Function at 0x1005df70
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098a30
mov eax, dword fs:[0]
push eax
sub esp, 0xd40
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp dword [edi + 0x12c], 0xffffffff
mov ecx, dword [ebp + 0x2c]
mov esi, dword [ebp + 0x30]
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xd2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xd40], edi
mov dword [ebp - 0xd08], eax
mov dword [ebp - 0xd30], ecx
mov dword [ebp - 0xd3c], esi
mov dword [ebp - 0xd24], 0
mov dword [ebp - 0xd04], ebx
mov dword [ebp - 0xd1c], ebx
jne 0x1005e057
cmp dword [edi + 0x118], 0x10
lea ecx, [edi + 0x104]
jb 0x1005e011
mov ecx, dword [ecx]
movzx eax, byte [edi + 0x11e]
sub esp, 8
push eax
push dword [edi + 0x168]
movzx eax, word [edi + 0x11c]
push eax
push ecx
mov ecx, edi
call fcn.1005f390
test al, al
jne 0x1005e051
push 0x100c97a8
lea eax, [ebp - 0xd44]
mov dword [ebp - 0xd44], 0x6a
push eax
call fcn.1008220d
mov eax, dword [ebp - 0xd08]
or ebx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0xd28], ebx
test eax, eax
je 0x1005e0b7
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0xd28], ebx
cmp ebx, 0xffffffff
je 0x1005e13b
lea eax, [esi + 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi], eax
or eax, dword [esi + 4]
jne 0x1005e0b7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or ebx, 0xffffffff
mov dword [ebp - 0xd28], ebx
cmp ebx, 0xffffffff
je 0x1005e13b
mov eax, dword [ebp - 0xd30]
cmp dword [eax + 4], 0
ja 0x1005e102
jb 0x1005e0cf
cmp dword [eax], 0
ja 0x1005e102
mov edx, dword [ebp + 0x38]
test edx, edx
je 0x1005e0e2
cmp dword [esi + 4], 0
ja 0x1005e105
jb 0x1005e0e2
cmp dword [esi], edx
ja 0x1005e105
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0xd1c], 0
mov dword [eax], ebx
jmp 0x1005e154
mov edx, dword [ebp + 0x38]
mov ecx, edx
mov dword [ebp - 0xd1c], 1
add ecx, dword [esi]
mov eax, 0
push 0
adc eax, dword [esi + 4]
add ecx, 0xffffffff
push edx
adc eax, 0xffffffff
push eax
push ecx
call fcn.100820e0
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0xd2c]
mov dword [eax], ebx
jmp 0x1005e154
cmp dword [edi + 0x158], 0
jbe 0x1005ef58
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0xd10], eax
cmp dword [edi + 0x38], 0
jne 0x1005e175
push 0x100c97a8
lea eax, [ebp - 0xd4c]
mov dword [ebp - 0xd4c], 0xc9
push eax
call fcn.1008220d
xor esi, esi
xor ecx, ecx
xor eax, eax
jmp 0x1005e180
cmp dword [eax + 0x100db750], 9
je 0x1005e196
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005e180
jmp 0x1005e1a0
lea eax, [ecx + ecx*4]
lea esi, [eax*4 + 0x100db750]
cmp dword [edi + 0x3c], 0x10
lea eax, [edi + 0x28]
jb 0x1005e1ab
mov eax, dword [eax]
push eax
push str.MAIL_FROM:__s__r_n
push 0x2800
push dword [edi + 0x124]
call fcn.1007a967
add esp, 0x10
mov ecx, edi
push esi
call fcn.10062450
push esi
mov ecx, edi
call fcn.10062b70
cmp dword [edi + 0x140], 0
jne 0x1005e1f8
push 0x100c97a8
lea eax, [ebp - 0xd48]
mov dword [ebp - 0xd48], 0xcb
push eax
call fcn.1008220d
mov ecx, 0xa
call fcn.1005d470
mov esi, dword [edi + 0x13c]
mov ebx, eax
mov esi, dword [esi]
cmp esi, dword [edi + 0x13c]
je 0x1005e24a
cmp dword [esi + 0x34], 0x10
lea eax, [esi + 0x20]
jb 0x1005e21f
mov eax, dword [eax]
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [edi + 0x124]
call fcn.1007a967
add esp, 0x10
mov ecx, edi
push ebx
call fcn.10062450
push ebx
mov ecx, edi
call fcn.10062b70
jmp 0x1005e20a
mov esi, dword [edi + 0x144]
mov esi, dword [esi]
cmp esi, dword [edi + 0x144]
je 0x1005e290
cmp dword [esi + 0x34], 0x10
lea eax, [esi + 0x20]
jb 0x1005e265
mov eax, dword [eax]
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [edi + 0x124]
call fcn.1007a967
add esp, 0x10
mov ecx, edi
push ebx
call fcn.10062450
push ebx
mov ecx, edi
call fcn.10062b70
jmp 0x1005e250
mov esi, dword [edi + 0x14c]
mov esi, dword [esi]
cmp esi, dword [edi + 0x14c]
je 0x1005e2d6
cmp dword [esi + 0x34], 0x10
lea eax, [esi + 0x20]
jb 0x1005e2ab
mov eax, dword [eax]
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [edi + 0x124]
call fcn.1007a967
add esp, 0x10
mov ecx, edi
push ebx
call fcn.10062450
push ebx
mov ecx, edi
call fcn.10062b70
jmp 0x1005e296
xor esi, esi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp dword [eax + 0x100db750], 0xb
je 0x1005e2f6
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005e2e0
jmp 0x1005e300
lea eax, [ecx + ecx*4]
lea esi, [eax*4 + 0x100db750]
push str.DATA_r_n
push 0x2800
push dword [edi + 0x124]
call fcn.1007a967
add esp, 0xc
mov ecx, edi
push esi
call fcn.10062450
push esi
mov ecx, edi
call fcn.10062b70
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0xd18], ebx
xor eax, eax
cmp dword [eax + 0x100db750], 0xc
je 0x1005e34a
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005e334
jmp 0x1005e35a
lea eax, [ecx + ecx*4]
lea ebx, [eax*4 + 0x100db750]
mov dword [ebp - 0xd18], ebx
push dword [ebp - 0xd1c]
mov ecx, edi
push dword [ebp - 0xd10]
push dword [ebp + 0x28]
push dword [ebp - 0xd08]
sub esp, 8
push dword [ebp - 0xd38]
push dword [ebp - 0xd34]
push dword [edi + 0x124]
call fcn.10061600
push ebx
mov ecx, edi
call fcn.10062450
cmp dword [edi + 0x160], 0
je 0x1005e3da
mov esi, dword [edi + 0x15c]
mov esi, dword [esi]
cmp esi, dword [edi + 0x15c]
je 0x1005e3ff
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
jb 0x1005e3b7
mov eax, dword [eax]
push eax
push str._s_r_n
push 0x2800
push dword [edi + 0x124]
call fcn.1007a967
add esp, 0x10
mov ecx, edi
push ebx
call fcn.10062450
jmp 0x1005e3a2
push 0x100c5bf0
push str._s_r_n
push 0x2800
push dword [edi + 0x124]
call fcn.1007a967
add esp, 0x10
mov ecx, edi
push ebx
call fcn.10062450
mov esi, dword [edi + 0x154]
mov esi, dword [esi]
cmp esi, dword [edi + 0x154]
je 0x1005e664
cmp dword [esi + 0x1c], 8
lea ecx, [esi + 8]
jb 0x1005e41e
mov ecx, dword [ecx]
lea edx, [ebp - 0xa4c]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x1005e424
lea eax, [ebp - 0xa4c]
push 0x5c
push eax
call fcn.1007b43d
add esp, 8
test eax, eax
jne 0x1005e452
lea eax, [ebp - 0xa4c]
jmp 0x1005e455
add eax, 2
push 0x2e
push eax
mov dword [ebp - 0xd0c], eax
call fcn.1007b43d
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1005e484
mov edx, dword [ebp - 0xd0c]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e477
jmp 0x1005e4cb
push 0x100c5bf4
add ebx, 2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1005e4b0
mov ecx, 0x100c5bfc
sub ebx, ecx
mov edi, edi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ebx + ecx - 2], ax
test ax, ax
jne 0x1005e4a0
mov edx, dword [ebp - 0xd0c]
mov ecx, edx
lea ebx, [ecx + 2]
jmp 0x1005e4c0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e4c0
push 0
sub ecx, ebx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x24c]
push eax
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
mov byte [ebp + eax - 0x24c], 0
mov al, byte [ebp + ecx - 0x24c]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0xd01], al
test al, al
jne 0x1005e4f4
lea eax, [ebp - 0xd00]
push eax
push eax
push str.__MESSAGE__ID__54yg6f6h6y456345
push str.___s_r_nContent_Type:_application_x_msdownload__name__s__r_nContent_Transfer_Encoding:_base64_r_nContent_Disposition:_attachment__filename__s__r_n_r_n
push dword [edi + 0x124]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov ecx, edi
push dword [ebp - 0xd18]
call fcn.10062450
mov ecx, dword [esi + 0x28]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xd14], ecx
mov dword [ebp - 0xd0c], ebx
mov dword [ebp - 0xd04], eax
push 0
lea eax, [ebp - 0xd20]
push eax
push 0x36
lea eax, [ebp - 0x4c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005e638
mov ebx, dword [ebp - 0xd20]
test ebx, ebx
je 0x1005e632
lea ecx, [ebx + 2]
mov eax, 0x55555556
imul ecx
lea ecx, [ebp - 0x4c]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebx
shl eax, 2
push eax
mov eax, dword [edi + 0x124]
add eax, dword [ebp - 0xd0c]
push eax
call fcn.1005ce50
mov ebx, dword [ebp - 0xd0c]
mov ecx, eax
mov eax, dword [edi + 0x124]
add esp, 8
add eax, ebx
mov byte [eax + ecx], 0xd
mov eax, dword [edi + 0x124]
add eax, ebx
mov byte [eax + ecx + 1], 0xa
add ecx, 2
mov eax, dword [edi + 0x124]
add eax, ebx
add ebx, ecx
mov dword [ebp - 0xd0c], ebx
mov byte [eax + ecx], 0
mov ecx, dword [ebp - 0xd04]
add ecx, 2
add ecx, dword [ebp - 0xd20]
mov dword [ebp - 0xd04], ecx
cmp ecx, 0x1400
mov ecx, dword [ebp - 0xd14]
jb 0x1005e550
push dword [ebp - 0xd18]
xor ebx, ebx
xor eax, eax
mov ecx, edi
mov dword [ebp - 0xd0c], ebx
mov dword [ebp - 0xd04], eax
call fcn.10062450
mov ecx, dword [ebp - 0xd14]
jmp 0x1005e550
mov ebx, dword [ebp - 0xd0c]
test ebx, ebx
je 0x1005e649
push dword [ebp - 0xd18]
mov ecx, edi
call fcn.10062450
push dword [ebp - 0xd14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xd04], 1
jmp 0x1005e405
cmp dword [ebp - 0xd08], 0
je 0x1005eecf
cmp dword [ebp - 0xd28], 0xffffffff
je 0x1005eecf
mov ecx, dword [ebp - 0xd30]
mov edx, dword [ebp - 0xd3c]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
cmp dword [edx + 4], ecx
jb 0x1005eeaa
ja 0x1005e6a2
cmp dword [edx], eax
jbe 0x1005eeaa
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, 0x10000
push eax
push 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov dword [ebp - 0xd0c], eax
test eax, eax
je 0x1005eeaf
xor ecx, ecx
je 0x1005e6e6
mov eax, 0x10000
add eax, 0x36
push eax
push ecx
call ebx
push eax
call esi
mov ebx, eax
mov dword [ebp - 0xd14], ebx
jmp 0x1005e6ee
mov ebx, eax
mov dword [ebp - 0xd14], eax
test ebx, ebx
je 0x1005ee8b
push 0x5c
push dword [ebp - 0xd08]
call fcn.1007b43d
xor edx, edx
lea esi, [ebp - 0xa4c]
add esp, 8
mov dword [ebp - 0xd08], edx
xor eax, eax
lea ecx, [esi + 2]
mov word [ebp - 0xa4c], ax
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005e720
mov eax, dword [ebp - 0xd34]
sub esi, ecx
sar esi, 1
movzx eax, word [eax]
test ax, ax
je 0x1005e77e
xor ecx, ecx
nop
movzx eax, ax
push eax
lea eax, [ecx + esi]
lea ecx, [ebp - 0xa4c]
lea eax, [ecx + eax*2]
push str._02X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0xd08]
add esp, 0xc
mov eax, dword [ebp - 0xd34]
inc edx
mov dword [ebp - 0xd08], edx
lea ecx, [edx + edx]
movzx eax, word [ecx + eax]
test ax, ax
jne 0x1005e740
lea eax, [esi + edx*2]
xor ecx, ecx
mov word [ebp + eax*2 - 0xa4c], cx
lea ecx, [ebp - 0xa4c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e794
sub ecx, edx
mov eax, 0x5f
sar ecx, 1
mov word [ebp + ecx*2 - 0xa4c], ax
lea esi, [ebp + ecx*2 - 0xa4a]
mov ecx, dword [ebp - 0xd38]
test ecx, ecx
je 0x1005e7d5
sub esi, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x1005e7c3
jmp 0x1005e828
xor eax, eax
je 0x1005e828
mov ecx, esi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e7e0
sub ecx, edx
xor eax, eax
sar ecx, 1
mov word [esi + ecx*2 + 0x12], ax
test ecx, ecx
je 0x1005e80d
lea ebx, [ebx]
mov ax, word [esi + ecx*2 - 2]
dec ecx
mov word [esi + ecx*2 + 0x12], ax
jne 0x1005e800
xor eax, eax
push eax
push str._08x
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, 0x5f
add esp, 0xc
mov word [esi + 0x10], ax
lea eax, [ebp - 0xa4c]
push 0x2e
push eax
call fcn.1007b43d
mov esi, eax
add esp, 8
test esi, esi
jne 0x1005e8ae
lea esi, [ebp - 0xa4c]
lea ecx, [esi + 2]
jmp 0x1005e850
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005e850
sub esi, ecx
sar esi, 1
cmp dword [ebp - 0xd1c], 0
je 0x1005e95f
mov eax, dword [ebp + 0x28]
lea ebx, [ebp - 0xa4c]
inc eax
lea ebx, [ebx + esi*2]
push eax
push dword [ebp - 0xd10]
push str.._04d__04d
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1005e892
sub ebx, ecx
sar ebx, 1
add esi, ebx
mov ebx, dword [ebp - 0xd14]
jmp 0x1005e95f
cmp dword [ebp - 0xd1c], 0
je 0x1005e90e
lea esi, [ebp - 0xa4c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005e8c0
mov eax, dword [ebp + 0x28]
lea ebx, [ebp - 0xa4c]
sub esi, ecx
inc eax
push eax
push dword [ebp - 0xd10]
sar esi, 1
push str.._04d__04d
lea ebx, [ebx + esi*2]
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1005e8f5
sub ebx, ecx
sar ebx, 1
add esi, ebx
mov ebx, dword [ebp - 0xd14]
jmp 0x1005e95f
push 0x100c5bf4
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1005e940
mov ecx, 0x100c5bfc
sub esi, ecx
jmp 0x1005e930
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x1005e930
lea esi, [ebp - 0xa4c]
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005e950
sub esi, ecx
sar esi, 1
push 0
push 0
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x24c]
push eax
push esi
lea eax, [ebp - 0xa4c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
mov byte [ebp + eax - 0x24c], 0
lea ebx, [ebx]
mov al, byte [ebp + ecx - 0x24c]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0xd01], al
test al, al
jne 0x1005e990
lea eax, [ebp - 0xd00]
push eax
push eax
push str.__MESSAGE__ID__54yg6f6h6y456345
push str.___s_r_nContent_Type:_application_x_msdownload__name__s__r_nContent_Transfer_Encoding:_base64_r_nContent_Disposition:_attachment__filename__s__r_n_r_n
push dword [edi + 0x124]
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [ebp - 0xd18]
add esp, 0x14
mov ecx, edi
push esi
call fcn.10062450
mov eax, dword [ebp - 0xd30]
cmp dword [eax + 4], 0
ja 0x1005e9e5
cmp dword [eax], 0
jbe 0x1005e9fa
push 0
push 0
push dword [eax + 4]
push dword [eax]
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [ebp - 0xd0c]
xor esi, esi
xor eax, eax
mov dword [ebp - 0xd24], esi
cmp edx, ebx
jne 0x1005ec1c
xor ebx, ebx
mov dword [ebp - 0xd10], eax
xor ecx, ecx
mov dword [ebp - 0xd08], ebx
mov dword [ebp - 0xd04], ecx
cmp dword [ebp + 0x38], 0
je 0x1005ea40
mov eax, 0x10000
sub eax, ecx
add eax, esi
cmp eax, dword [ebp + 0x38]
ja 0x1005eb87
push 0
lea eax, [ebp - 0xd20]
push eax
mov eax, 0x10000
sub eax, ecx
push eax
lea eax, [ecx + edx]
push eax
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005eb81
mov eax, dword [ebp - 0xd20]
test eax, eax
je 0x1005eb81
add esi, eax
add eax, dword [ebp - 0xd04]
mov dword [ebp - 0xd24], esi
xor esi, esi
mov dword [ebp - 0xd20], eax
mov dword [ebp - 0xd04], esi
cmp esi, eax
jae 0x1005eb6a
mov ebx, eax
sub ebx, esi
cmp ebx, 0x36
jae 0x1005ead2
test ebx, ebx
je 0x1005eac2
mov eax, dword [ebp - 0xd14]
mov edx, ebx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
mov byte [eax - 1], cl
dec edx
jne 0x1005eab0
mov eax, dword [ebp - 0xd20]
add esi, ebx
mov dword [ebp - 0xd04], ebx
mov ebx, dword [ebp - 0xd08]
jmp 0x1005ea93
mov eax, dword [edi + 0x124]
mov edx, 0x36
mov ecx, dword [ebp - 0xd14]
mov ebx, dword [ebp - 0xd08]
add eax, ebx
push 0x48
push eax
lea ecx, [esi + ecx]
call fcn.1005ce50
mov ecx, eax
add esp, 8
mov eax, dword [edi + 0x124]
add eax, ebx
mov byte [eax + ecx], 0xd
mov eax, dword [edi + 0x124]
add eax, ebx
mov byte [eax + ecx + 1], 0xa
add ecx, 2
mov eax, dword [edi + 0x124]
add eax, ebx
add ebx, ecx
mov dword [ebp - 0xd08], ebx
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0xd10]
add eax, 0x38
mov dword [ebp - 0xd10], eax
cmp eax, 0x1400
jb 0x1005eb5c
push dword [ebp - 0xd18]
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 0xd08], ebx
mov dword [ebp - 0xd10], ebx
call fcn.10062450
mov eax, dword [ebp - 0xd20]
add esi, 0x36
jmp 0x1005ea93
mov ecx, dword [ebp - 0xd04]
mov edx, dword [ebp - 0xd0c]
mov esi, dword [ebp - 0xd24]
jmp 0x1005ea28
mov ecx, dword [ebp - 0xd04]
test ecx, ecx
je 0x1005ee41
add ecx, 2
mov eax, 0x55555556
imul ecx
mov ecx, dword [ebp - 0xd14]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xd04]
shl eax, 2
push eax
mov eax, dword [edi + 0x124]
add eax, ebx
push eax
call fcn.1005ce50
mov ecx, eax
mov esi, dword [ebp - 0xd18]
mov eax, dword [edi + 0x124]
add esp, 8
add eax, ebx
mov byte [eax + ecx], 0xd
mov eax, dword [edi + 0x124]
add eax, ebx
mov byte [eax + ecx + 1], 0xa
add ecx, 2
mov eax, dword [edi + 0x124]
add eax, ebx
add ebx, ecx
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0xd10]
add eax, 2
add eax, dword [ebp - 0xd04]
cmp eax, 0x1400
jb 0x1005ee47
push esi
mov ecx, edi
xor ebx, ebx
call fcn.10062450
jmp 0x1005ee47
xor ebx, ebx
mov dword [ebp - 0xd04], eax
xor esi, esi
mov dword [ebp - 0xd10], ebx
mov dword [ebp - 0xd1c], esi
mov ecx, dword [ebp + 0x38]
test ecx, ecx
je 0x1005ec54
mov eax, dword [ebp - 0xd24]
mov ebx, 0x10000
add eax, ebx
mov ebx, dword [ebp - 0xd10]
cmp eax, ecx
ja 0x1005edad
push 0
lea eax, [ebp - 0xd20]
push eax
mov eax, 0x10000
push eax
push edx
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005edad
mov edx, dword [ebp - 0xd20]
test edx, edx
je 0x1005edad
mov ecx, dword [ebp - 0xd0c]
lea eax, [ebp - 0xd08]
add dword [ebp - 0xd24], edx
push eax
mov eax, dword [ebp - 0xd14]
add eax, esi
push eax
xor eax, eax
push 0
push eax
call fcn.1005d0c0
mov eax, dword [ebp - 0xd08]
add esp, 0x10
add eax, esi
xor esi, esi
mov dword [ebp - 0xd08], eax
mov dword [ebp - 0xd1c], esi
cmp esi, eax
jae 0x1005ed9c
mov ebx, eax
sub ebx, esi
cmp ebx, 0x36
jae 0x1005ed04
test ebx, ebx
je 0x1005ecf4
mov ecx, dword [ebp - 0xd14]
mov edx, ebx
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec edx
jne 0x1005ece2
mov eax, dword [ebp - 0xd08]
add esi, ebx
mov dword [ebp - 0xd1c], ebx
mov ebx, dword [ebp - 0xd10]
jmp 0x1005ecc5
mov eax, dword [edi + 0x124]
mov edx, 0x36
mov ecx, dword [ebp - 0xd14]
mov ebx, dword [ebp - 0xd10]
add eax, ebx
push 0x48
push eax
lea ecx, [esi + ecx]
call fcn.1005ce50
mov ecx, eax
add esp, 8
mov eax, dword [edi + 0x124]
add eax, ebx
mov byte [eax + ecx], 0xd
mov eax, dword [edi + 0x124]
add eax, ebx
mov byte [eax + ecx + 1], 0xa
add ecx, 2
mov eax, dword [edi + 0x124]
add eax, ebx
add ebx, ecx
mov dword [ebp - 0xd10], ebx
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0xd04]
add eax, 0x38
mov dword [ebp - 0xd04], eax
cmp eax, 0x1400
jb 0x1005ed8e
push dword [ebp - 0xd18]
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 0xd10], ebx
mov dword [ebp - 0xd04], ebx
call fcn.10062450
mov eax, dword [ebp - 0xd08]
add esi, 0x36
jmp 0x1005ecc5
mov esi, dword [ebp - 0xd1c]
mov edx, dword [ebp - 0xd0c]
jmp 0x1005ec32
mov ecx, dword [ebp - 0xd1c]
test ecx, ecx
je 0x1005ee41
add ecx, 2
mov eax, 0x55555556
imul ecx
mov ecx, dword [ebp - 0xd14]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xd1c]
shl eax, 2
push eax
mov eax, dword [edi + 0x124]
add eax, ebx
push eax
call fcn.1005ce50
mov ecx, eax
add esp, 8
mov eax, dword [edi + 0x124]
add eax, ebx
mov byte [eax + ecx], 0xd
mov eax, dword [edi + 0x124]
add eax, ebx
mov byte [eax + ecx + 1], 0xa
add ecx, 2
mov eax, dword [edi + 0x124]
add eax, ebx
add ebx, ecx
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0xd04]
add eax, 2
add eax, dword [ebp - 0xd1c]
cmp eax, 0x1400
jb 0x1005ee41
mov esi, dword [ebp - 0xd18]
mov ecx, edi
push esi
xor ebx, ebx
call fcn.10062450
jmp 0x1005ee47
mov esi, dword [ebp - 0xd18]
test ebx, ebx
je 0x1005ee53
push esi
mov ecx, edi
call fcn.10062450
mov eax, dword [ebp - 0xd14]
mov ebx, 1
cmp dword [ebp - 0xd0c], eax
je 0x1005ee91
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
push dword [ebp - 0xd0c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
jmp 0x1005eeb5
mov ebx, dword [ebp - 0xd04]
push dword [ebp - 0xd0c]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
jmp 0x1005eeb5
mov dword [edx], eax
mov dword [edx + 4], ecx
mov ebx, dword [ebp - 0xd04]
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd2c]
mov dword [eax], 0xffffffff
jmp 0x1005eed5
mov ebx, dword [ebp - 0xd04]
test ebx, ebx
je 0x1005ef03
push str.__MESSAGE__ID__54yg6f6h6y456345
push str._r_n___s___r_n
push 0x2800
push dword [edi + 0x124]
call fcn.1007a967
add esp, 0x10
mov ecx, edi
push dword [ebp - 0xd18]
call fcn.10062450
xor esi, esi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp dword [eax + 0x100db750], 0xd
je 0x1005ef26
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005ef10
jmp 0x1005ef30
lea eax, [ecx + ecx*4]
lea esi, [eax*4 + 0x100db750]
push str._r_n._r_n
push 0x2800
push dword [edi + 0x124]
call fcn.1007a967
add esp, 0xc
mov ecx, edi
push esi
call fcn.10062450
push esi
mov ecx, edi
call fcn.10062b70
mov eax, dword [ebp - 0xd24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007a730
mov esp, ebp
pop ebp
ret 0x34