Function at 0x10002ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x1000e01c]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x14], eax
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov ecx, dword [edi + 0xc]
mov edx, dword [esp + 0x18]
mov dword [edx], ecx
mov ebx, dword [edi + 0xc]
cmp ebx, eax
je 0x10003264
push 0x1ff
push eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x31]
push eax
mov byte [esp + 0x34], 0
call sub.ntdll.dll_memset
mov ecx, 0x200
mov eax, ebx
mul ecx
add esp, 0xc
push 0
mov dword [esp + 0x28], edx
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10003167
mov eax, dword [edi + 4]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x200
lea edx, [esp + 0x34]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100031ba
cmp byte [esp + 0x226], 0x55
jne 0x10003264
cmp byte [esp + 0x227], 0xaa
jne 0x10003264
mov dl, byte [esp + 0x1ea]
test dl, dl
mov ecx, dword [esp + 0x1ee]
mov dword [edi + 0xc], 0
je 0x10002fe1
cmp dl, 0xf
je 0x10002ff1
cmp dl, 5
je 0x10002fe1
mov eax, dword [esp + 0x18]
add dword [eax], ecx
mov ebx, dword [esp + 0x1e6]
mov dword [esi], ebx
mov ebx, dword [esp + 0x1ea]
mov dword [esi + 4], ebx
mov ebx, dword [esp + 0x1f2]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x10], 1
jmp 0x10002fe5
mov eax, dword [esp + 0x18]
cmp dl, 0xf
je 0x10002ff5
cmp dl, 5
jne 0x10003005
jmp 0x10002ff5
mov eax, dword [esp + 0x18]
mov edx, dword [edi + 8]
add edx, ecx
mov dword [edi + 0xc], edx
mov dword [esp + 0x14], 1
mov dl, byte [esp + 0x1fa]
test dl, dl
mov ecx, dword [esp + 0x1fe]
je 0x10003052
cmp dl, 0xf
je 0x1000305c
cmp dl, 5
je 0x10003052
cmp dword [esp + 0x10], 0
jne 0x10003052
add dword [eax], ecx
mov ebx, dword [esp + 0x1f6]
mov dword [esi], ebx
mov ebx, dword [esp + 0x1fa]
mov dword [esi + 4], ebx
mov ebx, dword [esp + 0x202]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x10], 1
cmp dl, 0xf
je 0x1000305c
cmp dl, 5
jne 0x1000306c
mov edx, dword [edi + 8]
add edx, ecx
mov dword [edi + 0xc], edx
mov dword [esp + 0x14], 1
mov dl, byte [esp + 0x20a]
test dl, dl
mov ecx, dword [esp + 0x20e]
je 0x100030b9
cmp dl, 0xf
je 0x100030c3
cmp dl, 5
je 0x100030b9
cmp dword [esp + 0x10], 0
jne 0x100030b9
add dword [eax], ecx
mov ebx, dword [esp + 0x206]
mov dword [esi], ebx
mov ebx, dword [esp + 0x20a]
mov dword [esi + 4], ebx
mov ebx, dword [esp + 0x212]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x10], 1
cmp dl, 0xf
je 0x100030c3
cmp dl, 5
jne 0x100030d3
mov edx, dword [edi + 8]
add edx, ecx
mov dword [edi + 0xc], edx
mov dword [esp + 0x14], 1
mov dl, byte [esp + 0x21a]
test dl, dl
mov ecx, dword [esp + 0x21e]
je 0x10003120
cmp dl, 0xf
je 0x1000312a
cmp dl, 5
je 0x10003120
cmp dword [esp + 0x10], 0
jne 0x10003120
add dword [eax], ecx
mov eax, dword [esp + 0x216]
mov dword [esi], eax
mov eax, dword [esp + 0x21a]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x222]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
mov dword [esp + 0x10], 1
cmp dl, 0xf
je 0x1000312a
cmp dl, 5
jne 0x1000313a
mov edx, dword [edi + 8]
add edx, ecx
mov dword [edi + 0xc], edx
mov dword [esp + 0x14], 1
mov eax, dword [edi + 0x14]
cmp eax, 0x64
lea ecx, [eax + 1]
mov dword [edi + 0x14], ecx
ja 0x1000320a
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10003266
cmp dword [esp + 0x14], eax
je 0x10003266
jmp 0x10002ef3
test byte [0x1000e784], 1
jne 0x10003198
or dword [0x1000e784], 1
push 0x1000ad90
mov dword [0x1000e554], 0x1000b78c
mov dword [0x1000e558], 0xffffffff
call fcn.1000a217
add esp, 4
push 0x6c
call fcn.10002c00
mov edx, dword [0x1000e554]
push eax
mov eax, dword [edx + 8]
push str._s:_Set_file_pointer_to_fail_in_QueryExtTableNextItem.
push 0x1000e554
call eax
jmp 0x10003261
test byte [0x1000e784], 1
jne 0x100031eb
or dword [0x1000e784], 1
push 0x1000ad90
mov dword [0x1000e554], 0x1000b78c
mov dword [0x1000e558], 0xffffffff
call fcn.1000a217
add esp, 4
push 0x72
call fcn.10002c00
mov ecx, dword [0x1000e554]
mov edx, dword [ecx + 8]
push eax
push str._s:_Read_file_to_fail_in_QueryExtTableNextItem.
push 0x1000e554
call edx
jmp 0x10003261
test byte [0x1000e784], 1
mov dword [edi + 0x14], 0
jne 0x10003242
or dword [0x1000e784], 1
push 0x1000ad90
mov dword [0x1000e554], 0x1000b78c
mov dword [0x1000e558], 0xffffffff
call fcn.1000a217
add esp, 4
push 0x95
call fcn.10002c00
push eax
mov eax, dword [0x1000e554]
mov ecx, dword [eax + 8]
push str._s:_Partition_table_is_a_loop
push 0x1000e554
call ecx
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000a10d
mov esp, ebp
pop ebp
ret 8