Function at 0x1006cfa
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c8
mov eax, dword [0x101348c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push 0x27
push edi
mov dword [ebp - 0x5ac], edi
mov dword [ebp - 0x590], esi
mov dword [ebp - 0x594], eax
call fcn.0100c15e
push 0
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0x5c8]
push eax
lea eax, [ebp - 0x5c4]
push eax
push esi
push edi
call fcn.01008082
cmp eax, 0xfffffc15
mov dword [ebp - 0x5a0], eax
je 0x1007378
cmp eax, 0xfffffffc
jl 0x1007378
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x70
push 0x42
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [ebp - 0x5a8], eax
call ebx
test eax, eax
mov dword [ebp - 0x598], eax
jne 0x1006da2
push 1
push edi
push 0x3ed
call fcn.0100b820
jmp 0x1007378
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x58c]
push eax
call fcn.01004965
and dword [0x1033928], 0
mov eax, 0x200000
push eax
push 0x42
mov dword [ebp - 0x5b8], 1
mov dword [ebp - 0x5a0], eax
call esi
mov dword [0x1033930], eax
movzx eax, word [ebp - 0x48c]
imul eax, eax, 0xdee0
push eax
push 0x42
call esi
xor ecx, ecx
cmp dword [ebp - 0x5a8], ecx
mov dword [0x103392c], eax
je 0x10072fd
cmp eax, ecx
je 0x10072fd
cmp dword [0x1033930], ecx
je 0x10072fd
cmp dword [0x1034864], ecx
je 0x10072fd
push eax
call ebx
test eax, eax
mov dword [ebp - 0x5a4], eax
je 0x10072f3
push dword [0x1033930]
call ebx
test eax, eax
mov dword [ebp - 0x59c], eax
je 0x10072f3
push dword [0x1034864]
call ebx
test eax, eax
mov dword [ebp - 0x5b0], eax
je 0x10072f3
lea ecx, [ebp - 0x58c]
push ecx
push eax
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0x5bc]
push eax
push dword [ebp - 0x590]
push edi
call fcn.010093b2
test eax, eax
jle 0x100730a
push 3
push 0x80000000
push dword [ebp - 0x590]
push edi
call fcn.0100c756
cmp eax, 0xffffffff
mov dword [0x103393c], eax
je 0x1007378
push 2
push 0xc0000000
push dword [ebp - 0x594]
push edi
call fcn.0100c756
cmp eax, 0xffffffff
mov dword [0x1034868], eax
jne 0x1006ed7
push dword [0x103393c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1007378
lea ecx, [ebp - 0x420]
push ecx
push eax
call fcn.01008c0c
test eax, eax
jne 0x1006ef5
push 1
push edi
push 0x579
jmp 0x1007305
push dword [ebp - 0x598]
push dword [0x1034868]
call fcn.01008ca2
test eax, eax
jne 0x1006f17
push 1
push edi
push 0x57a
jmp 0x1007305
push dword [ebp - 0x598]
lea eax, [ebp - 0x58c]
push eax
push dword [0x1034868]
call fcn.01008d2e
test eax, eax
jne 0x1006f40
push 1
push edi
push 0x57b
jmp 0x1007305
mov eax, dword [ebp - 0x598]
cmp dword [eax + 0x18], 0
je 0x1006f77
push eax
push dword [ebp - 0x5b0]
movzx eax, word [ebp - 0x424]
push eax
push dword [0x1034868]
call fcn.01008dc3
test eax, eax
jne 0x1006f77
push 1
push edi
push 0x57c
jmp 0x1007305
movzx eax, word [ebp - 0x48c]
imul eax, eax, 0xdee0
push eax
push 0x42
call esi
test eax, eax
mov dword [ebp - 0x594], eax
je 0x10072fd
push eax
call ebx
test eax, eax
mov dword [ebp - 0x590], eax
je 0x10072f3
push dword [0x1033934]
call ebx
mov esi, eax
test esi, esi
je 0x10072f3
push 0x28
push edi
call fcn.0100c15e
push dword [ebp - 0x590]
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0x5b4]
push eax
push dword [ebp - 0x59c]
lea eax, [ebp - 0x5b8]
push dword [ebp - 0x5a4]
push dword [0x103393c]
push eax
push edi
call fcn.01006967
test eax, eax
je 0x100730a
push 0x29
push edi
call fcn.0100c15e
mov ebx, dword [ebp - 0x598]
push ebx
push esi
push dword [0x1034868]
call fcn.01008ebb
cmp word [ebp - 0x424], 0
je 0x100706f
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x47
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.0100b74c
test eax, eax
je 0x100706f
movzx eax, word [ebp - 0x48c]
push eax
push esi
push dword [ebp - 0x5a4]
push edi
call fcn.0100c046
test eax, eax
jne 0x100706f
push 1
push edi
push 0x51c
jmp 0x1007305
cmp dword [ebx + 0x38], 0
je 0x1007087
push ebx
push dword [ebp - 0x5a4]
push dword [0x1034868]
call fcn.01008f85
cmp dword [ebx + 0x48], 0
je 0x100709f
push ebx
push dword [ebp - 0x590]
push dword [0x1034868]
call fcn.0100901d
push dword [0x1033934]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
cmp word [ebp - 0x424], ax
je 0x10071c8
cmp dword [0x1033928], eax
mov dword [ebp - 0x590], eax
jbe 0x10071c8
mov ebx, dword [ebp - 0x59c]
cmp word [ebx + 0x1a], 1
jbe 0x10071a7
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x10071a7
xor esi, esi
push esi
push esi
push dword [ebx + 0x1c]
push dword [0x103393c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx eax, word [ebx + 0x1a]
push esi
shl eax, 1
lea ecx, [ebp - 0x5b4]
push ecx
push eax
mov dword [ebp - 0x5a0], eax
lea eax, [ebp - 0x404]
push eax
push dword [0x103393c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x5a0]
push ebx
mov word [ebp + eax*2 - 0x404], si
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x5a4]
lea esi, [ebp - 0x58c]
push dword [ebp - 0x5b0]
sub esp, 0x16c
push 0x5a
pop ecx
mov edi, esp
push dword [ebp - 0x5ac]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.010062af
cmp word [ebx], 0x2c
jne 0x100718c
cmp word [ebx + 2], 0x7a
je 0x100719b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100730a
mov edi, dword [ebp - 0x5ac]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
inc dword [ebp - 0x590]
mov eax, dword [ebp - 0x590]
add ebx, 0x20
cmp eax, dword [0x1033928]
jb 0x10070e8
mov ebx, dword [ebp - 0x598]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x2a
push edi
call fcn.0100c15e
push dword [0x1033928]
push dword [ebp - 0x59c]
push edi
call fcn.0100bb1e
push 0
push 0
push dword [ebx + 0x54]
push dword [0x1034868]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx ecx, word [ebp - 0x48a]
lea eax, [ecx + 1]
imul eax, ecx
push 0
lea ecx, [ebp - 0x5a0]
push ecx
shl eax, 2
push eax
push 0
push dword [0x1034868]
mov dword [ebp - 0x5a0], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x58c]
push eax
push ebx
push dword [ebp - 0x59c]
push dword [0x1034868]
push edi
call fcn.01004a99
lea eax, [ebp - 0x58c]
push eax
push ebx
push dword [ebp - 0x59c]
push dword [0x1034868]
push dword [0x103393c]
push edi
call fcn.010050aa
mov eax, dword [0x1033928]
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x420]
push eax
push dword [0x1034868]
call fcn.01008c0c
push dword [0x1034864]
call esi
mov eax, dword [0x103392c]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x10072a8
push eax
call ebx
push dword [ebp - 0x594]
call esi
push dword [ebp - 0x594]
call ebx
push dword [0x1033930]
call esi
push dword [0x1033930]
call ebx
push dword [0x1034868]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x103393c]
call esi
push 2
push edi
push 0x5dd
call fcn.0100b820
xor eax, eax
inc eax
jmp 0x100737a
push 1
push edi
push 0x3ed
jmp 0x1007305
push 1
push edi
push 0x3ec
call fcn.0100b820
mov eax, dword [0x103393c]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x100731c
push eax
call esi
mov eax, dword [0x1034868]
test eax, eax
je 0x1007328
push eax
call esi
cmp dword [ebp - 0x5a8], 0
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x100733f
push dword [ebp - 0x5a8]
call esi
mov eax, dword [0x1033930]
test eax, eax
je 0x100734b
push eax
call esi
mov eax, dword [0x103392c]
test eax, eax
je 0x1007357
push eax
call esi
cmp dword [ebp - 0x594], 0
je 0x1007368
push dword [ebp - 0x594]
call esi
mov eax, dword [0x1034864]
test eax, eax
je 0x1007378
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.0100dd00
pop edi
pop esi
pop ebx
leave
ret 0xc