Function at 0x10016a0
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0x9ac], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
push 0x1014080
push 0x10140f8
push 0x10024e5
push 0x1001cfc
call fcn.0100252f
mov esi, 0x8000
mov edi, 0x80000000
cmp dword [0x101411c], ebx
je 0x1001724
mov al, byte [0x1014120]
cmp al, 4
jb 0x1001ccc
mov eax, dword [0x1014108]
mov ecx, dword [0x101410c]
and eax, esi
and ecx, edi
or eax, ecx
jne 0x10058cb
push 0x1001d1c
push 0xffffffffffffffff
call fcn.010028f1
call fcn.01003137
push 2
call fcn.01003092
test eax, eax
jl 0x1001cd9
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.MSSHooks.dll_LoadMSSearchHooks]
call fcn.01002926
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001c85
xor eax, eax
cmp dword [ebp + 8], 7
lea edi, [ebp - 0x9d4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x9c0], ebx
mov dword [ebp - 0x9c8], ebx
mov dword [ebp - 0x9b8], ebx
jne 0x1005912
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9c4], ebx
jl 0x1001879
push 0x60
call dword [0x1014498]
cmp eax, ebx
je 0x1001ce0
mov ecx, eax
call fcn.01002747
push eax
lea ecx, [ebp - 0x9c4]
call fcn.01001463
cmp dword [ebp - 0x9c4], ebx
je 0x1005921
cmp dword [ebp - 0x9a4], ebx
jl 0x1001879
push 1
push ebx
lea ecx, [ebp - 0x9e8]
mov dword [ebp - 0x9e8], ebx
mov dword [ebp - 0x9e4], ebx
mov dword [ebp - 0x9e0], ebx
mov dword [ebp - 0x9dc], ebx
mov dword [ebp - 0x9d8], ebx
call fcn.01003331
lea eax, [ebp - 0x9a8]
push eax
push 0x11
mov dword [ebp - 0x9a8], ebx
call fcn.01003a69
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x100185a
push 1
push dword [ebp - 0x9a8]
lea ecx, [ebp - 0x9e8]
call fcn.01002f06
push ebx
push ebx
push ebx
push 2
push 2
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x9e8]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x9a4], eax
cmp dword [ebp - 0x9a8], ebx
je 0x100186e
push dword [ebp - 0x9a8]
call dword [0x1014494]
lea ecx, [ebp - 0x9e8]
call fcn.01002295
cmp dword [ebp - 0x9a4], ebx
mov esi, dword [sym.imp.msvcrt.dll__wtoi]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [ebp - 0x9cc], ebx
jl 0x100190f
mov eax, dword [ebp - 0x9ac]
push dword [eax + 8]
call esi
pop ecx
lea ecx, [ebp - 0x9cc]
push ecx
push eax
mov dword [ebp - 0x9d4], eax
call edi
test eax, eax
je 0x1005930
cmp dword [ebp - 0x9a4], ebx
jl 0x100190f
mov eax, dword [ebp - 0x9ac]
push dword [eax + 0xc]
call esi
pop ecx
lea ecx, [ebp - 0x9cc]
push ecx
push eax
mov dword [ebp - 0x9c0], eax
call edi
test eax, eax
je 0x1005940
cmp dword [ebp - 0x9a4], ebx
jl 0x100190f
mov eax, dword [ebp - 0x9ac]
push dword [eax + 0x10]
call esi
pop ecx
lea ecx, [ebp - 0x9cc]
push ecx
push eax
mov dword [ebp - 0x9c8], eax
call edi
test eax, eax
je 0x1005950
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9bc], ebx
jl 0x10019c0
mov eax, dword [ebp - 0x9ac]
push dword [eax + 0x14]
call esi
pop ecx
mov dword [ebp - 0x9bc], eax
cmp eax, 0x10000
ja 0x1005960
cmp dword [ebp - 0x9a4], ebx
jl 0x10019c0
mov eax, dword [ebp - 0x9ac]
push dword [eax + 0x18]
call esi
pop ecx
lea ecx, [ebp - 0x9cc]
push ecx
push eax
mov dword [ebp - 0x9d0], eax
call edi
test eax, eax
je 0x100596f
cmp dword [ebp - 0x9a4], ebx
jl 0x10019c0
lea eax, [ebp - 0x9a8]
push eax
push 0x1001d0c
push 1
push ebx
push 0x1001d44
mov dword [ebp - 0x9a8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov eax, dword [ebp - 0x9a8]
jl 0x10019b0
cmp eax, ebx
je 0x10019b0
mov ecx, dword [eax]
push 2
push 1
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x9a4], ebx
cmp eax, ebx
je 0x10019c0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9a8], ebx
jl 0x1001a19
lea eax, [ebp - 0x9ac]
push eax
call fcn.01002399
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001a19
mov esi, dword [ebp - 0x9ac]
mov eax, dword [esi]
push esi
call dword [eax + 4]
push dword [ebp - 0x9c4]
mov ecx, esi
call fcn.010022c8
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001a13
push esi
lea ecx, [ebp - 0x9a8]
call fcn.01001496
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9b4], ebx
mov esi, 0x1001d34
jl 0x1001a60
push 1
push ebx
push ebx
push dword [ebp - 0x9a8]
lea eax, [ebp - 0x9b4]
push esi
push eax
call dword [sym.imp.ole32.dll_CoGetMarshalSizeMax]
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001a60
mov eax, dword [ebp - 0x9b4]
cmp eax, dword [ebp - 0x9bc]
ja 0x100597f
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9ac], ebx
jl 0x1001ab6
push dword [ebp - 0x9b4]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x9ac], edi
cmp edi, ebx
je 0x100598e
cmp dword [ebp - 0x9a4], ebx
jl 0x1001ce7
lea eax, [ebp - 0x9b8]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001ce7
