Function at 0x10002433
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
je 0x100025db
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push esi
push 0xfffffffffffffffc
push edi
call ebx
lea eax, [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
lea eax, [ebp - 0xc]
push 4
push eax
push edi
call esi
cmp dword [ebp - 0xc], 0xbd43dbfe
je 0x100024ad
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100025db
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
xor edi, edi
push 2
push edi
push 0xfffffffffffffff8
push dword [ebp + 8]
call ebx
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 4]
push 4
push eax
push dword [ebp + 8]
call esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
cmp ecx, eax
ja 0x1000250a
push 2
push edi
neg ecx
push ecx
push dword [ebp + 8]
call ebx
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
cmp eax, edi
pop ecx
mov dword [ebp - 0x10], eax
jne 0x1000250f
push dword [ebp + 8]
jmp 0x100024a2
lea ecx, [ebp - 8]
push edi
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff8
push ecx
push eax
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 4]
mov ebx, 0x8c
add eax, 0xfffffff8
xor edx, edx
mov ecx, ebx
div ecx
test eax, eax
jle 0x10002569
mov eax, dword [ebp - 0x10]
mov esi, 0x10005018
mov dword [ebp - 0x14], eax
push esi
call sub.MSVCRT.dll_strlen
push eax
push esi
push ebx
push dword [ebp - 0x14]
call fcn.10002c2c
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0xfffffff8
mov ecx, ebx
div ecx
add dword [ebp - 0x14], ebx
add esp, 0x14
inc edi
cmp edi, eax
jl 0x10002541
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x18], esi
cmp dword [eax], 0xffffffff
jne 0x100025a6
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
div ebx
jmp 0x10002674
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
push 9
lea eax, [ebp - 0x2c]
push esi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, eax
add esp, 0x10
cmp ecx, esi
mov dword [ebp - 0x20], ecx
jne 0x100025e2
xor eax, eax
jmp 0x10002674
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], esi
add eax, 0xfffffff8
xor edx, edx
mov esi, ebx
div esi
test eax, eax
jle 0x1000264f
mov esi, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov dword [ebp - 0x1c], esi
lea eax, [esi + 0x84]
push 8
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 0x14
test eax, eax
jne 0x10002633
mov edi, dword [ebp + 8]
inc dword [ebp - 0x18]
add dword [ebp + 8], ebx
push 0x23
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0xfffffff8
mov ecx, ebx
div ecx
mov esi, dword [ebp - 0x1c]
inc dword [ebp - 0x14]
add esi, ebx
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x14], eax
jl 0x100025fe
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
push dword [ebp - 0x10]
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp + 0xc]
pop ecx
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret