Function at 0x1001dd92
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x364
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x360], eax
mov eax, dword [esp + 0x368]
or dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 0x37c]
mov edx, dword [esp + 0x380]
push ebx
mov ebx, dword [esp + 0x388]
push ebp
mov ebp, dword [esp + 0x390]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x378]
push esi
mov esi, dword [esp + 0x378]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x380]
push edi
mov dword [esp + 0x34], eax
xor edi, edi
mov eax, dword [esp + 0x388]
mov byte [esp + 0x1a], 0
mov dword [esp + 0x10], 1
mov byte [esp + 0x18], 1
mov byte [esp + 0x1b], 1
mov byte [esp + 0x19], 0
test eax, eax
je 0x1001de1e
and dword [eax], edi
test ecx, ecx
je 0x1001de24
and dword [ecx], edi
test edx, edx
je 0x1001de2b
mov byte [edx], 0
test ebx, ebx
je 0x1001de31
and dword [ebx], edi
test ebp, ebp
je 0x1001de38
and dword [ebp], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1001dee0
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x268]
push 0x106
push ecx
push ebx
push eax
call sym.CoreFoundation.dll_CFURLGetFileSystemRepresentation
add esp, 0x10
test al, al
je 0x1001dee0
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x26c]
push eax
call sym.CoreFoundation.dll__NS_stat
pop ecx
pop ecx
test eax, eax
jne 0x1001dee0
mov eax, dword [esp + 0x3e]
mov ecx, 0x8000
and eax, 0xf000
cmp ax, cx
jne 0x1001dee0
push 0x1ff
lea eax, [esp + 0x26c]
push 0x8080
push eax
call sym.CoreFoundation.dll__NS_open
add esp, 0xc
mov dword [esp + 0x20], eax
test eax, eax
js 0x1001dee0
push 0x200
lea ecx, [esp + 0x6c]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov edx, eax
mov byte [esp + 0x26], bl
mov eax, dword [esp + 0x58]
lea ebp, [esp + 0x74]
add esp, 0xc
mov dword [esp + 0x14], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
jmp 0x1001df1c
test esi, esi
je 0x1001eff2
push esi
call sym.CoreFoundation.dll_CFDataGetLength
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], eax
call sym.CoreFoundation.dll_CFDataGetBytePtr
mov edx, dword [esp + 0x1c]
mov ebp, eax
pop ecx
pop ecx
test edx, edx
mov dword [esp + 0x2c], eax
mov ecx, 0x1013b560
cmovne ecx, edi
mov edi, ecx
test ebp, ebp
je 0x1001eff2
push 6
pop ecx
cmp edx, 4
jl 0x1001e908
mov ebx, dword [ebp]
push 8
bswap ebx
mov dword [esp + 0x20], ebx
pop eax
mov dword [esp + 0x24], eax
test edi, edi
jne 0x1001df73
mov ecx, dword [0x1017547c]
mov eax, 0x1013a748
mov edx, edi
cmp eax, sym.CoreFoundation.dll_kCFBundleInfoDictionaryVersionKey
jge 0x1001df61
cmp dword [eax], ebx
mov edi, ecx
cmovne edi, edx
add eax, 4
add ecx, 5
test edi, edi
je 0x1001df47
test edi, edi
je 0x1001e39c
mov edx, dword [esp + 0x14]
push 8
pop eax
push 6
pop ecx
cmp ebx, 0xcafebabe
jne 0x1001df99
cmp edx, eax
jl 0x1001e185
xor eax, eax
cmp ax, word [ebp + 4]
je 0x1001e185
mov edi, str.class
jmp 0x1001e39c
cmp ebx, 0x7b5c7274
jne 0x1001dfb2
cmp edx, ecx
jl 0x1001e090
cmp byte [ebp + 4], 0x66
jmp 0x1001e17f
cmp ebx, 0x25504446
jne 0x1001dfcb
cmp edx, ecx
jl 0x1001e090
cmp byte [ebp + 4], 0x2d
jmp 0x1001e17f
cmp ebx, 0x10000
jne 0x1001dfe4
cmp edx, ecx
jl 0x1001e090
cmp byte [ebp + 4], 0
jmp 0x1001e17f
cmp ebx, 0x47494638
jne 0x1001e014
cmp edx, ecx
jl 0x1001e090
mov ax, word [ebp + 4]
mov ecx, 0x3761
rol ax, 8
movzx eax, ax
cmp cx, ax
je 0x1001e185
mov ecx, 0x3961
jmp 0x1001e050
cmp ebx, 0xc
jne 0x1001e024
cmp edx, ecx
jl 0x1001e090
mov ecx, 0x6a50
jmp 0x1001e048
cmp ebx, 0x2356524d
jne 0x1001e037
cmp edx, ecx
jl 0x1001e090
mov ecx, 0x4c20
jmp 0x1001e048
cmp ebx, 0x28445746
jne 0x1001e058
cmp edx, ecx
jl 0x1001e090
mov ecx, 0x2056
mov ax, word [ebp + 4]
rol ax, 8
cmp cx, ax
jmp 0x1001e17f
cmp ebx, 0x30373037
jne 0x1001e06a
cmp edx, ecx
jl 0x1001e090
cmp byte [ebp + 4], 0x30
jmp 0x1001e07a
cmp ebx, 0x41433130
jne 0x1001e097
cmp edx, ecx
jl 0x1001e090
cmp byte [ebp + 4], 0x31
jne 0x1001e090
movzx eax, byte [ebp + 5]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
jne 0x1001e185
xor edi, edi
jmp 0x1001e39c
cmp ebx, 0x89504e47
jne 0x1001e0b2
cmp edx, eax
jl 0x1001e090
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0xd0a1a0a
jmp 0x1001e17f
cmp ebx, 0x53747566
jne 0x1001e0cd
cmp edx, eax
jl 0x1001e090
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0x66497420
jmp 0x1001e17f
cmp ebx, 0x3026b275
jne 0x1001e0e8
cmp edx, eax
jl 0x1001e090
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0x8e66cf11
jmp 0x1001e17f
cmp ebx, 0x67696d70
jne 0x1001e100
cmp edx, eax
jl 0x1001e090
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0x20786366
jmp 0x1001e17f
cmp ebx, 0x424f4d53
jne 0x1001e118
cmp edx, eax
jl 0x1001e090
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0x746f7265
jmp 0x1001e17f
cmp ebx, 0x49544f4c
jne 0x1001e134
cmp edx, eax
jl 0x1001e090
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0x49544c53
jmp 0x1001e17f
cmp ebx, 0x72746664
jne 0x1001e14d
cmp edx, eax
jl 0x1001e090
mov eax, dword [ebp + 4]
bswap eax
test eax, eax
jmp 0x1001e17f
cmp ebx, 0x3d796265
jne 0x1001e1a8
cmp edx, 0xc
jl 0x1001e090
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0x67696e20
jne 0x1001e090
mov eax, dword [ebp + 8]
bswap eax
cmp eax, 0x6c696e65
je 0x1001e185
cmp eax, 0x70617274
jne 0x1001e090
mov edx, dword [esp + 0x14]
lea esi, [ebp + 4]
cmp ebx, 0x504b0304
jne 0x1001e1d6
push dword [esp + 0x28]
push edx
push ebp
push dword [esp + 0x2c]
call fcn.1001f6a4
jmp 0x1001e2d2
cmp ebx, 0x63616666
jne 0x1001e185
cmp edx, 0xc
jl 0x1001e090
lea esi, [ebp + 4]
cmp byte [esi], 0
jne 0x1001e090
mov eax, dword [ebp + 8]
bswap eax
cmp eax, 0x64657363
je 0x1001e18c
jmp 0x1001e090
cmp ebx, 0x25215053
jne 0x1001e232
cmp edx, 0xb
jl 0x1001e206
push 7
push str._Adobe_
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1001e202
mov edi, 0x1013b570
jmp 0x1001e39c
mov edx, dword [esp + 0x14]
cmp edx, 0xe
jl 0x1001e090
push 0xa
push str._AdobeFont
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1001e090
mov edi, 0x1013b584
jmp 0x1001e39c
cmp ebx, 0x464f524d
jne 0x1001e270
xor edi, edi
cmp edx, 0xc
jl 0x1001e39c
mov eax, dword [ebp + 8]
bswap eax
cmp eax, 0x41494646
jne 0x1001e25b
mov edi, str.aiff
jmp 0x1001e39c
cmp eax, 0x414946
jne 0x1001e39c
mov edi, str.aifc
jmp 0x1001e39c
cmp ebx, 0x52494646
jne 0x1001e2ae
xor edi, edi
cmp edx, 0xc
jl 0x1001e39c
mov eax, dword [ebp + 8]
bswap eax
cmp eax, 0x57415645
jne 0x1001e299
mov edi, 0x1013b598
jmp 0x1001e39c
cmp eax, 0x41564920
jne 0x1001e39c
mov edi, 0x1013b59c
jmp 0x1001e39c
cmp ebx, 0xd0cf11e0
jne 0x1001e2dc
cmp edx, 0x34
jl 0x1001e39c
mov eax, dword [ebp + 0x30]
inc eax
shl eax, 9
push eax
push edx
push ebp
push dword [esp + 0x2c]
call fcn.1001f508
add esp, 0x10
mov edi, eax
jmp 0x1001e39c
cmp ebx, 0x62656769
jne 0x1001e39c
xor edi, edi
cmp edx, 0x4c
jl 0x1001e39c
cmp byte [esi], 0x6e
jne 0x1001e39c
cmp byte [ebp + 5], 0x20
jne 0x1001e39c
movzx eax, byte [ebp + 6]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
push eax
call esi
pop ecx
test eax, eax
je 0x1001e39c
movzx eax, byte [ebp + 7]
push eax
call esi
pop ecx
test eax, eax
je 0x1001e39c
movzx eax, byte [ebp + 8]
push eax
call esi
pop ecx
test eax, eax
je 0x1001e39c
cmp byte [ebp + 9], 0x20
jne 0x1001e39c
mov ebx, dword [esp + 0x14]
xor ecx, ecx
push 0xa
pop edx
cmp edx, ebx
jge 0x1001e357
cmp byte [edx + ebp], 0xa
mov eax, edx
cmovne eax, ecx
inc edx
mov ecx, eax
test ecx, ecx
je 0x1001e343
mov ebx, dword [esp + 0x1c]
cmp ecx, 0xa
jl 0x1001e39c
lea ebx, [ecx + 0x3e]
cmp ebx, dword [esp + 0x14]
jge 0x1001e398
cmp byte [ecx + ebp + 1], 0x4d
jne 0x1001e398
cmp byte [ecx + ebp + 0x3e], 0xa
jne 0x1001e398
mov edi, 0x1013b5a0
lea esi, [ecx + 1]
cmp esi, ebx
jge 0x1001e398
movzx eax, byte [esi + ebp]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isprint]
neg eax
pop ecx
sbb eax, eax
inc esi
and edi, eax
jne 0x1001e37f
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x1001f01e
mov edx, dword [esp + 0x14]
test edi, edi
jne 0x1001e908
mov ax, word [ebp]
rol ax, 8
movzx esi, ax
cmp edx, 5
jl 0x1001e3fc
cmp byte [ebp + 3], 0
jne 0x1001e3fc
cmp byte [ebp + 4], 0
jne 0x1001e3fc
mov cl, byte [ebp + 1]
cmp cl, byte [esp + 0x10]
jne 0x1001e3e1
mov al, byte [ebp + 2]
and al, 0xf7
cmp al, 1
je 0x1001e3f2
test cl, cl
jne 0x1001e3fc
mov al, byte [ebp + 2]
and al, 0xf7
cmp al, 2
je 0x1001e3f2
cmp al, 3
jne 0x1001e3fc
mov edi, 0x1013b5a4
jmp 0x1001e908
cmp edx, 8
jl 0x1001e516
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0x6d6f6f76
je 0x1001e508
cmp eax, 0x6d646174
je 0x1001e508
cmp eax, 0x77696465
je 0x1001e508
cmp eax, 0x69647363
je 0x1001e4fe
cmp eax, 0x69646174
je 0x1001e4fe
cmp eax, 0x424f424f
jne 0x1001e452
mov edi, 0x1013b5b4
jmp 0x1001e908
cmp ebx, 0x62706c69
jne 0x1001e516
mov ax, word [ebp + 4]
mov ecx, 0x7374
rol ax, 8
cmp cx, ax
jne 0x1001e516
movzx eax, byte [ebp + 6]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x1001e512
movzx eax, byte [ebp + 7]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x1001e512
push 0x10
pop ebx
push 8
lea esi, [ebp + 8]
sub ebx, ebp
mov ebp, dword [esp + 0x18]
pop eax
cmp eax, 0x80
jge 0x1001e4e0
lea eax, [ebx + esi]
cmp eax, ebp
jg 0x1001e4e0
push 0xf
push str.WebMainResource
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
mov ecx, str.webarchive
test eax, eax
mov eax, dword [esp + 0x24]
cmovne ecx, edi
inc eax
mov edi, ecx
mov dword [esp + 0x24], eax
inc esi
test edi, edi
je 0x1001e4a7
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test edi, edi
jne 0x1001e90c
mov edi, 0x1013b5dc
jmp 0x1001e90c
mov edi, str.qtif
jmp 0x1001e908
mov edi, 0x1013b5a8
jmp 0x1001e908
mov edx, dword [esp + 0x14]
xor eax, eax
push 0x12
pop ebx
cmp ax, si
jne 0x1001e669
cmp edx, 0xc
jl 0x1001e6a1
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0x66747970
jne 0x1001e6a1
mov ecx, dword [ebp + 8]
bswap ecx
cmp ecx, 0x6d703431
je 0x1001e65f
cmp ecx, 0x6d703432
je 0x1001e65f
cmp ecx, 0x69736f6d
je 0x1001e65f
cmp ecx, 0x69736f32
je 0x1001e65f
cmp ecx, 0x4d344120
jne 0x1001e584
mov edi, 0x1013b5e8
jmp 0x1001e908
cmp ecx, 0x4d344220
jne 0x1001e596
mov edi, 0x1013b5ec
jmp 0x1001e908
cmp ecx, 0x4d345020
jne 0x1001e5a8
mov edi, 0x1013b5f0
jmp 0x1001e908
cmp ecx, 0x4d345620
je 0x1001e655
cmp ecx, 0x4d345648
je 0x1001e655
cmp ecx, 0x4d345650
je 0x1001e655
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0x33670000
jne 0x1001e908
movzx eax, cx
mov ecx, 0x6536
cmp cx, ax
je 0x1001e64b
inc ecx
cmp cx, ax
je 0x1001e64b
mov ecx, 0x6736
cmp cx, ax
je 0x1001e64b
mov ecx, 0x7034
cmp cx, ax
je 0x1001e64b
inc ecx
cmp cx, ax
je 0x1001e64b
mov ecx, 0x7036
cmp cx, ax
je 0x1001e64b
mov ecx, 0x7236
cmp cx, ax
je 0x1001e64b
mov ecx, 0x7336
cmp cx, ax
je 0x1001e64b
inc ecx
cmp cx, ax
je 0x1001e64b
mov ecx, 0x3261
cmp cx, ax
mov ecx, dword [esp + 0x10]
jne 0x1001e90c
mov edi, 0x1013b5fc
jmp 0x1001e90c
mov edi, 0x1013b5f8
jmp 0x1001e908
mov edi, 0x1013b5f4
jmp 0x1001e908
mov edi, 0x1013b5e4
jmp 0x1001e908
mov eax, 0x424d
cmp ax, si
jne 0x1001e6a1
cmp edx, ebx
jl 0x1001e6a1
mov eax, dword [ebp + 0xe]
cmp eax, 0x28
je 0x1001e697
cmp eax, 0xc
je 0x1001e697
cmp eax, 0x40
je 0x1001e697
cmp eax, 0x6c
je 0x1001e697
cmp eax, 0x7c
jne 0x1001e908
mov edi, 0x1013b600
jmp 0x1001e908
cmp edx, 0x14
jl 0x1001e6cc
push 0xe
lea eax, [ebp + 6]
push str.__PS_AdobeFont
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
