Function at 0x101208f0
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
movsd qword [esp + 0x48], xmm0
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x38], xmm2
jmp 0x10120934
mov dword [esp + 0x58], esi
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
xor edi, edi
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x7c], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x78], edx
mov dword [esp + 0x60], eax
add eax, 4
xor edx, edx
mov dword [esp + 0x74], eax
cmp esi, ecx
jb 0x10120a56
mov dword [esp + 0x1c], esi
mov dword [esp + 8], edi
mov edi, edx
lea esi, [esp + 0x80]
mov dword [esp + 0x24], ecx
jmp 0x101209c4
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
push ebx
call fcn.101614b0
add esp, 4
cmp al, 0x23
jne 0x10120a40
xorps xmm0, xmm0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
movaps xmmword [esp + 0x80], xmm0
mov dword [esp + 0x90], eax
push 0x1015be60
push esi
push dword [esp + 0x84]
push dword [esp + 0x6c]
push dword [esp + 0x88]
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x101209b0
nop word cs:[eax + eax]
nop dword [eax]
push 1
push 0xffffffffffffffff
call sub.KERNEL32.dll_SleepEx
cmp dword [esp + 0x2c], 0
je 0x10120a10
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x101209b7
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
cmp eax, ecx
cmovbe eax, ecx
mov dword [esp + 0x20], eax
jmp 0x10120a4e
movzx eax, al
cmp eax, 0xb
jne 0x10120c50
xor ecx, ecx
mov edx, edi
mov edi, dword [esp + 8]
xor esi, esi
mov eax, esi
mov eax, dword [esp + 0x60]
mov ebx, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], ecx
sub ebx, esi
cmp ebx, 8
lea esi, [eax + esi]
jae 0x10120aa0
test ebx, ebx
je 0x10120b60
xor ecx, ecx
nop word [eax + eax]
cmp byte [esi + ecx], 0xa
je 0x10120bb3
inc ecx
cmp ebx, ecx
jne 0x10120a80
jmp 0x10120b60
lea eax, [esi + 3]
mov dword [esp + 0x5c], edx
and eax, 0xfffffffc
sub eax, esi
je 0x10120ae0
je 0x10120ae0
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax]
cmp byte [esi + ecx], 0xa
je 0x10120baf
inc ecx
cmp eax, ecx
jne 0x10120ac0
lea ecx, [ebx - 8]
mov dword [esp + 8], edi
cmp eax, ecx
mov dword [esp + 0xc], ecx
jbe 0x10120aed
jmp 0x10120b44
lea eax, [ebx - 8]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x74]
add edx, ecx
nop word [eax + eax]
mov edi, dword [edx + eax - 4]
mov ecx, edi
xor edi, 0xa0a0a0a
not ecx
add edi, 0xfefefeff
and edi, ecx
test edi, 0x80808080
jne 0x10120b44
mov ecx, dword [edx + eax]
mov edi, ecx
xor ecx, 0xa0a0a0a
not edi
add ecx, 0xfefefeff
and ecx, edi
test ecx, 0x80808080
jne 0x10120b44
add eax, 8
cmp eax, dword [esp + 0xc]
jbe 0x10120b00
mov edx, dword [esp + 0x5c]
mov edi, dword [esp + 8]
cmp ebx, eax
je 0x10120b60
cmp byte [esi + eax], 0xa
je 0x10120c3e
inc eax
cmp ebx, eax
jne 0x10120b50
nop
mov eax, dword [esp + 0x14]
sub eax, edx
cmp eax, ebx
jae 0x10120b90
lea ecx, [esp + 0x10]
push ebx
call fcn.101256b0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
jmp 0x10120b94
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
add eax, edx
push ebx
push esi
push eax
mov esi, edx
call sub.msvcrt.dll_memcpy
mov edx, esi
add esp, 0xc
add edx, ebx
xor eax, eax
jmp 0x10120c11
mov edx, dword [esp + 0x5c]
cmp ecx, 0xffffffff
je 0x10120f38
lea eax, [ecx + 1]
cmp ecx, ebx
mov dword [esp + 0xc], eax
jae 0x10120f0c
mov eax, dword [esp + 0x14]
sub eax, edx
cmp eax, ecx
jbe 0x10120bdf
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0xc]
jmp 0x10120bf8
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebx
call fcn.101256b0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add eax, edx
push ebx
push esi
push eax
mov esi, edx
call sub.msvcrt.dll_memcpy
mov edx, esi
add esp, 0xc
add edx, ebx
mov al, 1
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], 0
add esi, ebx
cmp esi, ecx
cmovae esi, ecx
add edi, ebx
test al, al
mov al, 4
jne 0x10120c64
test ebx, ebx
jne 0x10120987
jmp 0x10120c64
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x10120bbc
jmp 0x10120f38
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov al, 1
mov edx, edi
mov edi, ebx
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x40], esi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x44], ecx
mov dword [esp + 8], edi
mov dword [esp + 0x48], eax
push edx
push esi
lea eax, [esp + 0x88]
push eax
mov edi, edx
call fcn.1002a2f0
add esp, 0xc
cmp dword [esp + 0x80], 0
mov ecx, 0
cmovne edi, ecx
mov ecx, dword [esp + 0xc]
sete al
or al, cl
je 0x10120ce0
mov edx, edi
test cl, cl
mov dword [esp + 0x18], edi
je 0x10120e80
mov ecx, dword [esp + 8]
movzx eax, bl
xor ebx, ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0
cmp dword [esp + 0x14], 0
jne 0x10120d06
jmp 0x10120d19
xor ebx, ebx
mov ecx, 0x102996ac
mov dword [esp + 0x18], 0
mov dword [esp + 0x54], 2
mov dword [esp + 0x58], 0
cmp dword [esp + 0x14], 0
je 0x10120d19
push esi
push 0
mov eax, dword [0x1035648c]
push dword [eax]
mov esi, ecx
call sub.KERNEL32.dll_HeapFree
mov ecx, esi
test bl, bl
jne 0x10120ee2
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
test esi, esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
je 0x10120ed9
movsd xmm0, qword [esp + 0x64]
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x6c]
movsd qword [esp + 0x10], xmm0
cmp ecx, 0xd
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x10]
jbe 0x10120d90
push 0xd
push str.POWERSHELL___DEBUGPOWERSHELL_
push ecx
push eax
lea eax, [esp + 0x90]
push eax
call fcn.1002a920
add esp, 0x14
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x80]
call fcn.10125e30
cmp dword [esp + 0x2c], 0
jne 0x10120e00
jmp 0x10120da6
jne 0x10120da6
push 0xd
push eax
push str.POWERSHELL___DEBUGPOWERSHELL_
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10120e00
lea eax, [esp + 0x10]
mov dword [esp + 0x80], 0x103490c8
mov dword [esp + 0x84], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], 0x10125740
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], 1
lea eax, [esp + 0x80]
push eax
call fcn.1005f950
add esp, 4
jmp 0x10120e57
lea eax, [esp + 0x10]
mov dword [esp + 0x80], 0x103490d0
mov dword [esp + 0x84], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], 0x10125740
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], 1
lea eax, [esp + 0x80]
push eax
call fcn.1005f950
add esp, 4
cmp dword [esp + 0x14], 0
je 0x10120930
push dword [esp + 0x10]
push 0
mov eax, dword [0x1035648c]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10120930
cmp dword [esp + 8], 0
je 0x10120ea8
xor ecx, ecx
test edx, edx
je 0x10120ec0
cmp byte [esi + edx - 1], 0xa
jne 0x10120ebe
mov eax, edx
dec eax
je 0x10120ec0
cmp byte [esi + edx - 2], 0xd
lea ecx, [edx - 2]
cmove eax, ecx
mov ecx, eax
jmp 0x10120ec0
mov ecx, dword [esp + 0x70]
mov bl, 1
cmp dword [esp + 0x14], 0
jne 0x10120d06
jmp 0x10120d19
mov ecx, edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x6c], ecx
jmp 0x10120d3d
lea ecx, [esp + 0x64]
call fcn.10124280
cmp dword [esp + 0x3c], 0
je 0x10120efb
push dword [esp + 0x38]
push 0
mov eax, dword [0x1035648c]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x4c]
call sub.KERNEL32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
push 0x10299678
push ebx
push dword [esp + 0x14]
call fcn.1002a190
add esp, 0xc
jmp 0x10120f5d
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
push 0x10299678
call fcn.1002a250
add esp, 4
ud2