ebx, ecx
lea edi, [esp + 0x1c]
jl 0x6106b098
mov dword [edi + ecx*4], 0
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
jne 0x6106b00a
mov ecx, dword [0x610f08a0]
test ecx, ecx
jne 0x6106afe1
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6106a5fa
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
jne 0x6106afb4
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x6106afbb
mov esp, esi
jmp 0x6106adb3
mov dword [esp + 0xc], 0x6106ab81
mov dword [esp + 8], 0x6106aae9
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6106afb4
mov dword [esp + 0xc], 0x6106aba0
mov dword [esp + 8], 0x6106aae9
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6106af7a
mov eax, dword [edi]
mov ebx, edi
test eax, eax
je 0x6106af7a
mov dword [esp], eax
call sym.cygwin1.dll__strlen
mov dword [esp + 0x10], 0
inc eax
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x6106b058
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x6106b016
jmp 0x6106af7a
mov edx, dword [0x610f08a0]
test edx, edx
je 0x6106af7a
mov dword [esp + 0xc], 0x6106abc1
sub ebx, edi
sar ebx, 2
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0x6106aae9
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6106af7a
mov dword [esp + 4], 0x7fffffff
mov eax, dword [sym.cygwin1.dll___argv]
mov eax, dword [eax + ebx*4]
mov dword [esp], eax
call sub.KERNEL32.dll_IsBadStringPtrA
sub esp, 8
test eax, eax
je 0x6106b0e2
mov dword [edi + ebx*4], 0x6106a5fa
mov eax, dword [edi + ebx*4]
inc ebx
mov dword [esp], eax
call sym.cygwin1.dll__strlen
mov edx, dword [ebp - 0x24]
mov ecx, dword [0x61110008]
add eax, edx
inc eax
cmp ebx, ecx
mov dword [ebp - 0x24], eax
jl 0x6106b098
jmp 0x6106af35
mov eax, dword [sym.cygwin1.dll___argv]
mov eax, dword [eax + ebx*4]
mov dword [edi + ebx*4], eax
jmp 0x6106b0be
mov eax, dword [0x610f08a0]
test eax, eax
je 0x6106aca7
mov eax, dword [edi + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [edi]
mov dword [esp + 0xc], 0x6106abe0
mov dword [esp + 8], 0x6106aae9
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6106aca7