mov edx, dword [esp + 0x20]
add esp, 0xc
test eax, eax
jne 0x1001e6cc
mov edi, 0x1013b618
jmp 0x1001e908
cmp edx, 0x28
jl 0x1001e6f9
mov eax, dword [ebp + 0x22]
bswap eax
cmp eax, 0x42696e48
jne 0x1001e6f9
mov ax, word [ebp + 0x26]
mov ecx, 0x6578
rol ax, 8
cmp cx, ax
jne 0x1001e6f9
mov edi, 0x1013b61c
jmp 0x1001e908
cmp edx, 0x80
jl 0x1001e7a6
mov eax, dword [ebp + 0x66]
bswap eax
cmp eax, 0x6d42494e
jne 0x1001e71b
mov edi, 0x1013b620
jmp 0x1001e908
cmp byte [ebp], 0
jne 0x1001e7a6
mov al, byte [ebp + 1]
dec al
cmp al, 0x3e
ja 0x1001e7a6
cmp byte [ebp + 0x4a], 0
jne 0x1001e7a6
cmp byte [ebp + 0x52], 0
jne 0x1001e7a6
mov ebx, dword [esp + 0x28]
mov eax, ebx
and eax, 0x8000007f
jns 0x1001e74e
dec eax
or eax, 0xffffff80
add eax, 1
jne 0x1001e7a3
mov esi, dword [ebp + 0x57]
mov edx, dword [ebp + 0x53]
bswap esi
bswap edx
lea ecx, [esi + 0x7f]
shr ecx, 7
lea eax, [edx + 0x7f]
inc ecx
shr eax, 7
add eax, ecx
mov ecx, 0x800000
cmp edx, ecx
jae 0x1001e904
cmp esi, ecx
mov ecx, dword [esp + 0x10]
jae 0x1001eb0b
cmp eax, ecx
jbe 0x1001eb0b
mov edx, dword [esp + 0x14]
shl eax, 7
cmp eax, ebx
jne 0x1001e90c
mov edi, 0x1013b620
jmp 0x1001e90c
push 0x12
pop ebx
cmp edx, 0x109
jl 0x1001e7eb
mov eax, dword [ebp + 0x101]
bswap eax
cmp eax, 0x75737461
jne 0x1001e7eb
mov eax, dword [ebp + 0x105]
bswap eax
cmp eax, 0x72202000
je 0x1001e7e1
mov ax, word [ebp + 0x105]
mov ecx, 0x7200
rol ax, 8
cmp cx, ax
jne 0x1001e7eb
mov edi, 0x1013b624
jmp 0x1001e908
mov eax, 0xfeff
cmp ax, si
je 0x1001eaad
mov eax, 0xfffe
cmp ax, si
je 0x1001eaad
mov eax, 0x1f9d
cmp ax, si
jne 0x1001e81b
mov edi, 0x1013b630
jmp 0x1001e908
mov eax, 0x1f8b
cmp ax, si
jne 0x1001e82f
mov edi, 0x1013b634
jmp 0x1001e908
mov eax, 0x71c7
cmp ax, si
je 0x1001eaa3
mov eax, 0xc771
cmp ax, si
je 0x1001eaa3
mov eax, 0xf702
cmp ax, si
jne 0x1001e85f
mov edi, 0x1013b640
jmp 0x1001e908
mov eax, 0x1da
cmp ax, si
jne 0x1001e890
mov al, byte [ebp + 2]
mov ecx, dword [esp + 0x10]
test al, al
je 0x1001e87c
cmp al, cl
jne 0x1001ea7d
mov al, byte [ebp + 3]
dec al
cmp al, 0xe
ja 0x1001ea7d
mov edi, 0x1013b644
jmp 0x1001e90c
mov eax, 0x2321
cmp ax, si
jne 0x1001e98b
xor edx, edx
xor esi, esi
push 2
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x18]
pop ecx
cmp ecx, esi
jge 0x1001e8c1
cmp byte [ecx + ebp], 0xa
mov eax, ecx
cmovne eax, edx
inc ecx
mov edx, eax
test edx, edx
je 0x1001e8ad
mov esi, dword [esp + 0x24]
cmp edx, 3
jle 0x1001e904
lea ecx, [edx - 1]
cmp ecx, dword [esp + 0x10]
jle 0x1001e8e3
cmp byte [ecx + ebp], 0x2f
mov eax, ecx
cmovne eax, esi
dec ecx
mov esi, eax
test esi, esi
je 0x1001e8cd
test esi, esi
jle 0x1001e904
push 4
inc esi
add esi, ebp
push str.perl
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1001e94a
mov edi, 0x1013b650
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x30], 0
je 0x1001f01e
test edi, edi
jne 0x1001ef06
cmp byte [ebp], 0xef
jne 0x1001eb14
cmp byte [ebp + 1], 0xbb
jne 0x1001eb14
cmp byte [ebp + 2], 0xbf
jne 0x1001eb14
xor bl, bl
mov al, cl
mov byte [esp + 0x18], bl
jmp 0x1001eb1c
push 6
push str.python
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1001e966
mov edi, 0x1013b65c
jmp 0x1001e904
push 4
push str.ruby
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
mov edi, 0x1013b668
test eax, eax
mov ecx, 0x1013b66c
cmovne edi, ecx
jmp 0x1001e904
mov eax, 0xffd8
cmp ax, si
jne 0x1001e9a9
cmp byte [ebp + 2], 0xff
jne 0x1001ea7d
mov edi, str.jpeg
jmp 0x1001e908
mov eax, 0x4657
cmp ax, si
jne 0x1001e9c7
cmp byte [ebp + 2], 0x53
jne 0x1001ea7d
mov edi, 0x1013b678
jmp 0x1001e908
mov eax, 0x4357
cmp ax, si
jne 0x1001e9e5
cmp byte [ebp + 2], 0x53
jne 0x1001ea7d
mov edi, 0x1013b67c
jmp 0x1001e908
mov eax, 0x4944
cmp ax, si
jne 0x1001ea09
cmp byte [ebp + 2], 0x33
jne 0x1001ea7d
cmp byte [ebp + 3], 0x20
jae 0x1001ea7d
mov edi, 0x1013b680
jmp 0x1001e908
mov eax, 0x425a
cmp ax, si
jne 0x1001ea7d
movzx eax, byte [ebp + 2]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x1001ea3d
movzx eax, byte [ebp + 3]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x1001ea3d
mov edi, 0x1013b684
jmp 0x1001e904
cmp byte [ebp + 2], 0x68
jne 0x1001ea79
movzx eax, byte [ebp + 3]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
mov edx, dword [esp + 0x18]
pop ecx
test eax, eax
je 0x1001ea7d
cmp edx, 8
jl 0x1001ea7d
mov eax, dword [ebp + 4]
bswap eax
cmp eax, 0x31415926
je 0x1001ea6f
cmp eax, 0x17724538
jne 0x1001ea7d
mov edi, 0x1013b688
jmp 0x1001e908
mov edx, dword [esp + 0x14]
mov ax, word [ebp + 2]
rol ax, 8
push 0x11
movzx eax, ax
pop ecx
cmp cx, ax
je 0x1001ea99
cmp bx, ax
jne 0x1001e908
mov edi, 0x1013b68c
jmp 0x1001e908
mov edi, str.cpio
jmp 0x1001e908
mov edi, 0x1013b560
cmp edx, 0xc
jl 0x1001e908
cmp dword [ebp], 0x3cfeff
jne 0x1001eada
cmp dword [ebp + 4], 0x740068
jne 0x1001e908
cmp dword [ebp + 8], 0x6c006d
je 0x1001eb01
cmp dword [ebp], 0xfffe3c00
jne 0x1001e908
cmp dword [ebp + 4], 0x68007400
jne 0x1001e908
cmp dword [ebp + 8], 0x6d006c00
jne 0x1001e908
mov edi, str.html
jmp 0x1001e908
mov edx, dword [esp + 0x14]
jmp 0x1001e90c
mov al, byte [esp + 0x19]
mov bl, byte [esp + 0x18]
xor esi, esi
test al, al
push 3
pop eax
cmovne esi, eax
test cl, cl
jne 0x1001eb32
test bl, bl
je 0x1001ee24
test edi, edi
jne 0x1001ef06
cmp esi, edx
jge 0x1001ee2c
cmp esi, 0x200
jge 0x1001ee2c
mov al, byte [esi + ebp]
mov byte [esp + 0x1c], al
test cl, cl
je 0x1001eb8e
cmp al, 0x3c
jne 0x1001eb8e
lea eax, [esi + 0xe]
cmp eax, edx
jg 0x1001eb8a
push edi
push 0xd
lea eax, [ebp + 1]
add eax, esi
push str._doctype_html
push eax
call sym.CoreFoundation.dll__NS_strncasecmp_l
mov edx, dword [esp + 0x24]
add esp, 0x10
test eax, eax
mov ecx, str.html
cmovne ecx, edi
mov edi, ecx
mov al, byte [esp + 0x1c]
cmp byte [esp + 0x1b], 0
je 0x1001edc1
cmp al, 0x3c
jne 0x1001edc1
lea eax, [esi + 0xe]
cmp eax, edx
jg 0x1001edc1
push 0
push 0xd
lea ebx, [ebp + 1]
add ebx, esi
push str._doctype_html
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001edbc
push 0
push 4
push str.head
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001edbc
push 0
push 5
push str.title
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001edbc
push 0
push 6
push str.script
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001edbc
push 0
push 4
push str.html
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
je 0x1001edbc
push 0
push 4
push str._xml
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001edc1
add esi, 4
test edi, edi
jne 0x1001edc1
cmp esi, 0x80
jge 0x1001edb1
lea eax, [esi + 0x14]
cmp eax, dword [esp + 0x14]
jg 0x1001edb1
cmp byte [esi + ebp], 0x3c
jne 0x1001eda8
push 0
push 7
lea ebx, [ebp + 1]
add ebx, esi
push str.abiword
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001eca0
mov edi, 0x1013b6cc
jmp 0x1001eda8
push 0
push 0xc
push str._doctype_svg
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001ecc0
mov edi, 0x1013b6e0
jmp 0x1001eda8
push 0
push 0xc
push str._doctype_rdf
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001ece0
mov edi, 0x1013b6f4
jmp 0x1001eda8
push 0
push 0xc
push str._doctype_x3d
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001ed00
mov edi, 0x1013b708
jmp 0x1001eda8
push 0
push 0xd
push str._doctype_html
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001ed20
mov edi, str.html
jmp 0x1001eda8
push 0
push 0x13
push str._doctype_posingfont
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001ed3d
mov edi, str.sfont
jmp 0x1001eda8
push 0
push 0xe
push str._doctype_plist
push ebx
call sym.CoreFoundation.dll__NS_strncasecmp_l
add esp, 0x10
test eax, eax
jne 0x1001eda8
add esi, 0xe
test edi, edi
jne 0x1001eda8
lea ebx, [esi + ebp]
push 0x10
pop ebp
sub ebp, dword [esp + 0x2c]
cmp esi, 0x100
jge 0x1001ed98
lea eax, [ebx + ebp]
cmp eax, dword [esp + 0x14]
jg 0x1001ed98
push 0xf
push str.WebMainResource
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
mov ecx, str.webarchive
test eax, eax
cmovne ecx, edi
inc esi
mov edi, ecx
inc ebx
test edi, edi
je 0x1001ed64
mov ebp, dword [esp + 0x2c]
test edi, edi
mov eax, 0x1013b5dc
cmovne eax, edi
mov edi, eax
inc esi
test edi, edi
je 0x1001ec58
test edi, edi
jne 0x1001edc1
mov edi, 0x1013b740
jmp 0x1001edc1
mov edi, str.html
mov dl, byte [esp + 0x1c]
xor ecx, ecx
movzx eax, byte [esp + 0x18]
test dl, dl
cmove ecx, eax
mov bl, cl
mov byte [esp + 0x18], bl
test bl, bl
jne 0x1001edf5
cmp dl, 0x7f
jge 0x1001edf5
cmp dl, 0x20
jge 0x1001ee01
push dword [esp + 0x1c]
call fcn.1002128a
add esp, 4
test al, al
jne 0x1001ee01
xor cl, cl
mov dword [esp + 0x10], ecx
test bl, bl
jne 0x1001ee15
jmp 0x1001ee05
mov ecx, dword [esp + 0x10]
push dword [esp + 0x1c]
call fcn.1002128a
add esp, 4
test al, al
jne 0x1001ee1a
mov byte [esp + 0x1b], 0
mov edx, dword [esp + 0x14]
inc esi
jmp 0x1001eb26
test edi, edi
jne 0x1001ef06
test cl, cl
je 0x1001ee5e
cmp edx, 0x10
jl 0x1001ee54
push 0x10
push str.StartFontMetrics
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1001ee54
mov edi, 0x1013b758
jmp 0x1001ef06
mov edi, 0x1013b560
jmp 0x1001ef06
test bl, bl
je 0x1001ef02
mov esi, 0x200
cmp edx, esi
jl 0x1001ef02
lea eax, [esi + 0xe]
cmp dword [esp + 0x28], eax
jl 0x1001ef02
cmp byte [esp + 0x1a], 0
je 0x1001eee7
mov ebx, dword [esp + 0x20]
push 0
push esi
push ebx
call sym.CoreFoundation.dll__NS_lseek
add esp, 0xc
cmp eax, esi
jne 0x1001ef02
push esi
lea eax, [esp + 0x6c]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
cmp eax, 0xe
jl 0x1001ef02
mov ecx, dword [esp + 0x72]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
cmp edx, 0x1102ff
jne 0x1001ef02
mov edi, str.pict
jmp 0x1001ef02
cmp edx, eax
jl 0x1001ef02
mov eax, dword [ebp + 0x20a]
mov ecx, str.pict
bswap eax
cmp eax, 0x1102ff
cmovne ecx, edi
mov edi, ecx
test edi, edi
je 0x1001ef1b
push 0x1013b688
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x1001eff2
mov ecx, dword [esp + 0x14]
mov edx, 0x200
cmp ecx, edx
jl 0x1001eff2
mov eax, dword [esp + 0x28]
cmp eax, edx
jl 0x1001eff2
cmp byte [esp + 0x1a], 0
je 0x1001efc3
mov ebx, dword [esp + 0x20]
lea esi, [eax - 0x200]
push 0
push esi
push ebx
call sym.CoreFoundation.dll__NS_lseek
add esp, 0xc
cmp eax, esi
jne 0x1001eff2
mov ebp, 0x200
lea eax, [esp + 0x68]
push ebp
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
cmp eax, ebp
jl 0x1001eff2
mov ecx, dword [esp + 0x68]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
cmp edx, 0x6b6f6c79
je 0x1001efed
mov eax, dword [esp + 0x260]
bswap eax
cmp eax, 0x63647361
jne 0x1001eff2
mov eax, dword [esp + 0x264]
jmp 0x1001efe4
mov eax, dword [ecx + ebp - 0x200]
bswap eax
cmp eax, 0x6b6f6c79
je 0x1001efed
mov eax, dword [ecx + ebp - 8]
bswap eax
cmp eax, 0x63647361
jne 0x1001eff2
mov eax, dword [ecx + ebp - 4]
bswap eax
cmp eax, 0x656e6372
jne 0x1001eff2
mov edi, 0x1013b764
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x1001f01e
test edi, edi
je 0x1001f01a
push dword [sym.CoreFoundation.dll_kCFAllocatorNull]
push 0x8000100
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCStringNoCopy
add esp, 0x10
jmp 0x1001f01c
xor eax, eax
mov dword [ebx], eax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x1001f029
and dword [eax], 0
mov eax, dword [esp + 0x20]
test eax, eax
js 0x1001f039
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
pop ecx
mov ecx, dword [esp + 0x370]
test edi, edi
pop edi
pop esi
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x364
ret