Function at 0x1001f6ae
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
xor ecx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, 0x1013b418
mov dword [esp + 0x20], ecx
mov dl, cl
mov dword [esp + 0x1c], edi
mov al, cl
mov dword [esp + 0x28], edi
inc ebx
mov byte [esp + 0x11], dl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x19], cl
mov byte [esp + 0x15], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x16], cl
mov byte [esp + 0x14], al
mov byte [esp + 0x17], cl
mov byte [esp + 0x12], cl
mov byte [esp + 0x24], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 0x13], cl
test ebp, ebp
je 0x1001fad9
mov esi, ecx
mov ecx, dword [esp + 0x3c]
lea eax, [esi + 0x1e]
cmp eax, ecx
jge 0x1001fac3
mov edi, dword [esp + 0x38]
lea ebp, [esi + edi]
cmp byte [ebp], 0x50
jne 0x1001faba
cmp byte [esi + edi + 1], 0x4b
jne 0x1001faba
mov al, byte [ebp + 2]
cmp al, bl
jne 0x1001f755
cmp byte [esi + edi + 3], 2
jne 0x1001faba
mov ecx, edi
push 0x2e
movzx eax, word [esi + ecx + 0x1c]
jmp 0x1001f773
cmp al, 3
jne 0x1001faba
cmp byte [esi + edi + 3], 4
jne 0x1001faba
mov ecx, dword [esp + 0x38]
push 0x1e
movzx eax, word [esi + ecx + 0x1a]
movzx ebx, ax
pop edi
lea eax, [ebx + edi]
add eax, esi
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x3c]
jg 0x1001fab3
cmp ebx, 8
jne 0x1001f7ce
cmp edi, 0x1e
jne 0x1001f7fe
push 0
push ebx
lea eax, [ecx + 0x1e]
add eax, esi
push str.mimetype
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f7fe
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x40]
sub eax, esi
push eax
push ebp
call fcn.10020165
mov dl, al
add esp, 0xc
mov byte [esp + 0x11], dl
jmp 0x1001faa7
cmp ebx, 9
jne 0x1001f7fe
lea ebp, [edi + esi]
mov edi, dword [esp + 0x38]
push 0
push ebx
push str.META_INF_
lea eax, [edi + ebp]
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f805
xor ebx, ebx
inc ebx
mov byte [esp + 0x1a], bl
jmp 0x1001fa52
lea ebp, [edi + esi]
mov edi, dword [esp + 0x38]
lea esi, [edi + ebp]
cmp ebx, 0xb
jne 0x1001f858
push 0
push ebx
push str.content.xml
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f82e
xor ebx, ebx
inc ebx
mov byte [esp + 0x19], bl
jmp 0x1001fa52
cmp ebx, 0xb
jne 0x1001f858
push 0
push ebx
push str._rels_.rels
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8cf
xor ebx, ebx
inc ebx
mov byte [esp + 0x16], bl
jmp 0x1001fa52
cmp ebx, 0x13
jne 0x1001f87e
push 0
push ebx
push str._Content_Types_.xml
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8cf
xor ebx, ebx
inc ebx
mov byte [esp + 0x14], bl
jmp 0x1001fa52
cmp ebx, 0x14
jne 0x1001f8a4
push 0
push ebx
push str.META_INF_MANIFEST.MF
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8cf
xor ebx, ebx
inc ebx
mov byte [esp + 0x15], bl
jmp 0x1001fa52
cmp ebx, 0x15
jne 0x1001f8ca
push 0
push ebx
push str.META_INF_manifest.xml
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8cf
xor ebx, ebx
inc ebx
mov byte [esp + 0x18], bl
jmp 0x1001fa52
cmp ebx, 4
jbe 0x1001f91e
mov eax, dword [esp + 0x1c]
push 0
push 4
add eax, 0xfffffffc
add eax, edi
push str..opf
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f8fa
xor ebx, ebx
inc ebx
mov byte [esp + 0x1b], bl
jmp 0x1001fa52
cmp ebx, 4
jbe 0x1001f91e
mov eax, dword [esp + 0x1c]
push 0
push 4
add eax, 0xfffffffc
add eax, edi
push str..sml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001f942
cmp ebx, 5
jbe 0x1001f94e
mov eax, dword [esp + 0x1c]
push 0
push 5
add eax, 0xfffffffb
add eax, edi
push str..smil
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f94e
xor ebx, ebx
inc ebx
mov byte [esp + 0x13], bl
jmp 0x1001fa52
cmp ebx, 7
jbe 0x1001f98b
push 0
push 3
push 0x1013b4bc
