Function at 0x969c10
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ebx, edx
push edi
mov edi, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
test esi, esi
je 0x969dad
movzx eax, byte [esi]
push eax
call fcn.00a7c649
add esp, 4
cmp eax, 0x4d
jne 0x969dc3
movzx ecx, byte [esi + 1]
push ecx
call fcn.00a7c649
add esp, 4
cmp eax, 0x5a
jne 0x969dc3
cmp byte [esi + 4], 0
mov ecx, dword [esi + 0x3c]
jne 0x969c77
cmp byte [esi + 5], 0
je 0x969c91
mov dword [esp + 0xc], 1
test ebx, ebx
je 0x969c89
mov dword [ebx], 1
test ebp, ebp
je 0x969dad
xor eax, eax
mov byte [esp + 0x18], 0
mov dword [esp + 0x19], eax
mov byte [esp + 0x1d], al
mov dword [esp + 0x10], eax
push eax
cmp edi, eax
je 0x969cc7
push ecx
push edi
call fcn.00a79da2
add esp, 0xc
push edi
push 6
lea edx, [esp + 0x20]
push 1
push edx
call fcn.00a799fb
add esp, 0x10
jmp 0x969cea
push eax
push ecx
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x18]
push eax
push 6
lea ecx, [esp + 0x24]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx ecx, byte [esp + 0x18]
mov dl, byte [esp + 0x1c]
mov al, byte [esp + 0x1d]
push ecx
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], al
call fcn.00a7c649
add esp, 4
cmp eax, 0x50
jne 0x969d4b
movzx edx, byte [esp + 0x19]
push edx
call fcn.00a7c649
add esp, 4
cmp eax, 0x45
jne 0x969d4b
cmp byte [esp + 0x1a], 0
jne 0x969d4b
cmp byte [esp + 0x1b], 0
jne 0x969d4b
test ebx, ebx
je 0x969d38
mov dword [ebx], 1
mov dword [esp + 0xc], 1
test ebp, ebp
je 0x969d4b
mov dword [ebp], 1
mov eax, dword [esp + 0x10]
cmp eax, 0x14c
je 0x969d68
cmp eax, 0x8664
je 0x969d68
test ebp, ebp
je 0x969d68
mov dword [ebp], 0
cmp dword [esp + 0xc], 0
jne 0x969dad
cmp dword [esp + 0x2c], 1
jne 0x969dad
cmp byte [esi], 0x30
jne 0x969dad
cmp byte [esi + 1], 0x26
jne 0x969dad
cmp byte [esi + 2], 0xb2
jne 0x969dad
cmp byte [esi + 3], 0x75
jne 0x969dad
cmp byte [esi + 4], 0x8e
jne 0x969dad
cmp byte [esi + 5], 0x66
jne 0x969dad
cmp byte [esi + 6], 0xcf
jne 0x969dad
cmp byte [esi + 7], 0x11
jne 0x969dad
mov dword [esp + 0xc], 0xa
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
mov al, byte [esi]
cmp al, 0xd7
jne 0x969df7
cmp byte [esi + 1], 0xcd
jne 0x969df7
test ebx, ebx
je 0x969dd9
mov dword [ebx], 1
mov dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
cmp al, 0x50
jne 0x969e1f
cmp byte [esi + 1], 0x4b
jne 0x969e1f
mov dword [esp + 0xc], 3
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
mov edi, esi
mov al, byte [edi]
cmp al, 0x20
je 0x969e37
cmp al, 9
je 0x969e37
cmp al, 0xa0
je 0x969e37
cmp al, 0xd
je 0x969e37
cmp al, 0xa
jne 0x969e3a
inc edi
jmp 0x969e21
push 5
mov eax, str.begin
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x969e86
mov al, byte [edi + 5]
cmp al, 0x20
je 0x969e5e
cmp al, 9
je 0x969e5e
cmp al, 0xa0
jne 0x969e86
test ebx, ebx
je 0x969e68
mov dword [ebx], 1
mov dword [esp + 0xc], 4
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
push str.Standard_Jet_DB
lea edi, [esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, str.Standard_Jet_DB
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x969ec6
mov dword [esp + 0xc], 5
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
cmp byte [esi], 0x52
mov bl, 0x21
jne 0x969f2b
mov al, byte [esi + 1]
cmp al, 0x61
jne 0x969efd
cmp byte [esi + 2], 0x72
jne 0x969efd
cmp byte [esi + 3], bl
jne 0x969efd
mov dword [esp + 0xc], 6
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
cmp al, 0x49
jne 0x969f2b
cmp byte [esi + 2], 0x46
jne 0x969f2b
cmp byte [esi + 3], 0x46
jne 0x969f2b
mov dword [esp + 0xc], 7
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
push 0
push str.wscript
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x969f6c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x969f4e
mov dword [eax], 1
mov dword [esp + 0xc], 9
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
cmp byte [esi], 0x58
jne 0x969fae
cmp byte [esi + 1], 0x35
jne 0x969fae
cmp byte [esi + 2], 0x4f
jne 0x969fae
cmp byte [esi + 3], bl
jne 0x969fae
mov eax, dword [esp + 0x10]
test eax, eax
je 0x969f90
mov dword [eax], 1
mov dword [esp + 0xc], 0xb
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
push 0
push str.autorun
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x969fef
mov eax, dword [esp + 0x10]
test eax, eax
je 0x969fd1
mov dword [eax], 1
mov dword [esp + 0xc], 0xd
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
mov al, byte [esi]
cmp al, 0x4d
jne 0x96a025
cmp byte [esi + 1], 0x53
jne 0x96a025
cmp byte [esi + 2], 0x43
jne 0x96a025
cmp byte [esi + 3], 0x46
jne 0x96a025
mov dword [esp + 0xc], 0xe
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret
cmp al, 0x7b
jne 0x969d6f
lea ecx, [esi + 1]
mov eax, 0xae0c74
call fcn.0094c3e0
test eax, eax
jne 0x969d6f
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
mov dword [esp], 0xf
mov eax, dword [esp]
xor ecx, esp
call fcn.00a78f21
add esp, 0x18
ret