Function at 0x1003696
Capabilities:
Read file via mapping

Disassembly:
push 0x27c
push 0x10039c8
call fcn.010039e4
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x238], ebx
xor esi, esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x230], esi
mov eax, dword [0x100c074]
cmp eax, 0xffffffff
je 0x10058c4
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, dword [ebp - 0x268]
mov dword [ebp - 0x248], edi
cmp eax, esi
je 0x10058cf
cmp edi, 0x40000000
jae 0x1005c29
cmp dword [ebp - 0x26c], esi
jne 0x1005c29
push dword [0x100c090]
call dword [sym.imp.USER32.dll_SetCursor]
cmp edi, esi
je 0x10058da
xor ebx, ebx
mov dword [ebp - 0x240], ebx
push esi
push edi
push esi
push 2
push esi
push dword [0x100c074]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x258], eax
cmp eax, esi
je 0x100376e
push edi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x240], ebx
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x100c074]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x100c074], 0xffffffff
cmp ebx, esi
je 0x10058f4
mov dword [ebp - 4], esi
mov dword [ebp - 0x23c], ebx
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x1005a60
movzx eax, word [ebx]
cmp eax, 0xbbef
je 0x100592c
cmp eax, 0xfeff
jne 0x1005908
xor eax, eax
inc eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov esi, edi
shr esi, 1
dec esi
mov dword [ebp - 0x228], esi
xor eax, eax
cmp dword [ebp - 0x234], eax
je 0x100596e
push eax
push eax
push 0xb
push dword [0x100c028]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
call edi
push 0
push 0
push 0xb1
push dword [0x100c028]
call edi
push 0
push 0
push 0xb7
push dword [0x100c028]
call edi
push 2
lea eax, [esi + esi + 2]
push eax
push dword [0x100c098]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x1005993
push eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x234], 0
je 0x1005b08
movzx ecx, word [ebx]
mov edx, 0xfeff
cmp cx, dx
jne 0x1005ae4
lea ecx, [esi + esi]
push ecx
lea ecx, [ebx + 2]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x22c]
mov dword [0x100c00c], eax
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x24c]
cmp ebx, eax
je 0x1003893
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x254]
test eax, eax
je 0x10038db
mov ecx, eax
test esi, esi
jbe 0x10038bf
mov edx, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx], 0
je 0x1005b77
inc ecx
inc ecx
dec edx
jne 0x10038b0
xor ecx, ecx
mov word [eax + esi*2], cx
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x2e
je 0x1005b82
and dword [ebp - 0x244], 0
mov ebx, dword [ebp - 0x250]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov dword [0x100c098], ebx
push dword [ebp - 0x238]
push 0x104
push 0x100cae0
call fcn.0100293e
push dword [ebp - 0x238]
call fcn.0100283c
xor ebx, ebx
mov dword [0x100c008], ebx
mov dword [0x100c030], 1
push ebx
push dword [0x100c098]
push 0xbc
push dword [0x100c028]
call edi
cmp dword [0x100c030], 2
je 0x1005bb9
mov dword [0x100c030], ebx
push ebx
push ebx
push 0xc5
push dword [0x100c028]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 0x244], ebx
jne 0x1005bff
xor esi, esi
inc esi
push esi
push ebx
push 0xbe
push 0x115
push dword [0x100c028]
call edi
push eax
push esi
push dword [0x100c020]
call dword [sym.imp.USER32.dll_SetScrollPos]
push ebx
push esi
push 0xb
push dword [0x100c028]
call edi
push esi
push ebx
push dword [0x100c028]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x100c028]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x100c094]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, esi
call fcn.01002295
ret 8
push ebx
call fcn.01007c4a
jmp 0x1005c56
push ebx
call fcn.01007c4a
jmp 0x1005c43
lea ebx, [ebp - 0x24c]
mov dword [ebp - 0x240], ebx
xor eax, eax
mov word [ebp - 0x24c], ax
jmp 0x100376e
push dword [0x100c094]
call dword [sym.imp.USER32.dll_SetCursor]
push dword [ebp - 0x238]
jmp 0x10058c5
cmp eax, 0xfffe
jne 0x1005a07
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x22c], 2
jmp 0x10037c6
cmp edi, 2
jbe 0x1005a07
cmp byte [ebx + 2], 0xbf
jne 0x1005a07
mov dword [ebp - 0x230], 0xfde9
push 3
pop eax
mov dword [ebp - 0x22c], eax
lea ecx, [ebx + 3]
mov dword [ebp - 0x23c], ecx
sub edi, eax
mov dword [ebp - 0x248], edi
mov esi, dword [ebp - 0x228]
jmp 0x10037d1
push eax
push eax
push edi
push dword [ebp - 0x23c]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
mov dword [ebp - 0x228], esi
xor eax, eax
jmp 0x10037df
push dword [ebp - 0x238]
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.0100293e
xor esi, esi
push esi
call fcn.0100800c
push dword [0x100c094]
call dword [sym.imp.USER32.dll_SetCursor]
push 0x30
lea eax, [ebp - 0x224]
push eax
push dword [0x100c2cc]
push dword [0x100c2d0]
push dword [0x100c020]
call fcn.01007071
lea eax, [ebp - 0x24c]
cmp ebx, eax
je 0x10059ef
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
push esi
push 0xb
push dword [0x100c028]
call edi
mov dword [ebp - 4], 0xfffffffe
jmp 0x1005c56
push edi
push ebx
call fcn.01009975
mov dword [ebp - 0x234], eax
cmp eax, esi
je 0x1005a2b
mov dword [ebp - 0x22c], 1
mov esi, edi
shr esi, 1
jmp 0x10037cb
push edi
push ebx
call fcn.0100991f
test eax, eax
je 0x1005a4f
mov dword [ebp - 0x22c], 3
mov dword [ebp - 0x230], 0xfde9
jmp 0x1005963
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], esi
jmp 0x1005963
dec eax
je 0x1005ace
dec eax
je 0x1005aa2
dec eax
jne 0x1005a4f
mov dword [ebp - 0x230], 0xfde9
push 3
pop eax
mov dword [ebp - 0x22c], eax
cmp edi, 2
jbe 0x1005963
mov ecx, 0xbbef
cmp word [ebx], cx
jne 0x1005963
cmp byte [ebx + 2], 0xbf
je 0x1005952
jmp 0x1005963
xor eax, eax
inc eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov eax, 0xfffe
mov esi, edi
shr esi, 1
mov dword [ebp - 0x228], esi
cmp word [ebx], ax
je 0x10037ca
jmp 0x10037d1
xor eax, eax
inc eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov eax, 0xfeff
jmp 0x1005ab6
mov edx, 0xfffe
cmp cx, dx
jne 0x1005afe
push esi
lea ecx, [ebx + 2]
push ecx
push eax
call fcn.01007aac
jmp 0x1003870
lea ecx, [esi + esi]
push ecx
push ebx
jmp 0x1003867
push esi
push eax
push dword [ebp - 0x248]
push dword [ebp - 0x23c]
push 0
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
mov dword [ebp - 0x228], esi
jmp 0x1003870
push 0x20
pop ebx
mov word [ecx], bx
jmp 0x10038ba
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x4c
jne 0x10038d4
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x4f
jne 0x10038d4
cmp word [eax], 0x47
jne 0x10038d4
mov dword [ebp - 0x244], 1
jmp 0x10038db
push dword [0x100c094]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x100c030], ebx
push 0x30
push dword [ebp - 0x238]
push dword [0x100c2cc]
push dword [0x100c2d0]
push dword [0x100c020]
call fcn.01007071
push ebx
call fcn.0100800c
push ebx
push 1
push 0xb
push dword [0x100c028]
call edi
jmp 0x1005c56
push esi
push esi
push 0xb1
push dword [0x100c028]
call edi
push ebx
push ebx
push 0xb7
push dword [0x100c028]
call edi
push 1
call fcn.010097e1
jmp 0x1003966
push 0x30
push ebx
push dword [0x100c2cc]
push dword [0x100c2d0]
push dword [0x100c020]
call fcn.01007071
push dword [0x100c074]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x100c074], 0xffffffff
xor eax, eax
jmp 0x10039bf