Function at 0x10001500
Capabilities:
Create thread
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x3c]
add eax, 0xffffe7c7
add dword [esp + 0x40], 0x3e9
push ebx
mov dword [esp + 0x10], eax
push ebp
push esi
mov esi, ecx
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
add ebx, 0xffffe935
mov ebp, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x58]
add ebp, 0xffffec65
lea eax, [ecx - 0x1292]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], eax
add ecx, 0x5a7
mov eax, dword [esp + 0x48]
add edi, 0xfffffe2c
add eax, 0x2a0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
lea eax, [edx + 0x17b]
mov dword [esp + 0x10], eax
lea eax, [edx - 0x6c]
mov dword [esp + 0x18], eax
lea eax, [edx - 0x1550]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x2c]
add eax, 0xbb
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x48]
add eax, 0x164
mov dword [esp + 0x58], eax
lea eax, [edx + 0x234]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x58]
add eax, 0xffffff08
cmp dword [esp + 0x50], eax
jl 0x1000193d
mov edx, dword [esp + 0x1c]
lea eax, [edx + 0x1784]
cmp ecx, eax
jl 0x10001730
mov ebp, dword [esp + 0x2c]
lea eax, [ebx + 0x13a4]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x40]
push eax
sub esp, 0xc
add eax, 0x1d4
cmp ebp, eax
mov eax, dword [esp + 0x3c]
lea edx, [ecx + 0x269]
cmovl edx, ecx
add eax, 0x1784
add edx, 0x414
push edx
push esi
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x74]
lea edx, [edi + 0x61]
call fcn.10002d30
mov ecx, dword [esi + 0x38]
mov edx, esi
push 0x100495c0
push 0xb8
push 0xac
mov ecx, dword [ecx + 0x64]
sub ecx, 0xbd9
mov dword [esp + 0x88], eax
push 8
push ecx
push 0x190f
mov ecx, 0x1a4d
call fcn.1000c0b0
mov ecx, dword [esp + 0x90]
add esp, 0x44
mov edx, dword [esp + 0x14]
mov dword [esi + 0xe8], eax
add edx, 0x174
mov dword [esi + 0x90], eax
mov eax, dword [esi + 0x1b8]
add eax, 0x1839
imul eax, dword [esi + 0xc8]
mov dword [esi + 0xc8], eax
lea eax, [ecx + 0x1292]
push eax
sub esp, 8
lea eax, [ebx + 0x139b]
push eax
lea eax, [ebp - 0x4f2]
push esi
push eax
call fcn.1000e310
mov eax, dword [esi + 0xf8]
add esp, 0x18
mov eax, dword [eax + 0x64]
xor eax, 0x19ad
mov dword [esi + 0x1e8], eax
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x14c]
sub eax, 0x1785
mov dword [esi + 0x1f0], eax
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x1c4]
add eax, 0x812
cmp eax, 0x19ad
je 0x10001704
mov edi, dword [esi + 0xd0]
mov ecx, 0x19ad
mov edx, dword [esi + 0x98]
or edi, 0x132f
sub ecx, eax
imul edx, edi
sub ecx, 1
jne 0x100016f6
mov dword [esi + 0x98], edx
sub esp, 8
push esi
push ecx
call fcn.10009a70
mov eax, dword [esi + 0xfc]
add esp, 0x10
xor eax, 0x1a4d
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x50]
pop edi
pop esi
pop ebp
add eax, 0xfffffb0c
pop ebx
add esp, 0x18
ret
mov eax, dword [esi + 0x2c]
and eax, dword [esp + 0x2c]
cmp dword [esi + 0xd8], eax
je 0x10001912
imul eax, dword [esp + 0x4c], 0x1112
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
add edx, dword [esi + 0xd8]
mov edi, dword [esp + 0x20]
xor dword [esi + 0xfc], eax
add edi, 0x132f
mov eax, dword [esi + 0x118]
or eax, 0x1869
add edi, dword [esi + 0x30]
xor dword [esi + 0x13c], eax
mov eax, ebp
sub eax, dword [esi + 0x194]
xor dword [esi], eax
mov eax, dword [esi + 0xc8]
xor eax, dword [esi + 0x198]
sub eax, 0x1112
mov ebx, dword [esi + 0x40]
mov dword [esp + 0x50], eax
mov eax, ecx
sub eax, dword [esi + 0xf8]
sub eax, dword [esi + 8]
add dword [esi + 0x50], eax
mov eax, dword [esi + 0x14]
and eax, 0x1112
and ebx, dword [esi + 0x13c]
or ecx, eax
mov eax, dword [esi + 0x64]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x12c]
xor eax, ecx
push eax
mov eax, dword [esp + 0x3c]
xor edx, ecx
mov ecx, dword [esp + 0x50]
sub eax, ecx
sub eax, 0x1292
push eax
mov eax, dword [esp + 0x60]
sub esp, 8
xor eax, ebp
xor ebp, 0x139b
push esi
push ecx
push eax
push ebp
push edx
push edi
sub esp, 8
mov ecx, ebx
call fcn.1000e010
mov ecx, dword [esi + 0xc8]
add esp, 0x30
add ecx, dword [esp + 0x4c]
