Function at 0x10014830
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10064318]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x64], ecx
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0x58], eax
lea ebx, [eax + 6]
cmp ebx, eax
jl 0x100148a8
push ebx
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, eax
test edi, edi
je 0x100148a8
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, dword [ebp - 0x58]
test eax, eax
jne 0x10025a45
push 0xc
push 0x100080bc
lea eax, [edi + esi*2]
push 0xc
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025a65
xor eax, eax
push eax
mov word [edi + ebx*2], ax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, edi
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ProcessIdToSessionId]
push dword [ebp - 0x60]
lea eax, [ebp - 0x2c]
push 0x100080b4
push 0x14
push eax
call fcn.10014b50
lea edi, [ebp - 0x2c]
add esp, 0x10
lea ecx, [edi + 2]
lea esp, [esp]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x100148e0
sub edi, ecx
sar edi, 1
test esi, esi
je 0x100148fb
test edi, edi
je 0x1001497d
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, eax
mov dword [ebp - 0x58], ecx
lea eax, [ecx + edi]
cmp eax, ecx
jl 0x1001497d
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
test ebx, ebx
je 0x1001497d
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je case.0x10025aa5.80
mov edx, dword [ebp - 0x58]
lea ecx, [edx + edx]
push ecx
lea eax, [edx + edi]
push esi
add eax, eax
push eax
push ebx
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025a96
lea eax, [edi + edi]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov eax, dword [ebp - 0x58]
lea eax, [ebx + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025ab6
mov eax, dword [ebp - 0x58]
xor edx, edx
add eax, edi
push esi
mov word [ebx + eax*2], dx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
test eax, eax
je 0x10014a4d
push 0
push 0x28
lea ecx, [ebp - 0x54]
push ecx
push 2
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x10014a4d
lea edi, [ebp - 0x54]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x100149b1
sub edi, ecx
sar edi, 1
test esi, esi
je 0x100149cc
test edi, edi
je 0x10014a4d
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, eax
mov dword [ebp - 0x58], ecx
lea eax, [ecx + edi]
mov dword [ebp - 0x5c], eax
cmp eax, ecx
jl 0x10014a4d
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
test ebx, ebx
je 0x10014a4d
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je case.0x10025ae2.80
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
add ecx, ecx
push ecx
push esi
add eax, eax
push eax
push ebx
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025ad3
add edi, edi
lea eax, [ebp - 0x54]
push edi
push eax
mov eax, dword [ebp - 0x58]
push edi
lea eax, [ebx + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025ae9
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
push esi
mov word [ebx + eax*2], cx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, ebx
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0x5c], eax
lea ebx, [eax + 0xf]
cmp ebx, eax
jl 0x10014ac5
push ebx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, eax
test edi, edi
je 0x10014ac5
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je case.0x10025b12.80
mov ecx, dword [ebp - 0x5c]
lea eax, [ebx + ebx]
add ecx, ecx
push ecx
push esi
push eax
push edi
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025aff
mov eax, dword [ebp - 0x5c]
push 0x1e
push 0x10008094
push 0x1e
lea eax, [edi + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025b19
xor eax, eax
push esi
mov word [edi + ebx*2], ax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, edi
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
push 0
push 4
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
mov edi, dword [ebp - 0x64]
mov dword [edi], eax
test eax, eax
je 0x10014b1f
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [edi + 4], eax
test eax, eax
je 0x10025b33
xor ebx, ebx
cmp dword [edi + 4], 0
je 0x10014b36
xor ebx, ebx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f1e0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10014afd
movzx ebx, bx
or ebx, 0x80070000
jmp 0x10014afd
test ebx, ebx
js 0x10014b05
mov ebx, 0x80004005
jmp 0x10014b05
lea ecx, [esi + esi]
push ecx
push 0
lea eax, [ebx + ebx]
push eax
push edi
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
mov ecx, eax
call fcn.1002c277
jmp 0x1001487b
sub eax, 0xc
cmp eax, 0x44
ja case.0x10025aa5.13
movzx eax, byte [eax + 0x10025b65]
jmp dword [eax*4 + 0x10025b55]
mov ecx, 0x8007000e
jmp 0x10025a87
mov ecx, 0x80004005
call fcn.1002c34b
mov ecx, 0x80004005
call fcn.1002c34b
sub eax, 0xc
cmp eax, 0x44
ja case.0x10025aa5.13
movzx eax, byte [eax + 0x10025bbd]
jmp dword [eax*4 + 0x10025bad]
mov ecx, 0x80070057
call fcn.1002c34b
sub eax, 0xc
cmp eax, 0x44
ja case.0x10025ac5.13
movzx eax, byte [eax + 0x10025c15]
jmp dword [eax*4 + 0x10025c05]
mov ecx, 0x80070057
jmp 0x10025a87
sub eax, 0xc
cmp eax, 0x44
ja case.0x10025ac5.13
movzx eax, byte [eax + 0x10025c6d]
jmp dword [eax*4 + 0x10025c5d]
sub eax, 0xc
cmp eax, 0x44
ja case.0x10025ac5.13
movzx eax, byte [eax + 0x10025cc5]
jmp dword [eax*4 + 0x10025cb5]
sub eax, 0xc
cmp eax, 0x44
ja case.0x10025ac5.13
movzx eax, byte [eax + 0x10025d1d]
jmp dword [eax*4 + 0x10025d0d]
sub eax, 0xc
cmp eax, 0x44
ja case.0x10025ac5.13
movzx eax, byte [eax + 0x10025d75]
jmp dword [eax*4 + 0x10025d65]
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10025b48
movzx ebx, bx
or ebx, 0x80070000
mov ecx, edi
call fcn.10014806
jmp 0x10014afd