Function at 0x1002820
Capabilities:
Read file via mapping

Disassembly:
push 0x27c
push 0x1002b48
call fcn.01002b64
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x238], ebx
xor esi, esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x230], esi
mov eax, dword [0x100c074]
cmp eax, 0xffffffff
je 0x10058a7
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, dword [ebp - 0x268]
mov dword [ebp - 0x248], edi
cmp eax, esi
je 0x10058b2
cmp edi, 0x40000000
jae 0x1005c0c
cmp dword [ebp - 0x26c], esi
jne 0x1005c0c
push dword [0x100c090]
call dword [sym.imp.USER32.dll_SetCursor]
cmp edi, esi
je 0x10058bd
xor ebx, ebx
mov dword [ebp - 0x240], ebx
push esi
push edi
push esi
push 2
push esi
push dword [0x100c074]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x258], eax
cmp eax, esi
je 0x10028f8
push edi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x240], ebx
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x100c074]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x100c074], 0xffffffff
cmp ebx, esi
je 0x10058d7
mov dword [ebp - 4], esi
mov dword [ebp - 0x23c], ebx
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x1005a43
movzx eax, word [ebx]
cmp eax, 0xbbef
je 0x100590f
cmp eax, 0xfeff
jne 0x10058eb
xor eax, eax
inc eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov esi, edi
shr esi, 1
dec esi
mov dword [ebp - 0x228], esi
xor eax, eax
cmp dword [ebp - 0x234], eax
je 0x1005951
push eax
push eax
push 0xb
push dword [0x100c028]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
call edi
push 0
push 0
push 0xb1
push dword [0x100c028]
call edi
push 0
push 0
push 0xb7
push dword [0x100c028]
call edi
push 2
lea eax, [esi + esi + 2]
push eax
push dword [0x100c098]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x1005976
push eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x234], 0
je 0x1005aeb
movzx ecx, word [ebx]
mov edx, 0xfeff
cmp cx, dx
jne 0x1005ac7
lea ecx, [esi + esi]
push ecx
lea ecx, [ebx + 2]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x22c]
mov dword [0x100c00c], eax
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x24c]
cmp ebx, eax
je 0x1002a1d
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x254]
test eax, eax
je 0x1002a5b
mov ecx, eax
test esi, esi
jbe 0x1002a3f
mov edx, esi
nop
cmp word [ecx], 0
je 0x1005b5a
inc ecx
inc ecx
dec edx
jne 0x1002a30
xor ecx, ecx
mov word [eax + esi*2], cx
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x2e
je 0x1005b65
and dword [ebp - 0x244], 0
mov ebx, dword [ebp - 0x250]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov dword [0x100c098], ebx
push dword [ebp - 0x238]
push 0x104
push 0x100cae0
call fcn.01002558
push dword [ebp - 0x238]
call fcn.01002456
xor ebx, ebx
mov dword [0x100c008], ebx
mov dword [0x100c030], 1
push ebx
push dword [0x100c098]
push 0xbc
push dword [0x100c028]
call edi
cmp dword [0x100c030], 2
je 0x1005b9c
mov dword [0x100c030], ebx
push ebx
push ebx
push 0xc5
push dword [0x100c028]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 0x244], ebx
jne 0x1005be2
xor esi, esi
inc esi
push esi
push ebx
push 0xbe
push 0x115
push dword [0x100c028]
call edi
push eax
push esi
push dword [0x100c020]
call dword [sym.imp.USER32.dll_SetScrollPos]
push ebx
push esi
push 0xb
push dword [0x100c028]
call edi
push esi
push ebx
push dword [0x100c028]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x100c028]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x100c094]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, esi
call fcn.01001a72
ret 8
push ebx
call fcn.01007bf6
