Function at 0x1002d470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x180], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], eax
test edi, edi
je 0x1002d7e5
cmp esi, 0xffffffff
je 0x1002d7e5
test ebx, ebx
je 0x1002d4f6
xor eax, eax
push 2
push eax
or edx, 0xffffffff
push edx
mov ecx, 0xffffffea
mov dword [ebx], eax
mov dword [ebx + 4], eax
push ecx
mov dword [ebx + 8], eax
push esi
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1002d4f6
push 0
lea ecx, [esp + 0x180]
push ecx
push 0x10
push ebx
push esi
mov dword [esp + 0x190], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002d6f8
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call ebx
test eax, eax
je 0x1002d6f8
xor eax, eax
push eax
lea edx, [esp + 0xc]
push edx
push 0x10
mov dword [edi], eax
mov dword [edi + 4], eax
push edi
mov dword [edi + 8], eax
push esi
mov dword [edi + 0xc], eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002d6f8
cmp byte [edi], 0x4d
jne 0x1002d7c6
cmp byte [edi + 1], 0x5a
jne 0x1002d7c6
push 0x40
lea eax, [esp + 0x13c]
push 0
push eax
call fcn.10059a00
push 0xf8
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.10059a00
add esp, 0x18
xor eax, eax
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
call ebx
test eax, eax
je 0x1002d6f8
push 0
lea edx, [esp + 0xc]
push edx
push 0x40
lea eax, [esp + 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002d6f8
mov eax, dword [esp + 0x174]
push 0
cdq
push 0
push edx
push eax
push esi
call ebx
test eax, eax
je 0x1002d6f8
push 0
lea ecx, [esp + 0xc]
push ecx
push 0xf8
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002d6f8
movzx eax, word [esp + 0x1e]
dec eax
lea eax, [eax + eax*4]
push 1
add eax, eax
xor ecx, ecx
push ecx
add eax, eax
push ecx
add eax, eax
push eax
push esi
call ebx
test eax, eax
je 0x1002d6f8
push 0
lea eax, [esp + 0xc]
push eax
push 0x28
lea ecx, [esp + 0x11c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002d6f8
mov eax, dword [esp + 0x124]
mov edx, dword [esp + 0x120]
lea ebx, [edx + eax]
xor eax, eax
push eax
push eax
push eax
push ebx
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1002d6f8
xor eax, eax
push eax
lea ecx, [esp + 0xc]
push ecx
push 0x10
mov dword [edi], eax
mov dword [edi + 4], eax
push edi
mov dword [edi + 8], eax
push esi
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002d6f8
cmp dword [edi], 0
jne 0x1002d710
cmp dword [edi + 4], 0xdeadbeef
jne 0x1002d710
mov eax, dword [esp + 0x14]
push 0
add ebx, 4
push 0
adc eax, 0
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1002d6f8
xor eax, eax
push eax
lea edx, [esp + 0xc]
push edx
push 0x10
mov dword [edi], eax
mov dword [edi + 4], eax
push edi
mov dword [edi + 8], eax
push esi
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002d7a7
call fcn.10002c20
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.1005710f
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esp + 0x17d], eax
mov word [esp + 0x181], ax
mov byte [esp + 0x183], al
mov dword [esp + 8], eax
mov eax, dword [edi]
add eax, 4
add ebx, eax
mov eax, dword [esp + 0x14]
push 0
push 0
adc eax, 0
push eax
push ebx
push esi
mov byte [esp + 0x190], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1002d7a7
push 0
lea ecx, [esp + 0xc]
push ecx
push 8
lea edx, [esp + 0x188]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002d7a7
cmp dword [esp + 8], 0
je 0x1002d7a7
cmp byte [esp + 0x17c], 0x4d
jne 0x1002d7a7
cmp byte [esp + 0x17d], 0x4f
jne 0x1002d7a7
cmp byte [esp + 0x17e], 0x55
jne 0x1002d7a7
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x180]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov edx, dword [esp + 0xc]
mov dword [edx], 1
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.1005710f
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
mov dword [eax], 0
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.1005710f
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x184]
pop ebx
xor ecx, esp
mov eax, 0x80070057
call fcn.1005710f
mov esp, ebp
pop ebp
ret