mov ebp, eax
add dword [esi + 0x1c4], ecx
mov ecx, dword [esi + 0x98]
mov eax, ecx
sub ecx, dword [esp + 0x50]
and eax, 0x190f
mov edx, dword [esi + 0x198]
or edx, dword [esp + 0x58]
mov edi, dword [esi + 0x154]
or edi, dword [esp + 0x38]
mov ebx, dword [esi + 0x58]
sub ebx, dword [esp + 0x30]
push ecx
push eax
push edx
sub esp, 8
mov eax, ebp
xor eax, 0x1648
xor ebx, 0x1590
imul eax, dword [esp + 0x28]
push edi
push eax
mov eax, dword [esp + 0x4c]
imul eax, ebp
push ecx
add eax, eax
push eax
push ebx
mov ecx, esi
call fcn.1000a660
imul ecx, dword [esi + 0xc8], 0x1590
add esp, 0x28
push ecx
mov ecx, dword [esi + 0x7c]
add ecx, dword [esi + 0x70]
sub ecx, eax
mov eax, dword [esp + 0x3c]
or eax, dword [esp + 0x14]
push ecx
push esi
push eax
mov eax, dword [esi + 0x108]
xor eax, dword [esi + 0xfc]
push ecx
or eax, 0x174d
push eax
lea eax, [ebp + 0x1550]
imul eax, eax, 0x1784
push ecx
push eax
mov eax, dword [esi + 0x40]
and eax, dword [esi + 0x118]
push eax
mov eax, dword [esi + 0x58]
push ecx
and eax, 0x132f
push eax
sub esp, 8
call fcn.1000dc40
mov ax, word [esi + 0x24]
add esp, 0x34
mov ecx, 0x1869
sub ax, cx
movzx eax, ax
push eax
push dword [esi + 0x1c4]
mov eax, dword [esi + 0x88]
or eax, dword [esp + 0x54]
push eax
mov eax, dword [esi + 0x60]
and eax, dword [esi + 0x198]
xor eax, dword [esi + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x50]
pop edi
pop esi
pop ebp
add eax, 0xfffffb0c
pop ebx
add esp, 0x18
ret
lea eax, [edx - 0x13fc]
cmp dword [esi + 0x40], eax
ja 0x10001ae1
mov eax, dword [esi + 0x108]
and eax, ebx
xor dword [esi + 0x50], eax
mov eax, dword [esp + 0x50]
pop edi
pop esi
pop ebp
add eax, 0xfffffb0c
pop ebx
add esp, 0x18
ret
mov eax, ebx
sub eax, dword [esp + 0x38]
add eax, ebp
cmp ebp, eax
jle 0x10001ae1
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0xfc]
add edx, 0x1648
add eax, edx
cmp ebp, eax
jb 0x10001acc
sub ebp, dword [esp + 0x18]
mov eax, ebx
sub eax, dword [esp + 0x14]
add ebp, 0x11d7
push eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
xor eax, 0x190f
imul eax, dword [esp + 0x1c]
add edx, 0x160
xor ecx, dword [esp + 0x20]
push ebp
or ecx, dword [esi + 0x50]
push eax
mov eax, edi
and eax, 0x1197
push eax
sub esp, 8
lea eax, [edx + 0x1550]
push eax
imul eax, edx, 0x119a
push eax
mov eax, dword [esp + 0x3c]
add eax, edi
imul eax, eax, 0x1550
push ecx
push eax
push esi
call fcn.1000d5b0
mov ebp, dword [esp + 0x40]
add esp, 0x2c
imul ecx, ebx, 0xffffe5b3
add dword [esi + 0x118], ecx
mov ecx, dword [esp + 0x4c]
and ecx, ebp
add ecx, dword [esi + 0x1b8]
add ecx, dword [esi + 0x12c]
add ecx, eax
mov eax, dword [esi + 0x1c4]
add dword [esp + 0x18], ecx
or eax, 0x1112
push eax
mov eax, dword [esi + 0x30]
xor eax, dword [esp + 0x54]
sub eax, 0x1a46
push eax
mov eax, dword [esi + 0xf8]
or eax, dword [esi + 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
imul eax, dword [esp + 0x4c], 0x156f
mov ecx, dword [esp + 0x20]
xor eax, dword [esp + 0x10]
add dword [esi + 0x40], eax
mov eax, dword [esp + 0x34]
add eax, 0x160
xor dword [esi + 8], eax
mov eax, dword [esi]
or eax, 0x132f
add eax, ecx
add dword [esi + 0x10c], eax
lea eax, [ebx + ebp]
or dword [esi + 0x12c], eax
mov eax, dword [esi + 0x19c]
imul eax, ebp
add eax, 0x1590
mov dword [esi + 0xfc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [esi + 0x16c]
xor eax, dword [esp + 0x38]
push ecx
or eax, ebx
push esi
push eax
mov eax, dword [esi + 0x58]
and eax, dword [esi + 0x10c]
imul eax, eax, 0x1590
push ecx
push eax
mov eax, dword [esi + 0x1c4]
push ecx
mov ecx, dword [esp + 0x4c]
sub eax, 0x14fb
xor eax, dword [esi + 0x15c]
add ecx, 0x160
xor eax, ecx
sub eax, dword [esi + 0x98]
push eax
mov eax, dword [esi + 8]
push ecx
add eax, 0x1292
push eax
lea eax, [ebp - 0x1292]
push eax
call fcn.10008a70
add esp, 0x28
or edi, dword [esp + 0x4c]
sub edi, dword [esp + 0x18]
imul edi, dword [esi + 0x13c]
mov dword [esi + 0x13c], edi
mov eax, dword [esp + 0x50]
pop edi
pop esi
pop ebp
add eax, 0xfffffb0c
pop ebx
add esp, 0x18
ret