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f98b
push eax
mov eax, dword [esp + 0x20]
push 4
add eax, 0xfffffffc
add eax, edi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001fa4b
cmp ebx, 8
jbe 0x1001f9d0
push 0
push 4
push str.ppt_
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f9d0
push eax
mov eax, dword [esp + 0x20]
push 4
add eax, 0xfffffffc
add eax, edi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001f9d0
xor ebx, ebx
inc ebx
mov byte [esp + 0x24], bl
jmp 0x1001fa52
cmp ebx, 9
jbe 0x1001fa12
push 0
push 5
push str.word_
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fa12
push eax
mov eax, dword [esp + 0x20]
push 4
add eax, 0xfffffffc
add eax, edi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fa12
xor ebx, ebx
inc ebx
mov byte [esp + 0x17], bl
jmp 0x1001fa52
cmp ebx, 0xa
jbe 0x1001fa58
push 0
push 6
push str.excel_
push esi
call sym.CoreFoundation.dll__NS_strncasecmp_l
mov esi, dword [esp + 0x2c]
add esp, 0x10
test eax, eax
jne 0x1001fa5c
push eax
push 4
lea eax, [esi - 4]
add eax, edi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fa5c
xor ebx, ebx
inc ebx
mov byte [esp + 0x12], bl
mov dl, byte [esp + 0x11]
jmp 0x1001faaa
mov esi, dword [esp + 0x1c]
cmp ebx, 0xf
jbe 0x1001faa3
push 0
push 0xb
lea eax, [edi + ebp]
push str.powerpoint_
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001faa3
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
mov ebx, dword [esp + 0x34]
add esp, 0x10
test eax, eax
movzx ebx, bl
push 1
pop eax
cmove ebx, eax
mov dword [esp + 0x24], ebx
mov dl, byte [esp + 0x11]
xor ebx, ebx
inc ebx
mov eax, dword [esp + 0x1c]
lea esi, [eax - 1]
jmp 0x1001fab6
xor ebx, ebx
inc ebx
mov ecx, dword [esp + 0x3c]
inc esi
test dl, dl
je 0x1001f711
mov edi, dword [esp + 0x28]
test dl, dl
jne 0x1001ff37
mov ebp, dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x1c], edi
mov esi, dword [esp + 0x40]
cmp esi, 0x400
jl 0x1001fe96
mov ebx, dword [esp + 0x34]
test ebx, ebx
js 0x1001fb3d
push ecx
add esi, 0xfffffc00
push esi
push ebx
call sym.CoreFoundation.dll__NS_lseek
add esp, 0xc
cmp eax, esi
jne 0x1001fb3d
mov ebp, 0x400
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, eax
mov dword [esp + 0x24], edx
pop ecx
test edx, edx
je 0x1001fe9a
push ebp
push edx
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov edx, dword [esp + 0x2c]
add esp, 0xc
cmp eax, ebp
jl 0x1001fe9a
mov eax, edx
jmp 0x1001fb64
test ebp, ebp
je 0x1001fe96
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x20]
cmp eax, 0x400
jl 0x1001fe9a
add eax, 0xfffffc00
add eax, ebp
mov ebp, 0x400
mov dword [esp + 0x38], eax
test eax, eax
je 0x1001fe9a
xor esi, esi
mov edi, eax
cmp byte [esi + edi], 0x50
jne 0x1001fe86
cmp byte [esi + edi + 1], 0x4b
jne 0x1001fe86
mov al, byte [esi + edi + 2]
xor ecx, ecx
inc ecx
cmp al, cl
jne 0x1001fba8
cmp byte [esi + edi + 3], 2
jne 0x1001fe86
movzx ecx, word [esi + edi + 0x1c]
push 0x2e
jmp 0x1001fbc2
cmp al, 3
jne 0x1001fe86
cmp byte [esi + edi + 3], 4
jne 0x1001fe86
movzx ecx, word [esi + edi + 0x1a]
push 0x1e
movzx ebx, cx
pop eax
lea ecx, [ebx + eax]
mov dword [esp + 0x28], ecx
add ecx, esi
mov dword [esp + 0x38], ecx
cmp ecx, ebp
ja 0x1001fe86
lea ebp, [eax + esi]
mov dword [esp + 0x2c], ebp
cmp ebx, 9
jne 0x1001fc09
push 0
push ebx
lea eax, [edi + ebp]
push str.META_INF_
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fc09
inc eax
mov byte [esp + 0x1a], al
jmp 0x1001fe7c
add ebp, edi
cmp ebx, 0xb
jne 0x1001fc53
push 0
push ebx
push str.content.xml
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fc2f
inc eax
mov byte [esp + 0x19], al
jmp 0x1001fe7c
cmp ebx, 0xb
jne 0x1001fc53
push 0
push ebx
push str._rels_.rels
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fcc4
inc eax
mov byte [esp + 0x16], al
jmp 0x1001fe7c
cmp ebx, 0x13
jne 0x1001fc77
push 0
push ebx
push str._Content_Types_.xml
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fcc4
inc eax
mov byte [esp + 0x14], al
jmp 0x1001fe7c
cmp ebx, 0x14
jne 0x1001fc9b
push 0
push ebx
push str.META_INF_MANIFEST.MF
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fcc4
inc eax
mov byte [esp + 0x15], al
jmp 0x1001fe7c
cmp ebx, 0x15
jne 0x1001fcbf
push 0
push ebx
push str.META_INF_manifest.xml
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fcc4
inc eax
mov byte [esp + 0x18], al
jmp 0x1001fe7c
cmp ebx, 4
jbe 0x1001fced
mov eax, dword [esp + 0x38]
push 0
push 4
add eax, 0xfffffffc
add eax, edi
push str..opf
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fced
inc eax
mov byte [esp + 0x1b], al
jmp 0x1001fe7c
add esi, dword [esp + 0x28]
cmp ebx, 4
jbe 0x1001fd11
push 0
push 4
lea eax, [edi - 4]
add eax, esi
push str..sml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001fd31
cmp ebx, 5
jbe 0x1001fd3d
push 0
push 5
lea eax, [edi - 5]
add eax, esi
push str..smil
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fd3d
xor eax, eax
inc eax
mov byte [esp + 0x13], al
jmp 0x1001fe7c
cmp ebx, 7
jbe 0x1001fd76
push 0
push 3
push 0x1013b4bc
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fd76
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001fe29
cmp ebx, 8
jbe 0x1001fdb5
push 0
push 4
push str.ppt_
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fdb5
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fdb5
inc eax
mov byte [esp + 0x24], al
jmp 0x1001fe7c
cmp ebx, 9
jbe 0x1001fdf4
push 0
push 5
push str.word_
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fdf4
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fdf4
inc eax
mov byte [esp + 0x17], al
jmp 0x1001fe7c
cmp ebx, 0xa
jbe 0x1001fe32
push 0
push 6
push str.excel_
push ebp
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fe32
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fe32
xor eax, eax
inc eax
mov byte [esp + 0x12], al
jmp 0x1001fe7c
cmp ebx, 0xf
jbe 0x1001fe7c
mov eax, dword [esp + 0x2c]
push 0
push 0xb
add eax, edi
push str.powerpoint_
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001fe7c
push eax
push 4
lea eax, [edi - 4]
add eax, esi
push str..xml
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
mov ecx, dword [esp + 0x34]
add esp, 0x10
test eax, eax
movzx ecx, cl
push 1
pop eax
cmove ecx, eax
mov byte [esp + 0x24], cl
mov esi, dword [esp + 0x38]
mov ebp, 0x400
dec esi
inc esi
lea eax, [esi + 0x1e]
cmp eax, ebp
jl 0x1001fb74
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
cmp byte [esp + 0x15], 0
jne 0x1001ff26
mov al, byte [esp + 0x16]
mov cl, byte [esp + 0x14]
test al, al
jne 0x1001feb5
test cl, cl
je 0x1001feef
cmp byte [esp + 0x17], 0
je 0x1001fec3
mov edi, str.docx
jmp 0x1001ff2b
test al, al
jne 0x1001fecb
test cl, cl
je 0x1001feef
cmp byte [esp + 0x12], 0
je 0x1001fed9
mov edi, str.xlsx
jmp 0x1001ff2b
test al, al
jne 0x1001fee1
test cl, cl
je 0x1001feef
cmp byte [esp + 0x24], 0
je 0x1001feef
mov edi, str.pptx
jmp 0x1001ff2b
cmp byte [esp + 0x18], 0
jne 0x1001ff1f
cmp byte [esp + 0x19], 0
jne 0x1001ff1f
cmp byte [esp + 0x1a], 0
jne 0x1001ff26
cmp byte [esp + 0x1b], 0
je 0x1001ff2b
cmp byte [esp + 0x13], 0
mov edi, 0x1013b50c
mov eax, 0x1013b510
cmove edi, eax
jmp 0x1001ff2b
mov edi, 0x1013b3cc
jmp 0x1001ff2b
mov edi, 0x1013b4f0
test edx, edx
je 0x1001ff37
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret