Function at 0x100fd77
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x45c8
call sub.ntdll.dll__chkstk
mov eax, dword [0x105e004]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ebx, ecx
mov dword [ebp - 0x42fc], edi
call fcn.0100e613
push edi
push esi
mov ecx, ebx
call fcn.0100eecb
test al, al
jne 0x100fdbd
mov ecx, ebx
call fcn.0100e613
jmp 0x1010887
push dword [ebp - 0x42fc]
lea eax, [ebx + 0x100]
push eax
lea edi, [ebx + 0x24]
push edi
push dword [ebp + 0x14]
mov dword [ebp - 0x4300], edi
push 0x100003
push esi
call fcn.0100ef26
xor esi, esi
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x100fdb1
push esi
push esi
push esi
push esi
push 0x70024
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push dword [ebp + 0x18]
cmp eax, 0xc00000a2
mov dword [ebx + 0x34], eax
setne al
mov ecx, ebx
mov byte [ebx + 0x105], al
call fcn.0100eb87
push 4
push 8
lea eax, [ebp - 0x4338]
push eax
lea eax, [ebp - 0x4308]
push eax
push dword [edi]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x100feb3
mov eax, dword [ebp - 0x4334]
test al, 0x10
je 0x100fe58
mov dword [ebx + 0x108], 3
jmp 0x100feb9
mov ecx, dword [ebp - 0x4338]
cmp ecx, 2
jb 0x100feb3
push 3
pop edx
cmp ecx, edx
jbe 0x100fea7
cmp ecx, 6
jbe 0x100feb3
cmp ecx, 8
jbe 0x100fe97
cmp ecx, 0x12
je 0x100fe8f
cmp ecx, 0x14
je 0x100fe8f
cmp ecx, 0x24
jne 0x100feb3
mov dword [ebx + 0x108], 5
jmp 0x100feb9
mov dword [ebx + 0x108], edx
jmp 0x100feb9
and al, 1
neg al
sbb eax, eax
inc eax
inc eax
mov dword [ebx + 0x108], eax
jmp 0x100feb9
mov dword [ebx + 0x108], 4
jmp 0x100feb9
mov dword [ebx + 0x108], esi
push 0x18
lea eax, [ebp - 0x4328]
push eax
push esi
push esi
push 0x70000
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
mov byte [ebx + 0x2c], 0
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x100ff51
cmp eax, 0xc0000001
je 0x100ff4b
cmp eax, 0xc0000014
je 0x100ff4b
mov ecx, ebx
call fcn.0100e613
mov ebx, dword [ebx + 0x34]
cmp ebx, 0x80000010
je 0x100ff33
cmp ebx, 0x80000011
je 0x100ff2c
cmp ebx, 0xc0000013
je 0x100ff25
cmp ebx, 0xc00000a3
je 0x100ff2c
mov eax, 0x7d6
jmp 0x100ff38
mov eax, 0x7d7
jmp 0x100ff38
mov eax, 0x830
jmp 0x100ff38
mov eax, 0xbe7
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1010887
jmp 0x1010881
mov dword [ebp - 0x4320], esi
cmp dword [ebp - 0x4320], esi
jne 0x100ff72
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x4328]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x4300]
mov dword [ebp - 0x4320], esi
cmp dword [ebp - 0x4320], 0xc
je 0x100ff88
cmp dword [ebp - 0x4320], 0xb
jne 0x1010481
push 8
lea eax, [ebp - 0x4340]
push eax
push esi
push esi
push 0x7405c
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
setge cl
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x100ffdc
cmp eax, 0xc0000010
je 0x100ffdc
mov ecx, ebx
call fcn.0100e613
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1010887
push 0x7e7
jmp 0x1010882
test cl, cl
je 0x1010481
push 0x90
lea eax, [ebp - 0x43e8]
push eax
push esi
push esi
push 0x70048
lea eax, [ebp - 0x4308]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
mov edx, 0x100143c
jge 0x101005d
cmp eax, 0xc0000010
jne 0x100ffbd
mov eax, dword [ebp - 0x4340]
and dword [ebp - 0x43dc], 0
mov dword [ebp - 0x43d8], eax
mov eax, dword [ebp - 0x433c]
mov dword [ebp - 0x43e8], 1
mov dword [ebp - 0x43e0], 0x7e00
mov dword [ebp - 0x43d4], eax
mov esi, edx
lea edi, [ebp - 0x43c8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [ebp - 0x43e8], esi
je 0x10100b7
