Function at 0x10138e60
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
movsd qword [esp + 0x48], xmm0
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x38], xmm2
jmp 0x10138ea4
mov dword [esp + 0x58], esi
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
xor edi, edi
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x7c], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x78], edx
mov dword [esp + 0x60], eax
add eax, 4
xor edx, edx
mov dword [esp + 0x74], eax
cmp esi, ecx
jb 0x10138fc6
mov dword [esp + 0x1c], esi
mov dword [esp + 8], edi
mov edi, edx
lea esi, [esp + 0x80]
mov dword [esp + 0x24], ecx
jmp 0x10138f34
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
push ebx
call fcn.1017dcb0
add esp, 4
cmp al, 0x23
jne 0x10138fb0
xorps xmm0, xmm0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
movaps xmmword [esp + 0x80], xmm0
mov dword [esp + 0x90], eax
push 0x10178660
push esi
push dword [esp + 0x84]
push dword [esp + 0x6c]
push dword [esp + 0x88]
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x10138f20
nop word cs:[eax + eax]
nop dword [eax]
push 1
push 0xffffffffffffffff
call sub.KERNEL32.dll_SleepEx
cmp dword [esp + 0x2c], 0
je 0x10138f80
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x10138f27
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
cmp eax, ecx
cmovbe eax, ecx
mov dword [esp + 0x20], eax
jmp 0x10138fbe
movzx eax, al
cmp eax, 0xb
jne 0x101391c0
xor ecx, ecx
mov edx, edi
mov edi, dword [esp + 8]
xor esi, esi
mov eax, esi
mov eax, dword [esp + 0x60]
mov ebx, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], ecx
sub ebx, esi
cmp ebx, 8
lea esi, [eax + esi]
jae 0x10139010
test ebx, ebx
je 0x101390d0
xor ecx, ecx
nop word [eax + eax]
cmp byte [esi + ecx], 0xa
je 0x10139123
inc ecx
cmp ebx, ecx
jne 0x10138ff0
jmp 0x101390d0
lea eax, [esi + 3]
mov dword [esp + 0x5c], edx
and eax, 0xfffffffc
sub eax, esi
je 0x10139050
je 0x10139050
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax]
cmp byte [esi + ecx], 0xa
je 0x1013911f
inc ecx
cmp eax, ecx
jne 0x10139030
lea ecx, [ebx - 8]
mov dword [esp + 8], edi
cmp eax, ecx
mov dword [esp + 0xc], ecx
jbe 0x1013905d
jmp 0x101390b4
lea eax, [ebx - 8]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x74]
add edx, ecx
nop word [eax + eax]
mov edi, dword [edx + eax - 4]
mov ecx, edi
xor edi, 0xa0a0a0a
not ecx
add edi, 0xfefefeff
and edi, ecx
test edi, 0x80808080
jne 0x101390b4
mov ecx, dword [edx + eax]
mov edi, ecx
xor ecx, 0xa0a0a0a
not edi
add ecx, 0xfefefeff
and ecx, edi
test ecx, 0x80808080
jne 0x101390b4
add eax, 8
cmp eax, dword [esp + 0xc]
jbe 0x10139070
mov edx, dword [esp + 0x5c]
mov edi, dword [esp + 8]
cmp ebx, eax
je 0x101390d0
cmp byte [esi + eax], 0xa
je 0x101391ae
inc eax
cmp ebx, eax
jne 0x101390c0
nop
mov eax, dword [esp + 0x14]
sub eax, edx
cmp eax, ebx
jae 0x10139100
lea ecx, [esp + 0x10]
push ebx
call fcn.1013e8f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
jmp 0x10139104
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
add eax, edx
push ebx
push esi
push eax
mov esi, edx
call sub.msvcrt.dll_memcpy
mov edx, esi
add esp, 0xc
add edx, ebx
xor eax, eax
jmp 0x10139181
mov edx, dword [esp + 0x5c]
cmp ecx, 0xffffffff
je 0x101394c8
lea eax, [ecx + 1]
cmp ecx, ebx
mov dword [esp + 0xc], eax
jae 0x1013949c
mov eax, dword [esp + 0x14]
sub eax, edx
cmp eax, ecx
jbe 0x1013914f
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0xc]
jmp 0x10139168
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebx
call fcn.1013e8f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add eax, edx
push ebx
push esi
push eax
mov esi, edx
call sub.msvcrt.dll_memcpy
mov edx, esi
add esp, 0xc
add edx, ebx
mov al, 1
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], 0
add esi, ebx
cmp esi, ecx
cmovae esi, ecx
add edi, ebx
test al, al
mov al, 4
jne 0x101391d4
test ebx, ebx
jne 0x10138ef7
jmp 0x101391d4
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x1013912c
jmp 0x101394c8
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov al, 1
mov edx, edi
mov edi, ebx
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x40], esi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x44], ecx
mov dword [esp + 8], edi
mov dword [esp + 0x48], eax
push edx
push esi
lea eax, [esp + 0x88]
push eax
mov edi, edx
call fcn.1002ad90
add esp, 0xc
cmp dword [esp + 0x80], 0
mov ecx, 0
cmovne edi, ecx
mov ecx, dword [esp + 0xc]
sete al
or al, cl
je 0x10139250
mov edx, edi
test cl, cl
mov dword [esp + 0x18], edi
je 0x10139410
mov ecx, dword [esp + 8]
movzx eax, bl
xor ebx, ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0
cmp dword [esp + 0x14], 0
jne 0x10139276
jmp 0x10139289
xor ebx, ebx
mov ecx, 0x103879e4
mov dword [esp + 0x18], 0
mov dword [esp + 0x54], 2
mov dword [esp + 0x58], 0
cmp dword [esp + 0x14], 0
je 0x10139289
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
mov esi, ecx
call sub.KERNEL32.dll_HeapFree
mov ecx, esi
test bl, bl
jne 0x10139472
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
test esi, esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
je 0x10139469
movsd xmm0, qword [esp + 0x64]
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x70], ecx
movsd qword [esp + 0x10], xmm0
cmp eax, 0xe
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x10]
jb 0x10139310
push 0xd
push str.POWERSHELL_
push eax
push ecx
lea eax, [esp + 0x90]
push eax
call fcn.1002b3c0
add esp, 0x14
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x80]
call fcn.1013f140
cmp dword [esp + 0x2c], 0
jne 0x10139390
jmp 0x10139329
cmp eax, 0xd
jne 0x10139329
push 0xd
push ecx
push str.POWERSHELL_
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10139390
lea eax, [esp + 0x10]
mov dword [esp + 0x80], 0x10437484
mov dword [esp + 0x84], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], 0x1013e980
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], 1
lea eax, [esp + 0x80]
push eax
call fcn.100748a0
add esp, 4
jmp 0x101393e7
lea eax, [esp + 0x10]
mov dword [esp + 0x80], 0x10437468
mov dword [esp + 0x84], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], 0x1013e980
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], 1
lea eax, [esp + 0x80]
push eax
call fcn.100748a0
add esp, 4
cmp dword [esp + 0x14], 0
je 0x10138ea0
push dword [esp + 0x10]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10138ea0
cmp dword [esp + 8], 0
je 0x10139438
xor ecx, ecx
test edx, edx
je 0x10139450
cmp byte [esi + edx - 1], 0xa
jne 0x1013944e
mov eax, edx
dec eax
je 0x10139450
cmp byte [esi + edx - 2], 0xd
lea ecx, [edx - 2]
cmove eax, ecx
mov ecx, eax
jmp 0x10139450
mov ecx, dword [esp + 0x70]
mov bl, 1
cmp dword [esp + 0x14], 0
jne 0x10139276
jmp 0x10139289
mov ecx, edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x6c], ecx
jmp 0x101392ad
lea ecx, [esp + 0x64]
call fcn.1013d1f0
cmp dword [esp + 0x3c], 0
je 0x1013948b
push dword [esp + 0x38]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x4c]
call sub.KERNEL32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
push 0x103879b0
push ebx
push dword [esp + 0x14]
call fcn.1002ac30
add esp, 0xc
jmp 0x101394ed
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
push 0x103879b0
call fcn.1002acf0
add esp, 4
ud2