Function at 0x101387c0
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
lea esi, [esp + 0x54]
movsd qword [esp + 0x40], xmm0
movsd qword [esp + 0x38], xmm1
movsd qword [esp + 0x30], xmm2
jmp 0x10138808
mov dword [esp + 0x4c], esi
lea esi, [esp + 0x54]
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x2c], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov eax, ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x7c], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x60], ecx
add ecx, 4
xor edx, edx
mov dword [esp + 0x74], ecx
cmp eax, ebx
mov dword [esp + 0x24], edx
jb 0x10138924
mov dword [esp + 0x18], eax
mov dword [esp + 4], ebx
jmp 0x10138894
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
push ebx
call fcn.1017dcb0
add esp, 4
cmp al, 0x23
jne 0x10138910
xorps xmm0, xmm0
mov dword [esp + 0x54], 0
movaps xmmword [esp + 0x80], xmm0
mov dword [esp + 0x90], esi
push 0x10178660
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x84]
push dword [esp + 0x6c]
push dword [esp + 0x88]
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x10138880
nop word cs:[eax + eax]
push 1
push 0xffffffffffffffff
call sub.KERNEL32.dll_SleepEx
cmp dword [esp + 0x54], 0
je 0x101388e0
mov ebx, dword [esp + 0x58]
test ebx, ebx
jne 0x10138887
mov ebx, dword [esp + 0x5c]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
cmovbe eax, ebx
mov dword [esp + 0x1c], eax
jmp 0x1013891e
movzx eax, al
cmp eax, 0xb
jne 0x10138b20
xor ebx, ebx
mov edx, dword [esp + 0x24]
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword [esp + 4], ebx
sub ebx, eax
mov dword [esp + 0x18], eax
cmp ebx, 8
lea esi, [ecx + eax]
jae 0x10138970
test ebx, ebx
je 0x10138a20
xor ecx, ecx
nop word cs:[eax + eax]
nop
cmp byte [esi + ecx], 0xa
je 0x10138a73
inc ecx
cmp ebx, ecx
jne 0x10138950
jmp 0x10138a20
lea eax, [esi + 3]
and eax, 0xfffffffc
sub eax, esi
je 0x101389a0
je 0x101389a0
xor ecx, ecx
nop
cmp byte [esi + ecx], 0xa
je 0x10138a6f
inc ecx
cmp eax, ecx
jne 0x10138980
lea ecx, [ebx - 8]
cmp eax, ecx
mov dword [esp + 0x28], ecx
jbe 0x101389a9
jmp 0x10138a04
lea eax, [ebx - 8]
mov dword [esp + 0x28], eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x74]
add edx, ecx
nop word cs:[eax + eax]
nop dword [eax]
mov edi, dword [edx + eax - 4]
mov ecx, edi
xor edi, 0xa0a0a0a
not ecx
add edi, 0xfefefeff
and edi, ecx
test edi, 0x80808080
jne 0x10138a04
mov ecx, dword [edx + eax]
mov edi, ecx
xor ecx, 0xa0a0a0a
not edi
add ecx, 0xfefefeff
and ecx, edi
test ecx, 0x80808080
jne 0x10138a04
add eax, 8
cmp eax, dword [esp + 0x28]
jbe 0x101389c0
mov edx, dword [esp + 0x24]
cmp ebx, eax
je 0x10138a20
nop dword [eax]
cmp byte [esi + eax], 0xa
je 0x10138b0a
inc eax
cmp ebx, eax
jne 0x10138a10
nop
mov eax, dword [esp + 0xc]
sub eax, edx
cmp eax, ebx
jae 0x10138a50
lea ecx, [esp + 8]
push ebx
call fcn.1013e8f0
add esp, 4
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
jmp 0x10138a54
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
add eax, edx
push ebx
push esi
push eax
mov esi, edx
call sub.msvcrt.dll_memcpy
mov edx, esi
add esp, 0xc
add edx, ebx
xor eax, eax
jmp 0x10138ac7
mov edx, dword [esp + 0x24]
cmp ecx, 0xffffffff
je 0x10138dc0
lea edi, [ecx + 1]
cmp ecx, ebx
jae 0x10138d97
mov eax, dword [esp + 0xc]
sub eax, edx
cmp eax, ecx
jbe 0x10138a97
mov eax, dword [esp + 0x2c]
jmp 0x10138aac
lea ecx, [esp + 8]
push edi
call fcn.1013e8f0
add esp, 4
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
add eax, edx
push edi
push esi
push eax
mov esi, edx
call sub.msvcrt.dll_memcpy
mov edx, esi
add esp, 0xc
add edx, edi
mov al, 1
mov ebx, edi
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 4]
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], 0
add esi, ebx
cmp esi, ecx
cmovae esi, ecx
add dword [esp + 0x20], ebx
test al, al
mov al, 4
mov ecx, esi
lea esi, [esp + 0x54]
mov dword [esp + 0x50], eax
jne 0x10138d35
test ebx, ebx
mov ebx, dword [esp + 4]
mov eax, ecx
jne 0x10138863
jmp 0x10138b3e
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x10138a7c
jmp 0x10138dc0
mov al, 1
mov dword [esp + 0x20], ebx
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 4]
mov dword [esp + 0x50], 0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 8]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
push edx
push esi
lea eax, [esp + 0x88]
push eax
mov ebx, edx
call fcn.1002ad90
add esp, 0xc
cmp dword [esp + 0x80], 0
mov ecx, 0
cmovne ebx, ecx
mov ecx, dword [esp + 0x28]
sete al
or al, cl
je 0x10138bb0
mov edx, ebx
test cl, cl
mov dword [esp + 0x10], ebx
je 0x10138cf0
movzx eax, byte [esp + 0x50]
mov ecx, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
cmp dword [esp + 0xc], 0
jne 0x10138bd6
jmp 0x10138be9
xor ebx, ebx
mov ecx, 0x103879e4
mov dword [esp + 0x10], 0
mov dword [esp + 0x48], 2
mov dword [esp + 0x4c], 0
cmp dword [esp + 0xc], 0
je 0x10138be9
push esi
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
mov esi, ecx
call sub.KERNEL32.dll_HeapFree
mov ecx, esi
test bl, bl
jne 0x10138d6d
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
lea edi, [esp + 0x80]
test esi, esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
je 0x10138d64
movsd xmm0, qword [esp + 0x64]
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x70], ecx
movsd qword [esp + 8], xmm0
cmp eax, 0xe
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 8]
jb 0x10138c60
push 0xd
push str.POWERSHELL_
push eax
push ecx
push edi
call fcn.1002b3c0
add esp, 0x14
lea ecx, [esp + 0x54]
mov edx, edi
call fcn.1013f140
cmp dword [esp + 0x54], 0
jne 0x10138c79
jmp 0x10138cc9
cmp eax, 0xd
jne 0x10138cc9
push 0xd
push ecx
push str.POWERSHELL_
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10138cc9
lea eax, [esp + 8]
lea ecx, [esp + 0x54]
mov dword [esp + 0x80], 0x10437468
mov dword [esp + 0x84], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x88], ecx
mov dword [esp + 0x58], 0x1013e980
mov dword [esp + 0x8c], 1
push edi
call fcn.100748a0
add esp, 4
cmp dword [esp + 0xc], 0
je 0x10138800
push dword [esp + 8]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10138800
cmp dword [esp + 0x20], 0
je 0x10138d1f
xor ecx, ecx
test edx, edx
je 0x10138d40
cmp byte [esi + edx - 1], 0xa
lea edi, [esp + 0x80]
jne 0x10138d49
mov eax, edx
dec eax
je 0x10138d4b
cmp byte [esi + edx - 2], 0xd
lea ecx, [edx - 2]
cmove eax, ecx
mov ecx, eax
jmp 0x10138d4b
mov ecx, dword [esp + 0x70]
mov bl, 1
cmp dword [esp + 0xc], 0
jne 0x10138bd6
jmp 0x10138be9
mov ebx, dword [esp + 4]
mov eax, ecx
jmp 0x10138b3e
lea edi, [esp + 0x80]
jmp 0x10138d4b
mov ecx, edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x6c], ecx
jmp 0x10138c14
lea ecx, [esp + 0x64]
call fcn.1013d1f0
cmp dword [esp + 0x34], 0
je 0x10138d86
push dword [esp + 0x30]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x44]
call sub.KERNEL32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ecx
push 0x103879b0
push ebx
push edi
call fcn.1002ac30
add esp, 0xc
jmp 0x10138de5
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ecx
push 0x103879b0
call fcn.1002acf0
add esp, 4
ud2