Function at 0x1001f6a4
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
xor ecx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, 0x1013b418
mov dword [esp + 0x20], ecx
mov dl, cl
mov dword [esp + 0x1c], edi
mov al, cl
mov dword [esp + 0x28], edi
inc ebx
mov byte [esp + 0x11], dl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x19], cl
mov byte [esp + 0x15], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x16], cl
mov byte [esp + 0x14], al
mov byte [esp + 0x17], cl
mov byte [esp + 0x12], cl
mov byte [esp + 0x24], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 0x13], cl
test ebp, ebp
je 0x1001facf
mov esi, ecx
mov ecx, dword [esp + 0x3c]
lea eax, [esi + 0x1e]
cmp eax, ecx
jge 0x1001fab9
mov edi, dword [esp + 0x38]
lea ebp, [esi + edi]
cmp byte [ebp], 0x50
jne 0x1001fab0
cmp byte [esi + edi + 1], 0x4b
jne 0x1001fab0
mov al, byte [ebp + 2]
cmp al, bl
jne 0x1001f74b
cmp byte [esi + edi + 3], 2
jne 0x1001fab0
mov ecx, edi
push 0x2e
movzx eax, word [esi + ecx + 0x1c]
jmp 0x1001f769
cmp al, 3
jne 0x1001fab0
cmp byte [esi + edi + 3], 4
jne 0x1001fab0
mov ecx, dword [esp + 0x38]
push 0x1e
movzx eax, word [esi + ecx + 0x1a]
movzx ebx, ax
pop edi
lea eax, [ebx + edi]
add eax, esi
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x3c]
jg 0x1001faa9
cmp ebx, 8
jne 0x1001f7c4
cmp edi, 0x1e
jne 0x1001f7f4
push 0
push ebx
lea eax, [ecx + 0x1e]
add eax, esi
push str.mimetype
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f7f4
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x40]
sub eax, esi
push eax
push ebp
call fcn.1002015b
mov dl, al
add esp, 0xc
mov byte [esp + 0x11], dl
jmp 0x1001fa9d
cmp ebx, 9
jne 0x1001f7f4
lea ebp, [edi + esi]
mov edi, dword [esp + 0x38]
push 0
push ebx
push str.META_INF_
lea eax, [edi + ebp]
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f7fb
xor ebx, ebx
inc ebx
mov byte [esp + 0x1a], bl
jmp 0x1001fa48
lea ebp, [edi + esi]
mov edi, dword [esp + 0x38]
lea esi, [edi + ebp]
cmp ebx, 0xb
jne 0x1001f84e
push 0
push ebx
push str.content.xml
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f824
xor ebx, ebx
inc ebx
mov byte [esp + 0x19], bl
jmp 0x1001fa48
cmp ebx, 0xb
jne 0x1001f84e
push 0
push ebx
push str._rels_.rels
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8c5
xor ebx, ebx
inc ebx
mov byte [esp + 0x16], bl
jmp 0x1001fa48
cmp ebx, 0x13
jne 0x1001f874
push 0
push ebx
push str._Content_Types_.xml
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8c5
xor ebx, ebx
inc ebx
mov byte [esp + 0x14], bl
jmp 0x1001fa48
cmp ebx, 0x14
jne 0x1001f89a
push 0
push ebx
push str.META_INF_MANIFEST.MF
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8c5
xor ebx, ebx
inc ebx
mov byte [esp + 0x15], bl
jmp 0x1001fa48
cmp ebx, 0x15
jne 0x1001f8c0
push 0
push ebx
push str.META_INF_manifest.xml
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8c5
xor ebx, ebx
inc ebx
mov byte [esp + 0x18], bl
jmp 0x1001fa48
cmp ebx, 4
jbe 0x1001f914
mov eax, dword [esp + 0x1c]
push 0
push 4
add eax, 0xfffffffc
add eax, edi
push str..opf
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8f0
xor ebx, ebx
inc ebx
mov byte [esp + 0x1b], bl
jmp 0x1001fa48
cmp ebx, 4
jbe 0x1001f914
mov eax, dword [esp + 0x1c]
push 0
push 4
add eax, 0xfffffffc
add eax, edi
push str..sml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001f938
cmp ebx, 5
jbe 0x1001f944
mov eax, dword [esp + 0x1c]
push 0
push 5
add eax, 0xfffffffb
add eax, edi
push str..smil
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f944
xor ebx, ebx
inc ebx
mov byte [esp + 0x13], bl
jmp 0x1001fa48
cmp ebx, 7
jbe 0x1001f981