jmp 0x1005c39
push ebx
call fcn.01007bf6
jmp 0x1005c26
lea ebx, [ebp - 0x24c]
mov dword [ebp - 0x240], ebx
xor eax, eax
mov word [ebp - 0x24c], ax
jmp 0x10028f8
push dword [0x100c094]
call dword [sym.imp.USER32.dll_SetCursor]
push dword [ebp - 0x238]
jmp 0x10058a8
cmp eax, 0xfffe
jne 0x10059ea
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x22c], 2
jmp 0x1002950
cmp edi, 2
jbe 0x10059ea
cmp byte [ebx + 2], 0xbf
jne 0x10059ea
mov dword [ebp - 0x230], 0xfde9
push 3
pop eax
mov dword [ebp - 0x22c], eax
lea ecx, [ebx + 3]
mov dword [ebp - 0x23c], ecx
sub edi, eax
mov dword [ebp - 0x248], edi
mov esi, dword [ebp - 0x228]
jmp 0x100295b
push eax
push eax
push edi
push dword [ebp - 0x23c]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
mov dword [ebp - 0x228], esi
xor eax, eax
jmp 0x1002969
push dword [ebp - 0x238]
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.01002558
xor esi, esi
push esi
call fcn.0100800f
push dword [0x100c094]
call dword [sym.imp.USER32.dll_SetCursor]
push 0x30
lea eax, [ebp - 0x224]
push eax
push dword [0x100c2cc]
push dword [0x100c2d0]
push dword [0x100c020]
call fcn.01007051
lea eax, [ebp - 0x24c]
cmp ebx, eax
je 0x10059d2
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
push esi
push 0xb
push dword [0x100c028]
call edi
mov dword [ebp - 4], 0xfffffffe
jmp 0x1005c39
push edi
push ebx
call fcn.0100991d
mov dword [ebp - 0x234], eax
cmp eax, esi
je 0x1005a0e
mov dword [ebp - 0x22c], 1
mov esi, edi
shr esi, 1
jmp 0x1002955
push edi
push ebx
call fcn.010098c7
test eax, eax
je 0x1005a32
mov dword [ebp - 0x22c], 3
mov dword [ebp - 0x230], 0xfde9
jmp 0x1005946
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], esi
jmp 0x1005946
dec eax
je 0x1005ab1
dec eax
je 0x1005a85
dec eax
jne 0x1005a32
mov dword [ebp - 0x230], 0xfde9
push 3
pop eax
mov dword [ebp - 0x22c], eax
cmp edi, 2
jbe 0x1005946
mov ecx, 0xbbef
cmp word [ebx], cx
jne 0x1005946
cmp byte [ebx + 2], 0xbf
je 0x1005935
jmp 0x1005946
xor eax, eax
inc eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov eax, 0xfffe
mov esi, edi
shr esi, 1
mov dword [ebp - 0x228], esi
cmp word [ebx], ax
je 0x1002954
jmp 0x100295b
xor eax, eax
inc eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov eax, 0xfeff
jmp 0x1005a99
mov edx, 0xfffe
cmp cx, dx
jne 0x1005ae1
push esi
lea ecx, [ebx + 2]
push ecx
push eax
call fcn.01007a58
jmp 0x10029fa
lea ecx, [esi + esi]
push ecx
push ebx
jmp 0x10029f1
push esi
push eax
push dword [ebp - 0x248]
push dword [ebp - 0x23c]
push 0
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
mov dword [ebp - 0x228], esi
jmp 0x10029fa
push 0x20
pop ebx
mov word [ecx], bx
jmp 0x1002a3a
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x4c
jne 0x1002a54
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x4f
jne 0x1002a54
cmp word [eax], 0x47
jne 0x1002a54
mov dword [ebp - 0x244], 1
jmp 0x1002a5b
push dword [0x100c094]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x100c030], ebx
push 0x30
push dword [ebp - 0x238]
push dword [0x100c2cc]
push dword [0x100c2d0]
push dword [0x100c020]
call fcn.01007051
push ebx
call fcn.0100800f
push ebx
push 1
push 0xb
push dword [0x100c028]
call edi
jmp 0x1005c39
push esi
push esi
push 0xb1
push dword [0x100c028]
call edi
push ebx
push ebx
push 0xb7
push dword [0x100c028]
call edi
push 1
call fcn.0100978a
jmp 0x1002ae6
push 0x30
push ebx
push dword [0x100c2cc]
push dword [0x100c2d0]
push dword [0x100c020]
call fcn.01007051
push dword [0x100c074]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x100c074], 0xffffffff
xor eax, eax
jmp 0x1002b3f