Function at 0x1000bac0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
call fcn.1000d0b0
or ebp, 0xffffffff
mov dword [0x101e06b0], ebp
call fcn.1000d2a0
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push str.C:_openme.txt
call edi
mov esi, eax
push ebx
cmp esi, ebp
je 0x1000bc2b
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push 0x418
push esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push ebx
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
lea eax, [esp + 0x14]
push eax
push 0x11
lea ecx, [esp + 0x20]
push ecx
push esi
mov byte [esp + 0x28], bl
mov dword [esp + 0x24], ebx
call ebp
test eax, eax
je 0x1000bc15
cmp dword [esp + 0x10], 0x11
jne 0x1000bc15
lea eax, [ebx + 0x11]
mov ecx, str.pdfhelp_india.com
lea edx, [esp + 0x14]
mov ebx, dword [edx]
cmp ebx, dword [ecx]
jne 0x1000bc15
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x1000bb85
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000bc15
push 0
push 0
push 0x481
push esi
call edi
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x28
lea edx, [esp + 0x20]
push edx
push esi
call ebp
test eax, eax
je 0x1000bbff
cmp dword [esp + 0x10], 0x28
jne 0x1000bbff
mov eax, 0x28
xor ecx, ecx
mov edx, dword [esp + ecx + 0x14]
cmp edx, dword [ecx + str.6se9RaIxXF9m70zWmx7nL3bVRp691w4SNY8UCir0]
jne 0x1000bbff
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x1000bbd2
push esi
mov dword [0x101e06b0], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000bd2f
push esi
mov dword [0x101e06b0], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000bd2f
push esi
mov dword [0x101e06b0], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000bd2f
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push str.C:_readme.txt
call edi
mov esi, eax
cmp esi, ebp
je 0x1000bd29
push 0x30
lea eax, [esp + 0x19]
push ebx
push eax
mov byte [esp + 0x20], bl
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
push ebx
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, 0x28
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea ecx, [esp + 0x14]
push ecx
push 0x28
lea edx, [esp + 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000bd1a
cmp dword [esp + 0x10], 0x28
jne 0x1000bd1a
mov eax, 0x28
xor ecx, ecx
jmp 0x1000bcb0
mov edx, dword [esp + ecx + 0x14]
cmp edx, dword [ecx + str.kOHg2i2KbHEkV0s9WBxeBnDUeZ4AJfpzZbspRpJa]
jne 0x1000bcda
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x1000bcb0
push esi
mov dword [0x101e06b0], 3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000bd2f
mov eax, 0x28
xor ecx, ecx
mov edx, dword [esp + ecx + 0x14]
cmp edx, dword [ecx + str.vElBnRCjG17HPbVSb8mw2WKW8uIBUDp5gbuiZat1]
jne 0x1000bd0b
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x1000bce1
push esi
mov dword [0x101e06b0], 2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000bd2f
push esi
mov dword [0x101e06b0], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000bd2f
push esi
mov dword [0x101e06b0], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000bd2f
mov dword [0x101e06b0], ebp
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x101e0694
call fcn.100d0738
add esp, 0x3c
ret