push 0
push 3
push 0x1013b4bc
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f981
push eax
mov eax, dword [esp + 0x20]
push 4
add eax, 0xfffffffc
add eax, edi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001fa41
cmp ebx, 8
jbe 0x1001f9c6
push 0
push 4
push str.ppt_
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f9c6
push eax
mov eax, dword [esp + 0x20]
push 4
add eax, 0xfffffffc
add eax, edi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f9c6
xor ebx, ebx
inc ebx
mov byte [esp + 0x24], bl
jmp 0x1001fa48
cmp ebx, 9
jbe 0x1001fa08
push 0
push 5
push str.word_
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fa08
push eax
mov eax, dword [esp + 0x20]
push 4
add eax, 0xfffffffc
add eax, edi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fa08
xor ebx, ebx
inc ebx
mov byte [esp + 0x17], bl
jmp 0x1001fa48
cmp ebx, 0xa
jbe 0x1001fa4e
push 0
push 6
push str.excel_
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
mov esi, dword [esp + 0x2c]
add esp, 0x10
test eax, eax
jne 0x1001fa52
push eax
push 4
lea eax, [esi - 4]
add eax, edi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fa52
xor ebx, ebx
inc ebx
mov byte [esp + 0x12], bl
mov dl, byte [esp + 0x11]
jmp 0x1001faa0
mov esi, dword [esp + 0x1c]
cmp ebx, 0xf
jbe 0x1001fa99
push 0
push 0xb
lea eax, [edi + ebp]
push str.powerpoint_
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fa99
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
mov ebx, dword [esp + 0x34]
add esp, 0x10
test eax, eax
movzx ebx, bl
push 1
pop eax
cmove ebx, eax
mov dword [esp + 0x24], ebx
mov dl, byte [esp + 0x11]
xor ebx, ebx
inc ebx
mov eax, dword [esp + 0x1c]
lea esi, [eax - 1]
jmp 0x1001faac
xor ebx, ebx
inc ebx
mov ecx, dword [esp + 0x3c]
inc esi
test dl, dl
je 0x1001f707
mov edi, dword [esp + 0x28]
test dl, dl
jne 0x1001ff2d
mov ebp, dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x1c], edi
mov esi, dword [esp + 0x40]
cmp esi, 0x400
jl 0x1001fe8c
mov ebx, dword [esp + 0x34]
test ebx, ebx
js 0x1001fb33
push ecx
add esi, 0xfffffc00
push esi
push ebx
call sym.CoreFoundation.dll__NS_lseek
add esp, 0xc
cmp eax, esi
jne 0x1001fb33
mov ebp, 0x400
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, eax
mov dword [esp + 0x24], edx
pop ecx
test edx, edx
je 0x1001fe90
push ebp
push edx
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov edx, dword [esp + 0x2c]
add esp, 0xc
cmp eax, ebp
jl 0x1001fe90
mov eax, edx
jmp 0x1001fb5a
test ebp, ebp
je 0x1001fe8c
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x20]
cmp eax, 0x400
jl 0x1001fe90
add eax, 0xfffffc00
add eax, ebp
mov ebp, 0x400
mov dword [esp + 0x38], eax
test eax, eax
je 0x1001fe90
xor esi, esi
mov edi, eax
cmp byte [esi + edi], 0x50
jne 0x1001fe7c
cmp byte [esi + edi + 1], 0x4b
jne 0x1001fe7c
mov al, byte [esi + edi + 2]
xor ecx, ecx
inc ecx
cmp al, cl
jne 0x1001fb9e
cmp byte [esi + edi + 3], 2
jne 0x1001fe7c
movzx ecx, word [esi + edi + 0x1c]
push 0x2e
jmp 0x1001fbb8
cmp al, 3
jne 0x1001fe7c
cmp byte [esi + edi + 3], 4
jne 0x1001fe7c
movzx ecx, word [esi + edi + 0x1a]
push 0x1e
movzx ebx, cx
pop eax
lea ecx, [ebx + eax]
mov dword [esp + 0x28], ecx
add ecx, esi
mov dword [esp + 0x38], ecx
cmp ecx, ebp
ja 0x1001fe7c
lea ebp, [eax + esi]
mov dword [esp + 0x2c], ebp
cmp ebx, 9
jne 0x1001fbff
push 0
push ebx
lea eax, [edi + ebp]
push str.META_INF_
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fbff
inc eax
mov byte [esp + 0x1a], al
jmp 0x1001fe72
add ebp, edi
cmp ebx, 0xb
jne 0x1001fc49
push 0
push ebx
push str.content.xml
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fc25
inc eax
mov byte [esp + 0x19], al
jmp 0x1001fe72
cmp ebx, 0xb
jne 0x1001fc49
push 0
push ebx
push str._rels_.rels
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fcba
inc eax
mov byte [esp + 0x16], al
jmp 0x1001fe72
cmp ebx, 0x13
jne 0x1001fc6d
push 0
push ebx
push str._Content_Types_.xml
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fcba
inc eax
mov byte [esp + 0x14], al
jmp 0x1001fe72
cmp ebx, 0x14
jne 0x1001fc91
push 0
push ebx
push str.META_INF_MANIFEST.MF
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fcba
inc eax
mov byte [esp + 0x15], al
jmp 0x1001fe72
cmp ebx, 0x15
jne 0x1001fcb5
push 0
push ebx
push str.META_INF_manifest.xml
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fcba
inc eax
mov byte [esp + 0x18], al
jmp 0x1001fe72
cmp ebx, 4
jbe 0x1001fce3
mov eax, dword [esp + 0x38]
push 0
push 4
add eax, 0xfffffffc
add eax, edi
push str..opf
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fce3
inc eax
mov byte [esp + 0x1b], al
jmp 0x1001fe72
add esi, dword [esp + 0x28]
cmp ebx, 4
jbe 0x1001fd07
push 0
push 4
lea eax, [edi - 4]
add eax, esi
push str..sml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001fd27
cmp ebx, 5
jbe 0x1001fd33
push 0
push 5
lea eax, [edi - 5]
add eax, esi
push str..smil
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fd33
xor eax, eax
inc eax
mov byte [esp + 0x13], al
jmp 0x1001fe72
cmp ebx, 7
jbe 0x1001fd6c
push 0
push 3
push 0x1013b4bc
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fd6c
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001fe1f
cmp ebx, 8
jbe 0x1001fdab
push 0
push 4
push str.ppt_
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fdab
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fdab
inc eax
mov byte [esp + 0x24], al
jmp 0x1001fe72
cmp ebx, 9
jbe 0x1001fdea
push 0
push 5
push str.word_
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fdea
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fdea
inc eax
mov byte [esp + 0x17], al
jmp 0x1001fe72
cmp ebx, 0xa
jbe 0x1001fe28
push 0
push 6
push str.excel_
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fe28
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fe28
xor eax, eax
inc eax
mov byte [esp + 0x12], al
jmp 0x1001fe72
cmp ebx, 0xf
jbe 0x1001fe72
mov eax, dword [esp + 0x2c]
push 0
push 0xb
add eax, edi
push str.powerpoint_
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fe72
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
mov ecx, dword [esp + 0x34]
add esp, 0x10
test eax, eax
movzx ecx, cl
push 1
pop eax
cmove ecx, eax
mov byte [esp + 0x24], cl
mov esi, dword [esp + 0x38]
mov ebp, 0x400
dec esi
inc esi
lea eax, [esi + 0x1e]
cmp eax, ebp
jl 0x1001fb6a
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
cmp byte [esp + 0x15], 0
jne 0x1001ff1c
mov al, byte [esp + 0x16]
mov cl, byte [esp + 0x14]
test al, al
jne 0x1001feab
test cl, cl
je 0x1001fee5
cmp byte [esp + 0x17], 0
je 0x1001feb9
mov edi, str.docx
jmp 0x1001ff21
test al, al
jne 0x1001fec1
test cl, cl
je 0x1001fee5
cmp byte [esp + 0x12], 0
je 0x1001fecf
mov edi, str.xlsx
jmp 0x1001ff21
test al, al
jne 0x1001fed7
test cl, cl
je 0x1001fee5
cmp byte [esp + 0x24], 0
je 0x1001fee5
mov edi, str.pptx
jmp 0x1001ff21
cmp byte [esp + 0x18], 0
jne 0x1001ff15
cmp byte [esp + 0x19], 0
jne 0x1001ff15
cmp byte [esp + 0x1a], 0
jne 0x1001ff1c
cmp byte [esp + 0x1b], 0
je 0x1001ff21
cmp byte [esp + 0x13], 0
mov edi, 0x1013b50c
mov eax, 0x1013b510
cmove edi, eax
jmp 0x1001ff21
mov edi, 0x1013b3cc
jmp 0x1001ff21
mov edi, 0x1013b4f0
test edx, edx
je 0x1001ff2d
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret