Function at 0x1000ec37
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x1003f4b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xa0], ecx
mov ebx, edi
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x88], edi
test ecx, ecx
jne 0x1000ec7b
mov eax, 0x80070057
jmp 0x1000ef34
push esi
push edi
push edi
push 3
push edi
push edi
push SysReAllocString
push dword [eax + 0x24]
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x1000eca0
mov eax, 0x80004005
jmp 0x1000ef33
push edi
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x1000ecd2
push edi
push 2
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.kernel32.dll_GlobalLock]
push 0
lea ecx, [ebp - 0x98]
push ecx
push edi
push eax
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
push ebx
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebp - 0x88]
mov esi, 0x80004005
push eax
xor eax, eax
inc eax
push eax
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x1000ef31
lea eax, [ebp - 0x70]
xor ebx, ebx
push eax
push 0x100327d0
push ebx
push edi
push dword [ebp - 0x88]
mov dword [ebp - 0x70], ebx
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
test eax, eax
js 0x1000ef25
push ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
push edi
mov dword [ebp - 0x7c], edi
call esi
push edi
mov ebx, eax
call esi
mov edi, eax
mov eax, 0x80004005
mov dword [ebp - 0x8c], edi
mov esi, eax
test ebx, ebx
je 0x1000ef17
test edi, edi
je 0x1000ef17
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x80]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x74]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x9ec
push 0x58
push ebx
call edi
mov esi, dword [sym.imp.kernel32.dll_MulDiv]
push eax
push dword [ebp - 0x80]
call esi
push 0x9ec
push 0x5a
push ebx
mov dword [ebp - 0x78], eax
call edi
push eax
push dword [ebp - 0x74]
call esi
push 0x28
pop edi
mov esi, eax
lea eax, [ebp - 0x40]
push edi
push 0
push eax
mov dword [ebp - 0x84], esi
call fcn.100182f0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x3c], eax
xor eax, eax
push 0x18
mov dword [ebp - 0x38], esi
inc eax
pop esi
push edi
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x6c]
push 0
push eax
mov dword [ebp - 0x40], edi
mov word [ebp - 0x32], si
call fcn.100182f0
mov ecx, dword [ebp - 0x94]
add esp, 0x18
mov dword [ebp - 0x6c], edi
mov edi, dword [ebp - 0x7c]
mov word [ebp - 0x5e], si
mov eax, dword [ecx + 0x28]
mov esi, dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x68], eax
mov eax, dword [ecx + 0x2c]
xor ecx, ecx
mov dword [ebp - 0x64], eax
xor eax, eax
push ecx
inc eax
mov dword [ebp - 0x90], ecx
push ecx
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x90]
push eax
push ecx
lea eax, [ebp - 0x40]
push eax
push edi
call esi
xor ecx, ecx
mov dword [ebp - 0x7c], eax
push ecx
push ecx
lea eax, [ebp - 0x90]
push eax
push ecx
lea eax, [ebp - 0x6c]
push eax
push edi
call esi
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push ebx
mov dword [ebp - 0xa4], edi
call esi
push edi
mov edi, dword [ebp - 0x8c]
push edi
mov dword [ebp - 0x9c], eax
call esi
mov ecx, dword [ebp - 0x70]
mov esi, 0x80004005
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x78]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x74]
mov edx, dword [ecx]
neg eax
push eax
push dword [ebp - 0x80]
xor eax, eax
push dword [ebp - 0x74]
push eax
push dword [ebp - 0x84]
push dword [ebp - 0x78]
push eax
push eax
push ebx
push ecx
call dword [edx + 0x20]
test eax, eax
js 0x1000ef05
mov eax, dword [ebp - 0x94]
xor ecx, ecx
push 0xcc0020
push dword [ebp - 0x84]
push dword [ebp - 0x78]
push ecx
push ecx
push ebx
push dword [eax + 0x2c]
push dword [eax + 0x28]
push ecx
push ecx
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
push dword [ebp - 0x9c]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call esi
push dword [ebp - 0x8c]
push edi
call esi
mov eax, dword [ebp - 0xa0]
xor esi, esi
mov ecx, dword [ebp - 0xa4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [ebp - 0x7c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0x88]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10014eac
leave
ret 4