Function at 0x10043ec0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f87d8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10126008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10043efb
xor al, al
jmp 0x10043f82
push ecx
lea ecx, [ebp - 0x14]
call fcn.10006eb0
add eax, 0x20
push eax
call fcn.10027df0
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x10043f6f
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea edi, [esi + 4]
push 1
push edi
call ebx
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x10043aa0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x10043f9e
push 0xffffffffffffffff
push edi
call ebx
sub eax, 1
jne 0x10043f67
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.10043c30
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10027e20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f11c3
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x10043fb6
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x10043f56
mov bl, 1
jmp 0x10043f71

Function at 0x100461f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x10126008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x10046272
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x10046272
test ecx, ecx
je 0x1004626e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x10046230
xor eax, eax
jmp 0x10046277
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10046281
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100f11c3
add esp, 0xc
ret 0xc

Function at 0x100467b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x100467e8
mov edx, dword [esp + 4]
test edx, edx
je 0x100467e8
cmp dword [eax], 0xffffffff
je 0x100467e8
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100467e8
mov al, 1
ret 0xc
xor al, al
ret 0xc