Function at 0x1c91cd0
Capabilities:
Check for peb ntglobalflag flag
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov eax, esp
push 0x42
push str....._base_files_file_win.cc
push str.Read
push eax
call fcn.01c7f230
add esp, 0x10
mov eax, dword [0x1cf656c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov edi, dword [eax + 0xa4]
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x1cfae94]
bt ecx, eax
jae 0x1c91e1c
push edi
call section..text
add esp, 4
mov dword [esp + 0x20], edi
mov eax, dword [0x1cf656c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
lea ebx, [eax + 0xa8]
mov edi, dword [ebx]
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x1cfae94]
bt ecx, eax
jae 0x1c91e2d
push edi
call section..text
add esp, 4
lea eax, [esp + 0x20]
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov ecx, dword [ebx]
mov dword [ebx], eax
mov dword [eax + 0xc], ecx
test edi, edi
je 0x1c91e18
mov al, byte [edi + 0x10]
mov byte [esp + 0x30], al
xor eax, eax
mov byte [esp + 0x38], al
mov byte [esp + 0x48], al
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp byte [ecx + 0xac], al
je 0x1c91e66
mov eax, dword [esp + 0x24]
cmp byte [esp + 0x30], 0
je 0x1c91e3e
test eax, eax
je 0x1c91e94
cmp byte [eax + 0x28], 0
je 0x1c91e94
mov edi, dword [eax + 0x20]
mov dword [eax + 0x20], 0
test edi, edi
je 0x1c91e94
lock dec dword [edi]
jne 0x1c91e94
mov ecx, edi
call fcn.01c25c80
push edi
call fcn.01c95155
add esp, 4
jmp 0x1c91e94
xor eax, eax
jmp 0x1c91da4
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x1d02e94], 1
jmp 0x1c91d4e
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x1d02e94], 1
jmp 0x1c91d8c
test eax, eax
jne 0x1c91e94
lea edi, [esp + 0x38]
cmp byte [edi + 0x10], 0
je 0x1c91e58
mov ecx, edi
call fcn.01cbf190
mov byte [esp + 0x48], 0
mov ecx, edi
call fcn.01c7f520
mov byte [esp + 0x48], 1
jmp 0x1c91e94
mov eax, dword [0x1d06124]
mov ecx, dword [0x1cf656c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c91f6b
cmp byte [0x1d06120], 0
je 0x1c91dce
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1c91eb6
cmp dword [esp + 0x24], 0
jne 0x1c91eb6
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x1cef298]
mov ecx, edi
push 0
call ebx
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x5c], 0xa
mov al, byte [0x1cf8cca]
test al, al
jne 0x1c91f43
xor ebx, ebx
dec ebx
test edi, edi
js 0x1c91f23
mov eax, dword [ebp + 0x14]
test eax, eax
js 0x1c91f23
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
pxor xmm0, xmm0
movdqa xmmword [esp], xmm0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
lea ecx, [esp + 0x64]
mov dword [ecx], 0xffffffff
mov edi, esp
push edi
push ecx
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c91f9e
mov ebx, dword [esp + 0x64]
test ebx, ebx
js 0x1c91fb3
lea ecx, [esp + 0x20]
call fcn.01c823e0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
movzx ecx, al
lea eax, [esp + 0x64]
mov edx, esp
mov dword [eax], edx
lea ebx, [esp + 0x60]
mov dword [ebx], str.ScopedBlockingCall
lea edx, [esp + 0x5c]
push eax
push ebx
call fcn.01c7f4c0
add esp, 8
jmp 0x1c91eca
push 0x1d06124
call fcn.01c9518a
add esp, 4
cmp dword [0x1d06124], 0xffffffff
jne 0x1c91e87
mov byte [0x1d06120], 1
push 0x1d06124
call fcn.01c951d9
add esp, 4
jmp 0x1c91e87
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x1c91f23
int3