Function at 0x1015798
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
push 0x8c
call fcn.0100c3f0
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
jne 0x10157e0
cmp byte [0x101b7e0], bl
je 0x1015a68
push ebx
push 0x10016b4
push 0x1001668
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1015a68
cmp dword [ebp + 0xc], ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
je 0x10157fc
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x1015802
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x6c], eax
jne 0x101585c
cmp dword [ebp + 0xc], ebx
push dword [ebp + 8]
je 0x1015819
push 0x1001d1c
jmp 0x101581e
push 0x1001cfc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp byte [0x101b7e0], bl
je 0x1015850
push ebx
lea eax, [ebp - 0x104]
push 0x10016b4
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0100c3a0
pop ecx
jmp 0x1015a68
lea ecx, [ebp - 4]
push ebx
push ecx
push 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ax, word [esi]
cmp ax, 0xda01
jne 0x1015a71
mov ax, word [esi + 2]
xor ecx, ecx
mov cl, ah
mov ch, al
mov ax, word [esi + 4]
mov word [esi + 2], cx
xor ecx, ecx
mov ch, al
mov cl, ah
mov ax, word [esi + 6]
mov word [esi + 4], cx
xor ecx, ecx
mov cl, ah
mov ch, al
mov ax, word [esi + 8]
mov word [esi + 6], cx
xor ecx, ecx
mov cl, ah
mov ch, al
mov ax, word [esi + 0xa]
mov word [esi + 8], cx
xor ecx, ecx
mov ch, al
mov cl, ah
mov word [esi + 0xa], cx
movzx eax, word [esi + 6]
shl eax, 8
push eax
call fcn.0100c3f0
mov dword [esi + 0x70], eax
pop ecx
movzx eax, word [esi + 6]
shl eax, 8
push eax
call fcn.0100c3f0
mov dword [esi + 0x74], eax
pop ecx
movzx eax, word [esi + 6]
shl eax, 8
push eax
call fcn.0100c3f0
mov dword [esi + 0x78], eax
pop ecx
movzx eax, word [esi + 6]
shl eax, 8
push eax
call fcn.0100c3f0
cmp dword [esi + 0x70], ebx
pop ecx
mov dword [esi + 0x7c], eax
je 0x1015a42
cmp dword [esi + 0x74], ebx
je 0x1015a42
cmp dword [esi + 0x78], ebx
je 0x1015a42
cmp eax, ebx
je 0x1015a42
mov ax, word [esi + 2]
and ax, 0xff00
cmp ax, 0x100
jne 0x1015a34
movzx edi, word [esi + 0xa]
movzx eax, word [esi + 8]
imul edi, eax
shl edi, 2
push edi
call fcn.0100c3f0
pop ecx
mov dword [esi + 0x84], eax
push edi
call fcn.0100c3f0
cmp dword [esi + 0x84], ebx
pop ecx
mov dword [esi + 0x88], eax
je 0x1015a38
cmp eax, ebx
je 0x1015a38
push ebx
push ebx
push 0x200
lea eax, [edi + edi + 0x200]
push dword [esi + 0x6c]
mov dword [esi + 0x80], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push ebx
push eax
push edi
push dword [esi + 0x84]
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 4]
push ebx
push eax
push edi
push dword [esi + 0x88]
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esi], 0xda01
jne 0x1015a34
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x88]
shr edi, 2
mov eax, edi
dec edi
test eax, eax
je 0x1015a34
inc edi
mov dword [ebp + 8], edi
mov eax, dword [ecx]
mov edi, eax
mov ebx, eax
and edi, 0xff00
shl ebx, 0x10
or edi, ebx
mov ebx, eax
shr ebx, 0x10
and eax, 0xff0000
or ebx, eax
shl edi, 8
shr ebx, 8
or edi, ebx
mov dword [ecx], edi
mov eax, dword [edx]
mov edi, eax
mov ebx, eax
and edi, 0xff00
add ecx, 4
shl ebx, 0x10
or edi, ebx
mov ebx, eax
shr ebx, 0x10
and eax, 0xff0000
or ebx, eax
shl edi, 8
shr ebx, 8
or edi, ebx
mov dword [edx], edi
add edx, 4
dec dword [ebp + 8]
jne 0x10159db
mov eax, esi
jmp 0x1015a6a
cmp byte [0x101b7e0], bl
je 0x1015a62
jmp 0x1015a4a
cmp byte [0x101b7e0], bl
je 0x1015a62
push ebx
push 0x10016b4
push 0x1001668
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.01015a90
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
cmp ax, 0x1da
je 0x10158be
cmp byte [0x101b7e0], bl
je 0x1015a62
push ebx
push 0x10016b4
push 0x1001ce8
jmp 0x1015a55