Function at 0x1020eff
Capabilities:
Access peb ldr_data
Get process heap flags
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
shl eax, 4
mov eax, dword [eax + 0x1038914]
push ebx
push dword [0x1038f24]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1020f46
mov eax, 0xc000000d
jmp 0x102112f
push ebx
lea eax, [ebp - 0x3c]
push eax
push 0x18
lea eax, [ebp - 0x38]
push eax
push dword [0x1038f24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1020f3c
cmp dword [ebp - 0x3c], 0x18
jne 0x1020f3c
push 2
pop ecx
mov edi, 0x1021278
lea esi, [ebp - 0x38]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x1020f90
push 2
pop ecx
mov edi, 0x102126c
lea esi, [ebp - 0x38]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1020f3c
mov dword [ebp - 0x44], 1
movzx esi, byte [ebp - 0x22]
movzx eax, word [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
shl esi, 0x10
or esi, eax
movzx eax, byte [ebp - 0x25]
push ebx
shl esi, 8
push ebx
or esi, eax
push esi
push dword [0x1038f24]
call edi
cmp eax, 0xffffffff
je 0x1020f3c
push ebx
lea eax, [ebp - 0x3c]
push eax
push 2
lea eax, [ebp - 0x38]
push eax
push dword [0x1038f24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1020f3c
cmp dword [ebp - 0x3c], 2
jne 0x1020f3c
movzx eax, word [ebp - 0x38]
inc esi
inc esi
mov dword [ebp - 0x40], eax
cmp word [ebp - 0x38], bx
je 0x1020f3c
push ebx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [0x1038f24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1020f3c
cmp dword [ebp - 0x3c], 0x1c
jne 0x1020f3c
movzx eax, word [ebp - 0x28]
cmp eax, dword [ebp + 8]
je 0x1021074
cmp dword [ebp - 0x44], ebx
je 0x102103e
movzx esi, word [ebp - 0x34]
movzx eax, word [ebp - 0x36]
shl esi, 0x10
or esi, eax
jmp 0x102104d
movzx eax, word [ebp - 0x34]
movzx ecx, word [ebp - 0x36]
shl eax, 0x10
or eax, ecx
add esi, eax
push ebx
push ebx
push esi
push dword [0x1038f24]
call edi
cmp eax, 0xffffffff
je 0x1020f3c
add dword [ebp - 0x40], 0xffff
cmp word [ebp - 0x40], bx
je 0x1020f3c
jmp 0x1020ff8
cmp dword [ebp - 0x44], ebx
je 0x102107e
mov esi, dword [ebp - 0x20]
jmp 0x1021081
add esi, dword [ebp - 0x20]
push ebx
push ebx
push esi
push dword [0x1038f24]
call edi
cmp eax, 0xffffffff
je 0x1020f3c
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [ebp - 0x3c]
push eax
push 6
lea eax, [ebp - 0x38]
push eax
push dword [0x1038f24]
call esi
test eax, eax
je 0x1020f3c
cmp dword [ebp - 0x3c], 6
jne 0x1020f3c
movzx eax, word [ebp - 0x36]
mov dword [ebp - 0x40], eax
cmp word [ebp - 0x36], bx
je 0x102112c
push ebx
lea eax, [ebp - 0x3c]
push eax
push 6
lea eax, [ebp - 0x38]
push eax
push dword [0x1038f24]
call esi
test eax, eax
je 0x1020f3c
cmp dword [ebp - 0x3c], 6
jne 0x1020f3c
mov ax, word [ebp - 0x38]
cmp al, byte [ebp - 0x46]
jne 0x1021100
cmp ah, byte [ebp - 0x48]
je 0x1021140
movzx ecx, word [ebp - 0x34]
movzx eax, al
imul eax, ecx
push 1
push ebx
push eax
push dword [0x1038f24]
call edi
cmp eax, 0xffffffff
je 0x1020f3c
add dword [ebp - 0x40], 0xffff
cmp word [ebp - 0x40], bx
jne 0x10210cd
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010015a8
leave
ret 8
mov eax, dword fs:[0x18]
movzx ecx, byte [ebp - 0x38]
movzx edx, word [ebp - 0x34]
mov eax, dword [eax + 0x30]
imul ecx, edx
add ecx, 0xc
push ecx
push dword [0x1038030]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
movzx ecx, word [ebp - 0x34]
mov esi, eax
cmp esi, ebx
jne 0x10211a2
movzx eax, byte [ebp - 0x38]
mov esi, dword [sym.imp.ntdll.dll_DbgPrintEx]
imul eax, ecx
add eax, 0xc
push eax
push 0x1021230
push 1
push 0x70
call esi
push 0x100aba0
push 1
push 0x70
call esi
add esp, 0x1c
mov eax, 0xc0000017
jmp 0x102112f
push ebx
lea eax, [ebp - 0x3c]
push eax
movzx eax, byte [ebp - 0x38]
imul eax, ecx
push eax
lea eax, [esi + 8]
push eax
push dword [0x1038f24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x102120d
movzx eax, byte [ebp - 0x38]
movzx ecx, word [ebp - 0x34]
imul eax, ecx
cmp dword [ebp - 0x3c], eax
jne 0x102120d
mov ax, word [ebp - 0x48]
mov word [esi], ax
mov ax, word [ebp - 0x46]
mov word [esi + 2], ax
movzx ecx, word [ebp - 0x34]
movzx eax, byte [ebp - 0x38]
imul eax, ecx
mov dword [esi + 4], eax
movzx eax, byte [ebp - 0x38]
movzx ecx, word [ebp - 0x34]
imul eax, ecx
push ebx
push ebx
add eax, 0xc
push eax
push esi
push 7
call sub.GDI32.dll_GdiFullscreenControl
mov edi, eax
jmp 0x1021212
mov edi, 0xc000000d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
jmp 0x102112f