cmp dword [ebp - 0x9a4], ebx
mov dword [ebp - 0x9bc], ebx
jl 0x1001bdc
xor edi, edi
inc edi
push edi
push ebx
push ebx
push dword [ebp - 0x9a8]
push esi
push dword [ebp - 0x9b8]
call dword [sym.imp.ole32.dll_CoMarshalInterface]
cmp eax, ebx
mov dword [ebp - 0x9a4], eax
jl 0x1001bdc
mov eax, dword [ebp - 0x9b4]
add eax, 4
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x9c8]
mov dword [ebp - 0x9bc], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x10059aa
cmp dword [ebp - 0x9a4], ebx
jl 0x1001bdc
push dword [ebp - 0x9ac]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
cmp edi, ebx
je 0x10059ba
cmp dword [ebp - 0x9a4], ebx
jl 0x1001b7c
mov eax, dword [ebp - 0x9b4]
mov dword [esi], eax
push dword [ebp - 0x9b4]
lea eax, [esi + 4]
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 0x9ac]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x1001b7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10059ca
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x9a4], ebx
jl 0x1001bdc
lea ecx, [ebp - 0x9b0]
call fcn.01003cd0
push dword [ebp - 0x9c0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x10059da
cmp dword [ebp - 0x9a4], ebx
jl 0x10059fa
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x9d4]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
je 0x10059ea
lea ecx, [ebp - 0x9b0]
call fcn.01002095
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, dword [ebp + edi*4 - 0x9d4]
cmp eax, ebx
je 0x1001bf2
push eax
call esi
inc edi
cmp edi, 2
jb 0x1001be4
mov ecx, dword [ebp - 0x9b8]
cmp ecx, ebx
je 0x1001c26
cmp dword [ebp - 0x9bc], ebx
je 0x1001c26
mov edx, dword [ecx]
push ebx
push ebx
push ebx
xor eax, eax
push eax
push ecx
call dword [edx + 0x14]
test eax, eax
jl 0x1001c26
push dword [ebp - 0x9b8]
call dword [sym.imp.ole32.dll_CoReleaseMarshalData]
cmp dword [ebp - 0x9c0], ebx
je 0x1001c36
push dword [ebp - 0x9c0]
call esi
cmp dword [ebp - 0x9c8], ebx
je 0x1001c46
push dword [ebp - 0x9c8]
call esi
mov eax, dword [ebp - 0x9a8]
cmp eax, ebx
je 0x1001c56
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x9c4]
cmp ecx, ebx
je 0x1001c65
call fcn.010013bd
mov eax, dword [ebp - 0x9b8]
cmp eax, ebx
je 0x1001c75
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 0x8000
mov edi, 0x80000000
cmp dword [0x101411c], ebx
je 0x1001cad
mov al, byte [0x1014120]
cmp al, 4
jb 0x1001cf4
mov eax, dword [0x1014108]
mov ecx, dword [0x101410c]
and eax, esi
and ecx, edi
or eax, ecx
jne 0x1005a56
push 0x1014080
call fcn.01001ec1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x9a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010012fd
leave
ret
cmp al, bl
je 0x100170d
jmp 0x1001724
push 3
jmp 0x1001746
xor eax, eax
jmp 0x10017bc
cmp edi, ebx
jne 0x100599e
jmp 0x1001ab6
cmp al, bl
jne 0x1001cad
jmp 0x1001c96
mov eax, dword [0x1014110]
mov edx, dword [0x1014114]
mov ecx, eax
and ecx, esi
and edx, edi
cmp ecx, eax
jne 0x1001724
cmp edx, dword [0x1014114]
jne 0x1001724
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1005aa0
push dword [0x1014084]
push dword [0x1014080]
call fcn.01009515
jmp 0x1001724
mov dword [ebp - 0x9a4], 0x80070667
jmp 0x1001793
mov dword [ebp - 0x9a4], 0x8007000e
jmp 0x10017d4
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x10018b7
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x10018e3
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x100190f
mov dword [ebp - 0x9a4], 0x80070057
jmp 0x100193e
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x100196a
mov dword [ebp - 0x9a4], 0x80028016
jmp 0x1001a60
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x1001a8c
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1001ab6
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x1001b19
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x1001b3b
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x1001b7c
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x1001baa
call fcn.01002d9a
mov dword [ebp - 0x9a4], eax
jmp 0x1001bd1
push 3
push 0x10063e8
lea ecx, [ebp - 0x60]
call fcn.0100dbca
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x9a0]
call fcn.010096b0
push dword [ebp - 0x9a4]
lea ecx, [ebp - 0x9a0]
call fcn.0100cbad
push ebx
lea eax, [ebp - 0x9a0]
push 0xc0000c1c
push eax
call fcn.010094f8
add esp, 0xc
lea ecx, [ebp - 0x9a0]
call fcn.010096e7
lea ecx, [ebp - 0x60]
call fcn.0100dbf2
jmp 0x1001bd1
mov eax, dword [0x1014110]
mov ecx, eax
and ecx, esi
mov esi, dword [0x1014114]
mov edx, esi
and edx, edi
cmp ecx, eax
jne 0x1001cad
cmp edx, esi
jne 0x1001cad
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1005ab0
push dword [0x1014084]
push dword [0x1014080]
call fcn.01009515
jmp 0x1001cad