Function at 0x10009ac3
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push dword [0x10003828]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x10003838]
mov ebx, eax
push dword [0x10003864]
mov dword [esp + 0x1c], ebx
mov eax, dword [ecx + 0x101a4]
mov dword [esp + 0x20], eax
call eax
push dword [0x10003864]
mov esi, eax
push esi
call fcn.10009a8f
add esp, 0xc
xor ebp, ebp
push 0x104
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [str.beggarman.gz]
mov eax, ebp
cmp word [esi], bp
je 0x10009b28
inc eax
cmp word [esi + eax*2], bp
jne 0x10009b21
push 0x5c
pop edi
jmp 0x10009b34
xor edx, edx
mov word [esi + eax*2], dx
dec eax
cmp word [esi + eax*2 - 2], di
jne 0x10009b2d
cmp byte [ecx], 0
je 0x10009b5a
mov bl, byte [ecx]
lea edx, [esi + eax*2]
movsx ax, bl
inc ecx
mov word [edx], ax
lea edx, [edx + 2]
mov bl, byte [ecx]
test bl, bl
jne 0x10009b45
mov ebx, dword [esp + 0x18]
push ebp
push 0x80
push 3
push ebp
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009ccc
push dword [0x1000382c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push edi
call eax
push dword [0x10003834]
mov esi, eax
call dword [esp + 0x20]
push dword [0x10003834]
mov ebx, eax
push ebx
call fcn.10009a8f
add esp, 0xc
mov dword [esp + 0x14], ebp
lea eax, [esp + 0x14]
push ebp
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10009ccc
mov eax, dword [esp + 0x14]
add eax, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [0x1000384c]
add ebx, eax
mov ecx, dword [ebx]
lea eax, [ebx + 4]
mov edx, dword [eax]
add eax, 4
test ecx, ecx
je 0x10009beb
add dword [eax], edx
lea eax, [eax + 4]
sub ecx, 1
jne 0x10009be1
mov eax, dword [0x10003868]
add ebx, eax
mov ebp, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebx + 1]
push eax
push ebp
call esi
mov edi, eax
test edi, edi
je 0x10009ccc
movsx ecx, byte [ebx]
add ebx, ecx
lea ecx, [ebx + 1]
push ecx
push ebp
call esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x10009ccc
movsx ecx, byte [ebx]
add ebx, ecx
lea ecx, [ebx + 1]
push ecx
call edi
mov edx, eax
test edx, edx
je 0x10009ccc
mov eax, dword [edx + 0x3c]
movsx ecx, byte [ebx]
mov edi, dword [eax + edx + 0x2c]
lea eax, [esp + 0x10]
mov ebp, dword [ebx + ecx + 4]
lea esi, [ecx + 0xc]
push eax
push 0x40
add esi, ebx
add edi, edx
mov ebx, dword [ebx + ecx + 8]
and dword [esp + 0x18], 0
push ebx
push edi
call dword [esp + 0x28]
push ebx
push esi
push edi
call fcn.10009a50
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebx
push edi
call dword [esp + 0x28]
mov eax, dword [str.barrenwort.vcf]
xor ecx, ecx
add edi, ebp
cmp byte [eax], cl
je 0x10009caa
mov edx, dword [esp + 0x1c]
mov eax, dword [str.barrenwort.vcf]
movsx ax, byte [eax + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [str.barrenwort.vcf]
cmp byte [eax + ecx], 0
jne 0x10009c90
mov eax, dword [esp + 0x1c]
xor edx, edx
mov word [eax + ecx*2], dx
mov dword [esp + 0x24], eax
lea eax, [ebx + esi]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x2c], 1
call edi
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret