Function at 0x1001b946
Capabilities:
Read file on windows

Disassembly:
push 0x35c
push 0x10084e80
call fcn.10083d38
mov dword [ebp - 0x33c], edx
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x330], eax
push 0x230
xor ebx, ebx
push ebx
lea eax, [ebp - 0x320]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x368], ebx
mov dword [ebp - 0x364], ebx
mov eax, ebx
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x328], ebx
push 0xd0
push ebx
lea eax, [ebp - 0xf0]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x34c], ebx
mov edi, ebx
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x35c], ebx
test esi, esi
je 0x1001bcb5
cmp dword [ebp - 0x33c], ebx
je 0x1001bcb5
cmp dword [ebp - 0x330], ebx
je 0x1001bcb5
mov ecx, esi
call fcn.10030a0e
mov esi, eax
mov dword [ebp - 0x344], esi
test esi, esi
je 0x1001bcb1
mov ecx, esi
call fcn.100310a3
cmp eax, 0xffffffff
je 0x1001bcb1
push 0x230
lea eax, [ebp - 0x320]
push eax
push esi
call sym.WIMGAPI.DLL_WIMGetAttributes
test eax, eax
je 0x1001bcbd
mov ecx, esi
call fcn.10030eb9
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x330]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x358], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x354], eax
mov ecx, esi
call fcn.10031dd9
mov esi, eax
mov dword [ebp - 0x350], esi
mov ecx, edx
mov dword [ebp - 0x34c], ecx
mov edx, dword [ebp - 0x334]
cmp edx, ebx
jl 0x1001bc11
mov eax, dword [ebp - 0x32c]
jg 0x1001baa3
cmp eax, ebx
jb 0x1001bc11
cmp edx, ecx
jg 0x1001bc11
jl 0x1001bab5
cmp eax, esi
jae 0x1001bc11
mov esi, dword [ebp + 8]
xor edi, edi
test esi, esi
jne 0x1001baca
inc edi
mov dword [ebp - 0x324], edi
jmp 0x1001bc19
mov ecx, esi
add ecx, eax
adc edi, edx
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x368], ecx
mov dword [ebp - 0x364], edi
cmp edi, edx
mov edi, dword [ebp - 0x324]
jg 0x1001bb05
jl 0x1001baf2
cmp ecx, eax
jae 0x1001bb05
or dword [ebp - 0x338], 0xffffffff
or dword [ebp - 0x334], 0xffffffff
or esi, 0xffffffff
jmp 0x1001bb25
mov edi, dword [ebp - 0x34c]
cmp dword [ebp - 0x334], edi
mov edi, dword [ebp - 0x324]
jl 0x1001bb2a
jg 0x1001bb23
cmp ecx, dword [ebp - 0x350]
jbe 0x1001bb2a
mov esi, ecx
sub esi, eax
mov dword [ebp + 8], esi
test edx, edx
jne 0x1001bbb6
mov ecx, 0xd0
cmp eax, ecx
jae 0x1001bbb6
sub ecx, eax
mov dword [ebp - 0x334], ecx
cmp ecx, esi
jbe 0x1001bb57
mov eax, esi
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x340], eax
jmp 0x1001bb5d
mov dword [ebp - 0x340], ecx
mov ecx, dword [ebp - 0x344]
call fcn.10031cf2
lea edx, [ebp - 0xf0]
mov ecx, eax
call fcn.10021bf2
push dword [ebp - 0x334]
mov eax, dword [ebp - 0x32c]
mov ecx, edx
add eax, ecx
push eax
push dword [ebp - 0x33c]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x32c]
mov ecx, dword [ebp - 0x334]
add eax, ecx
mov dword [ebp - 0x358], eax
sub esi, ecx
mov dword [ebp + 8], esi
jne 0x1001bbb8
xor edi, edi
jmp 0x1001babe
mov ecx, ebx
push dword [ebp - 0x330]
push ebx
push esi
mov eax, dword [ebp - 0x33c]
add eax, ecx
push eax
mov esi, dword [ebp - 0x344]
mov ecx, esi
call fcn.100310a3
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001bbaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1001bc19
push 1
lea eax, [ebp - 0x35c]
push eax
push dword [ebp - 0x330]
mov ecx, esi
call fcn.100310a3
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1001bc19
jmp 0x1001bbaf
push 0x26
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
jmp 0x1001bc90
test edi, edi
jne 0x1001bcad
mov eax, dword [ebp - 0x360]
test eax, eax
je 0x1001bcad
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
jmp 0x1001bcbf
push 6
jmp 0x1001bcb7
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
call fcn.10083d80
ret 0xc