Function at 0x10004ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x23c
mov eax, dword [0x101cc040]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push ebp
mov ebp, dword [esp + 0x248]
push esi
push edi
mov esi, ecx
push 0
push esi
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, 0x100000
cmp eax, 0x100000
ja 0x10004f2c
mov edi, eax
push edi
call fcn.1012fc96
add esp, 4
push 0
push 0
push 0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10004f51
xor edi, edi
mov dword [esp + 0x10], edi
jmp 0x10004f82
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10004f6b
mov dword [esp + 0x10], eax
jmp 0x10004f7e
mov edi, dword [esp + 0x14]
mov edx, ebx
call fcn.10007af0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov edi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
cmp eax, 0x20
jb 0x10005260
cmp eax, 0x400
jb 0x10004fa2
mov eax, 0x400
push eax
push edi
mov ebx, 0x10143830
call fcn.10007c70
mov edx, dword [esp + 0x1c]
add esp, 8
test eax, eax
jbe 0x10005008
lea ecx, [eax + 0x201]
cmp ecx, edx
ja 0x10005008
mov ecx, 1
add eax, edi
lea ebx, [ebx]
cmp byte [eax + ecx], 0x22
je 0x10005008
inc ecx
cmp ecx, 0x200
jbe 0x10004fd0
push edi
call fcn.1012fc21
push str.VBS.Encrypted.B
push 0x10143150
mov ecx, 0x40
mov edi, ebp
call fcn.10001100
add esp, 0xc
mov eax, 0x24
jmp 0x1000526b
push 1
push edx
push edi
mov ecx, str.CreateObject
call fcn.10004c30
add esp, 0xc
test al, al
je 0x10005046
push edi
call fcn.1012fc21
push str.VBS.Encrypted.C
push 0x10143150
mov ecx, 0x40
mov edi, ebp
call fcn.10001100
add esp, 0xc
mov eax, 0x24
jmp 0x1000526b
xor esi, esi
xor edi, edi
xor ebp, ebp
cmp dword [0x101cee84], esi
jbe 0x100050d9
cmp edi, 0x12c
jae 0x1000509b
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebx, dword [esi*4 + 0x101ce3f0]
push edx
push eax
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000508a
cmp esi, 1
ja 0x10005083
inc ebp
add edi, dword [esi*4 + 0x101ce258]
inc esi
cmp esi, dword [0x101cee84]
jb 0x10005058
cmp edi, 0x12c
jb 0x100050d9
cmp dword [esp + 0x254], 3
je 0x100050aa
cmp ebp, 2
jne 0x100050d9
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1012fc21
push str.VBS.VirusCode
mov edi, dword [esp + 0x20]
push 0x10143150
mov ecx, 0x40
call fcn.10001100
add esp, 0xc
mov eax, 0x24
jmp 0x1000526b
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 1
push edx
push edi
mov ecx, str.execute
call fcn.10004c30
add esp, 0xc
test al, al
je 0x10005104
push edi
mov esi, str.VBS.Encrypted.A2
call fcn.1012fc21
push esi
jmp 0x100050b9
mov eax, dword [esp + 0x14]
push 1
push eax
push edi
mov ecx, str.execute_
call fcn.10004c30
add esp, 0xc
test al, al
je 0x1000512b
push edi
mov esi, str.VBS.Encrypted.A1
call fcn.1012fc21
push esi
jmp 0x100050b9
mov eax, dword [esp + 0x14]
push eax
push edi
mov ebx, str.executeglobal
mov ebp, eax
call fcn.10007c70
add esp, 8
test eax, eax
ja 0x100052fa
je 0x1000525c
cmp eax, 1
jbe 0x100051a1
mov ecx, dword [esp + 0x10]
lea edx, [eax + ecx - 2]
mov cl, byte [edx]
cmp cl, 0xa
je 0x10005175
cmp cl, 0x20
je 0x10005175
cmp cl, 0x3a
je 0x10005175
cmp cl, 0x3d
jne 0x1000525c
mov esi, 1
lea edi, [eax - 1]
cmp edi, esi
jb 0x100051a1
mov cl, byte [edx]
cmp cl, 0xa
je 0x100051a1
cmp cl, 0x3a
je 0x100051a1
cmp cl, 0x3d
je 0x100051a1
cmp cl, 0x27
je 0x1000525c
inc esi
dec edx
cmp esi, edi
jbe 0x10005181
mov edx, 0x80
mov ecx, str.executeglobal
jmp 0x100051b0
cmp byte [ecx], 0
je 0x10005215
inc ecx
sub edx, 1
jne 0x100051b0
xor ecx, ecx
lea edx, [ecx + eax]
cmp edx, ebp
ja 0x1000525c
mov ecx, dword [esp + 0x10]
mov cl, byte [edx + ecx - 1]
xor edi, edi
cmp cl, 7
jbe 0x1000525c
mov esi, edx
sub esi, eax
nop
cmp cl, 0xe
jb 0x100051ea
cmp cl, 0x1f
jbe 0x1000525c
cmp cl, 0x30
jb 0x100051f4
cmp cl, 0x39
jbe 0x1000520d
cmp cl, 0x41
jb 0x100051fe
cmp cl, 0x5a
jbe 0x1000520d
cmp cl, 0x61
jb 0x10005208
cmp cl, 0x7a
jbe 0x1000520d
cmp cl, 0x5f
jne 0x10005222
test edi, edi
jne 0x1000523f
mov edi, edx
jmp 0x1000523f
test edx, edx
je 0x100051bb
mov ecx, 0x80
sub ecx, edx
jmp 0x100051bd
test edi, edi
jne 0x10005284
cmp cl, 0x22
je 0x1000525c
cmp cl, 0x2b
je 0x1000525c
cmp cl, 0x2d
je 0x1000525c
cmp cl, 0x27
je 0x1000525c
cmp cl, 0x29
je 0x1000525c
lea eax, [ebp - 1]
cmp edx, eax
ja 0x1000525c
cmp esi, 0x800
ja 0x1000525c
mov ecx, dword [esp + 0x10]
mov cl, byte [edx + ecx]
inc edx
inc esi
cmp cl, 7
ja 0x100051e0
mov edi, dword [esp + 0x10]
push edi
call fcn.1012fc21
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1012fc12
add esp, 0x23c
ret
mov ebx, dword [esp + 0x10]
sub edx, edi
mov esi, edx
push esi
lea edx, [edi + ebx - 1]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.10137d10
lea ecx, [esp + 0x28]
push ecx
push str.function__s
mov ecx, 0x12c
lea edi, [esp + 0x130]
mov byte [esp + esi + 0x30], 0
call fcn.10001100
push ebp
push ebx
mov ebx, edi
call fcn.10007c70
add esp, 0x1c
test eax, eax
jne 0x100052f6
lea edx, [esp + 0x1c]
push edx
push 0x1014380c
mov ecx, 0x12c
call fcn.10001100
mov eax, dword [esp + 0x18]
push ebp
push eax
call fcn.10007c70
add esp, 0x10
test eax, eax
je 0x1000525c
mov edi, dword [esp + 0x10]
push edi
mov esi, str.VBS.Encrypted.G
call fcn.1012fc21
push esi
jmp 0x100050b9