Function at 0x10002804
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
je 0x10002a0e
push 2
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0xc], 0xbd43dbfe
je 0x1000288f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10002a0e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
push 2
push ebx
push 0xfffffffffffffff8
push dword [ebp + 8]
call esi
lea eax, [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push eax
lea eax, [ebp - 4]
push 4
push eax
push dword [ebp + 8]
call edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
cmp ecx, eax
ja 0x1000290d
push 2
push ebx
neg ecx
push ecx
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [ebp - 0x10], eax
jne 0x10002915
push dword [ebp + 8]
jmp 0x10002884
lea ecx, [ebp - 8]
push ebx
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff8
push ecx
push eax
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 4]
mov esi, 0x8c
add eax, 0xfffffff8
xor edx, edx
mov ecx, esi
div ecx
test eax, eax
jle 0x1000296f
mov eax, dword [ebp - 0x10]
mov edi, 0x10005038
mov dword [ebp - 0x14], eax
push edi
call sub.MSVCRT.dll_strlen
push eax
push edi
push esi
push dword [ebp - 0x14]
call fcn.10002d28
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0xfffffff8
mov ecx, esi
div ecx
add dword [ebp - 0x14], esi
add esp, 0x14
inc ebx
cmp ebx, eax
jl 0x10002947
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x18], 0
cmp dword [eax], 0xffffffff
jne 0x100029c5
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
mov ecx, 0x8c
div ecx
jmp 0x10002ac5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
push 9
lea eax, [ebp - 0x2c]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 0x10
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x10002a15
xor eax, eax
jmp 0x10002ac5
mov eax, dword [ebp - 4]
mov ebx, 0x8c
add eax, 0xfffffff8
xor edx, edx
mov ecx, ebx
and dword [ebp - 0x14], 0
div ecx
test eax, eax
jle 0x10002a8b
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
mov dword [ebp + 8], eax
mov dword [ebp - 0x1c], esi
lea eax, [esi + 0x84]
push 8
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 0x14
test eax, eax
jne 0x10002a6f
mov edi, dword [ebp + 8]
inc dword [ebp - 0x18]
add dword [ebp + 8], ebx
push 0x23
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0xfffffff8
mov ecx, ebx
div ecx
mov esi, dword [ebp - 0x1c]
inc dword [ebp - 0x14]
add esi, ebx
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x14], eax
jl 0x10002a3a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
push dword [ebp - 0x10]
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp - 0x20]
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret