Function at 0x10183cf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x102c22c]
and dword [ebp - 0x124], 0
push esi
mov esi, dword [ebp + 8]
test esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x12c], eax
je 0x1018687
test eax, eax
je 0x1018687
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101840b
sub eax, edx
cmp eax, 5
jb 0x1018687
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1018422
sub eax, edx
lea eax, [esi + eax - 4]
push eax
push 0x10056bc
call sub.ntdll.dll__stricmp
test eax, eax
pop ecx
pop ecx
jne 0x1018687
push ebx
push 0x8000
push esi
call sub.msvcrt.dll__open
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
mov dword [ebp - 0x108], ebx
je 0x1018686
push 0xc
lea eax, [ebp - 0x158]
push eax
push ebx
call sub.msvcrt.dll__read
add esp, 0xc
cmp eax, 0xc
jne 0x101867a
xor eax, eax
mov ah, byte [ebp - 0x154]
push edi
xor esi, esi
mov al, byte [ebp - 0x153]
mov edi, eax
test edi, edi
jbe 0x1018679
cmp esi, 0x28
jae 0x1018679
push 0x10
lea eax, [ebp - 0x13c]
push eax
push ebx
call sub.msvcrt.dll__read
add esp, 0xc
cmp eax, 0x10
jne 0x1018679
cmp dword [ebp - 0x13c], 0x656d616e
je 0x10184d3
inc esi
cmp esi, edi
jb 0x1018499
jmp 0x1018679
mov eax, dword [ebp - 0x134]
mov esi, eax
mov ecx, eax
shr ecx, 0x10
mov ebx, 0xff0000
and esi, ebx
or esi, ecx
mov ecx, eax
shl ecx, 0x10
mov edi, 0xff00
and eax, edi
or ecx, eax
shl ecx, 8
shr esi, 8
or esi, ecx
push 0
push esi
push dword [ebp - 0x108]
call sub.msvcrt.dll__lseek
add esp, 0xc
cmp eax, esi
jne 0x1018679
push 6
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x108]
call sub.msvcrt.dll__read
add esp, 0xc
cmp eax, 6
jne 0x1018679
xor eax, eax
mov ah, byte [ebp - 0x11e]
mov al, byte [ebp - 0x11d]
mov dword [ebp - 0x10c], eax
jmp 0x101866c
dec dword [ebp - 0x10c]
push 0xc
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x108]
call sub.msvcrt.dll__read
add esp, 0xc
cmp eax, 0xc
jne 0x1018679
movzx ax, byte [ebp - 0x117]
mov ah, byte [ebp - 0x118]
cmp ax, 1
jne 0x101866c
movzx ax, byte [ebp - 0x111]
mov ah, byte [ebp - 0x112]
cmp ax, 5
jne 0x101866c
mov eax, dword [ebp - 0x134]
mov esi, eax
mov ecx, eax
shr ecx, 0x10
and esi, ebx
or esi, ecx
mov ecx, eax
and eax, edi
shl ecx, 0x10
or ecx, eax
xor eax, eax
mov ah, byte [ebp - 0x11c]
shr esi, 8
shl ecx, 8
or esi, ecx
push 0
mov al, byte [ebp - 0x11b]
add esi, eax
xor eax, eax
mov ah, byte [ebp - 0x10e]
mov al, byte [ebp - 0x10d]
add esi, eax
xor eax, eax
mov ah, byte [ebp - 0x110]
push esi
push dword [ebp - 0x108]
mov al, byte [ebp - 0x10f]
mov dword [ebp - 0x128], eax
call sub.msvcrt.dll__lseek
add esp, 0xc
cmp eax, esi
jne 0x1018679
push dword [ebp - 0x128]
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x108]
call sub.msvcrt.dll__read
add esp, 0xc
cmp eax, dword [ebp - 0x128]
jne 0x1018679
xor eax, eax
mov ah, byte [ebp - 0x110]
mov al, byte [ebp - 0x10f]
mov byte [ebp + eax - 0x104], 0
lea eax, [ebp - 0x104]
push eax
call fcn.01018361
mov ecx, dword [ebp - 0x12c]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov dword [ebp - 0x124], 1
cmp dword [ebp - 0x10c], 0
jne 0x1018551
pop edi
push dword [ebp - 0x108]
call sub.msvcrt.dll__close
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x124]
pop esi
call fcn.0101439a
leave
ret 8