and dword [ebp - 0x43e8], 0
push 4
pop ecx
xor eax, eax
mov edi, edx
lea esi, [ebp - 0x43c8]
repe cmpsd dword [esi], dword es:[edi]
push 0
push dword [ebp - 0x4314]
setne al
push dword [ebp - 0x43dc]
dec al
push dword [ebp - 0x43e0]
and al, 0x19
add al, 0xee
mov byte [ebp - 0x43c8], al
mov byte [ebp - 0x43c7], 0
mov byte [ebp - 0x43c6], 1
call sub.ntdll.dll__alldiv
mov dword [ebp - 0x43c4], eax
push 0x24
lea edi, [ebx + 0x38]
pop ecx
lea esi, [ebp - 0x43e8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x105e020]
mov ecx, 0x20001
cmp eax, ecx
jne 0x1010304
cmp dword [ebp - 0x4320], 0xb
jne 0x10100e9
mov dword [ebx + 0x20], 1
jmp 0x10100ed
and dword [ebx + 0x20], 0
mov eax, dword [0x105e020]
cmp eax, ecx
jne 0x1010304
cmp dword [ebx + 0x20], 1
je 0x1010385
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
push ecx
mov dword [eax], ecx
push ecx
xor esi, esi
mov dword [eax + 4], esi
mov ecx, dword [ebp - 0x43e0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43dc]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
mov dword [ebp - 0x4330], esi
mov dword [ebp - 0x432c], esi
call fcn.0100e803
cmp word [ebx + 0x10c], si
mov ecx, dword [eax]
mov dword [ebx + 0xf0], ecx
mov eax, dword [eax + 4]
mov cx, word [ebp - 0x4314]
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0xe8]
mov dword [eax], esi
mov word [eax], cx
jne 0x101027f
lea ecx, [ebp - 0x4354]
call fcn.010110a4
push dword [ebx + 0x100]
mov edi, 0x2800
push edi
lea ecx, [ebp - 0x4354]
mov dword [ebp - 0x42f0], esi
call fcn.01010f92
test eax, eax
jne 0x10101ae
lea ecx, [ebp - 0x4354]
call fcn.010110d0
jmp 0x1010887
mov eax, dword [ebp - 0x4344]
push esi
push esi
push edi
push eax
mov dword [ebp - 0x430c], eax
mov dword [ebp - 0x42f4], eax
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov ecx, 0xc0000000
mov dword [ebx + 0x34], eax
and eax, ecx
cmp eax, ecx
je 0x101019e
cmp dword [ebp - 0x4304], edi
jne 0x101019e
mov eax, dword [ebp - 0x42f4]
mov cx, word [eax + 0x13]
mov word [ebp - 0x42f0], cx
cmp dword [ebp - 0x42f0], esi
jne 0x1010214
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x42f0], eax
mov edi, dword [ebp - 0x430c]
push edi
xor eax, eax
push eax
push dword [ebp - 0x42f0]
call fcn.0101294d
test al, al
je 0x1010240
mov eax, dword [ebp - 0x42f4]
mov ax, word [eax + 0xb]
mov word [ebp - 0x4314], ax
jmp 0x1010274
lea eax, [edi + 0x2200]
push eax
lea eax, [edi + 0x2000]
push eax
push edi
xor eax, eax
push eax
push dword [ebp - 0x42f0]
call fcn.0101209e
test al, al
je 0x1010274
mov eax, 0x200
cmp dword [ebp - 0x4314], eax
je 0x1010274
mov dword [ebp - 0x4314], eax
lea ecx, [ebp - 0x4354]
call fcn.010110d0
mov edi, dword [ebp - 0x4330]
push ecx
push ecx
mov eax, esp
push dword [ebp - 0x432c]
mov dword [eax], esi
push edi
mov dword [eax + 4], esi
call fcn.0100e89e
test al, al
je 0x10102d5
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
push ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100e803
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x10102db
mov ecx, dword [ebp - 0x432c]
mov edx, dword [ebp - 0x43c4]
lea eax, [ebx + 0xc8]
push eax
push ecx
push ecx
mov eax, esp
push ecx
mov dword [eax], edx
mov dword [eax + 4], esi
push edi
lea eax, [ebp - 0x4328]
push eax
call fcn.0100e6cb
jmp 0x10103da
cmp eax, 0x40002
jne 0x1010377
cmp byte [ebp - 0x43c8], 1
jne 0x1010355
push ecx
push ecx
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], 0x300000
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
call fcn.0100e852
neg al
sbb eax, eax
and eax, 0xfffffc00
add eax, 0x800
mov dword [ebp - 0x4314], eax
jmp 0x10103da
cmp byte [ebp - 0x43c8], 4
je 0x101036b
cmp byte [ebp - 0x43c8], 6
jne 0x10103ec
mov dword [ebp - 0x4314], 0x800
jmp 0x10103da
cmp eax, ecx
jne 0x10103ec
cmp dword [ebx + 0x20], 1
jne 0x1010445
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], ecx
push ecx
mov ecx, dword [ebp - 0x43e0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43dc]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100e803
mov ecx, dword [eax]
mov dword [ebx + 0xf0], ecx
mov eax, dword [eax + 4]
mov cx, word [ebp - 0x4314]
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0xe8]
and dword [eax], 0
mov word [eax], cx
cmp dword [0x105e020], 0x20001
jne 0x10103ec
cmp dword [ebx + 0x20], 1
jne 0x1010445
lea eax, [ebx + 0xc8]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x43c4]
mov eax, esp
and dword [eax + 4], 0
mov dword [eax], ecx
push ecx
push ecx
mov ecx, dword [ebp - 0x4314]
mov eax, esp
and dword [eax + 4], 0
push ecx
mov dword [eax], ecx
push ecx
mov ecx, dword [ebp - 0x43d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x43d4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x4310]
push eax
call fcn.0100e803
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x4328]
push eax
call fcn.0100e6cb
xor esi, esi
lea eax, [ebx + 0xfc]
cmp dword [eax], esi
jne 0x1010795
push 0x30
mov dword [eax], 1
call fcn.0101408f
mov edi, eax
cmp edi, esi
pop ecx
je 0x101077c
push fcn.0100bd6a
push 1
push 0x30
push edi
call fcn.0100e5bc
jmp 0x101077e
lea eax, [ebx + 0xc8]
push eax
lea eax, [ebp - 0x4328]
push eax
call fcn.0100f25e
mov ecx, ebx
call fcn.0100eb21
test al, al
je 0x1010447
push 0x1e0
lea eax, [ebp - 0x45c8]
push eax
push esi
push esi
push 0x70c00
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x101052b
mov ecx, ebx
call fcn.0100e613
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1010887
mov ebx, dword [ebx + 0x34]
cmp ebx, 0x80000010
je 0x101087c
cmp ebx, 0x80000011
je 0x1010521
cmp ebx, 0xc0000013
je 0x1010517
cmp ebx, 0xc00000a3
je 0x1010521
mov eax, 0x7d6
jmp 0x1010881
mov eax, 0x8aa
jmp 0x1010881
mov eax, 0x830
jmp 0x1010881
mov eax, dword [ebp - 0x4304]
push 0x18
xor edx, edx
pop ecx
div ecx
cmp eax, esi
mov dword [ebx + 0xfc], eax
jne 0x1010561
mov ecx, ebx
call fcn.0100e613
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1010887
push 0x7d6
jmp 0x1010882
cmp dword [0x105e020], 0x20001
jne 0x101062c
cmp eax, esi
mov dword [ebp - 0x42f0], esi
jle 0x101062c
lea edx, [ebp - 0x45c8]
cmp dword [edx + 8], 6
jne 0x10105cb
mov eax, dword [ebx + 0xfc]
dec eax
cmp dword [ebp - 0x42f0], eax
mov dword [ebp - 0x42f4], eax
jge 0x10105c5
mov eax, dword [ebx + 0xfc]
sub eax, dword [ebp - 0x42f0]
lea esi, [edx + 0x18]
dec eax
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x42f4]
shl ecx, 3
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebx + 0xfc], eax
cmp dword [edx + 8], 0x16
jne 0x1010611
mov eax, dword [ebx + 0xfc]
dec eax
cmp dword [ebp - 0x42f0], eax
mov dword [ebp - 0x42f4], eax
jge 0x101060b
mov eax, dword [ebx + 0xfc]
sub eax, dword [ebp - 0x42f0]
lea esi, [edx + 0x18]
dec eax
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x42f4]
shl ecx, 3
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebx + 0xfc], eax
inc dword [ebp - 0x42f0]
mov eax, dword [ebp - 0x42f0]
add edx, 0x18
cmp eax, dword [ebx + 0xfc]
jl 0x1010585
mov edi, dword [ebx + 0xfc]
cmp edi, esi
mov dword [ebp - 0x42f0], edi
jle 0x10106d0
lea eax, [edi - 1]
mov dword [ebp - 0x42f4], eax
mov eax, edi
mov dword [ebp - 0x430c], eax
cmp dword [ebp - 0x42f4], esi
jle 0x10106c8
mov ecx, dword [ebx + 0xfc]
dec ecx
lea eax, [ebp - 0x45a0]
mov dword [ebp - 0x432c], ecx
mov ecx, dword [eax - 0x1c]
imul ecx, dword [eax - 0x18]
mov edx, dword [eax - 4]
imul ecx, dword [eax - 0x14]
imul edx, dword [eax + 4]
imul ecx, dword [eax - 0x28]
imul edx, dword [eax - 0x10]
imul edx, dword [eax]
cmp ecx, edx
jae 0x10106b7
push 6
pop ecx
lea edx, [eax - 0x28]
push 6
mov esi, edx
lea edi, [ebp - 0x4358]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea esi, [eax - 0x10]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
lea esi, [ebp - 0x4358]
lea edi, [eax - 0x10]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, dword [ebp - 0x42f0]
add eax, 0x18
dec dword [ebp - 0x432c]
jne 0x101066c
dec dword [ebp - 0x430c]
jne 0x1010651
lea eax, [edi + edi*2]
shl eax, 4
push eax
call fcn.0101408f
cmp eax, esi
pop ecx
mov dword [ebp - 0x430c], eax
je 0x10106fd
push fcn.0100bd6a
push edi
push 0x30
push eax
call fcn.0100e5bc
mov eax, dword [ebp - 0x430c]
jmp 0x10106ff
xor eax, eax
cmp eax, esi
mov dword [ebx + 0xf8], eax
jne 0x1010728
mov ecx, ebx
call fcn.0100e613
mov ecx, dword [ebp - 0x42fc]
cmp ecx, esi
je 0x1010887
push 0x801
jmp 0x1010882
xor edi, edi
cmp dword [ebx + 0xfc], esi
jle 0x1010447
lea eax, [ebp - 0x45c8]
mov dword [ebp - 0x42f4], esi
mov dword [ebp - 0x42f0], eax
mov eax, dword [ebx + 0xf8]
add eax, dword [ebp - 0x42f4]
push eax
push dword [ebp - 0x42f0]
call fcn.0100f25e
add dword [ebp - 0x42f4], 0x30
add dword [ebp - 0x42f0], 0x18
inc edi
cmp edi, dword [ebx + 0xfc]
jl 0x1010748
jmp 0x1010447
xor edi, edi
cmp edi, esi
mov dword [ebx + 0xf8], edi
je 0x1010709
push 0xc
lea esi, [ebx + 0xc8]
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov ecx, ebx
call fcn.0100e8c2
test al, al
mov ecx, ebx
je 0x10104d3
call fcn.0100ea62
test al, al
jne 0x10107bc
cmp dword [ebx + 0x34], 0xc0000023
je 0x1010887
mov ecx, ebx
call fcn.0100f7e6
cmp dword [ebp - 0x4320], 0xb
jne 0x10108b9
mov edi, dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push 0x36c0
lea eax, [ebp - 0x36c4]
push eax
push esi
push esi
push 0x70050
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
mov byte [ebp - 0x42f5], 0
call edi
cmp eax, esi
mov dword [ebx + 0x34], eax
jge 0x1010857
cmp eax, 0xc0000010
jne 0x1010857
push 0xc28
lea eax, [ebp - 0x42ec]
push eax
push esi
push esi
push 0x7400c
lea eax, [ebp - 0x4308]
push eax
mov eax, dword [ebp - 0x4300]
push esi
push esi
push esi
push dword [eax]
mov byte [ebp - 0x42f5], 1
call edi
cmp eax, esi
mov dword [ebx + 0x34], eax
jl 0x1010857
cmp dword [ebp - 0x42ec], 4
jae 0x1010857
mov byte [ebx + 0x104], 1
cmp dword [ebx + 0x34], esi
jl 0x10104d1
cmp byte [ebp - 0x42f5], 0
jne 0x10108b2
cmp dword [ebp - 0x36c4], esi
jne 0x101088b
cmp dword [ebp - 0x36c0], 4
jae 0x10108b2
jmp 0x10108ab
mov eax, 0xbe7
push eax
call fcn.0100bd8b
xor al, al
jmp 0x10108d1
cmp dword [ebp - 0x36c4], 1
jne 0x10108b2
cmp dword [ebp - 0x36c0], 1
jne 0x10108b2
mov eax, dword [ebp - 0x368c]
or eax, dword [ebp - 0x3688]
jne 0x10108b2
mov byte [ebx + 0x104], 1
mov ecx, ebx
call fcn.01017bfc
cmp byte [ebp + 0x10], 0
jne 0x10108cf
mov edi, dword [ebp - 0x4300]
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [edi], esi
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.0100d6cf
pop edi
pop esi
pop ebx
leave
ret 0x14