Function at 0x1004bc3
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push 0x16c
push 0x1007210
call fcn.01004f2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], eax
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x6c], edi
push 0x40
push edi
lea eax, [ebp - 0x5c]
push eax
call sub.msvcrt.dll_memset
mov esi, 0xf8
push esi
push edi
lea eax, [ebp - 0x17c]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
xor eax, eax
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
push 0x80
push 3
push 0
push 7
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x64], edi
cmp edi, 0xffffffff
je 0x1004c3b
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1004c57
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004c4f
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x60], eax
jmp 0x1004def
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x68]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push eax
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
call ebx
test eax, eax
jne 0x1004c90
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004c88
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x60], eax
jmp 0x1004de8
cmp dword [ebp - 0x68], 0x40
je 0x1004ca2
mov dword [ebp - 0x60], 0x800700c1
jmp 0x1004de8
mov eax, 0x5a4d
cmp word [ebp - 0x5c], ax
jne 0x1004c96
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x1004c96
cmp eax, 0x10000000
jae 0x1004c96
cdq
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], edx
push 0
push 0
push edx
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
call edi
test eax, eax
je 0x1004c96
push 0
lea eax, [ebp - 0x68]
push eax
push esi
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 0x64]
call ebx
test eax, eax
je 0x1004c74
cmp dword [ebp - 0x68], esi
jne 0x1004c96
cmp dword [ebp - 0x17c], 0x4550
jne 0x1004c96
movzx ecx, word [ebp - 0x176]
imul ecx, ecx, 0x28
movzx eax, word [ebp - 0x168]
lea eax, [ebp + eax - 0x164]
add eax, ecx
lea ecx, [ebp - 0x17c]
cmp eax, ecx
jbe 0x1004c96
sub eax, ecx
mov dword [ebp - 0x70], eax
cmp eax, 0xffffffff
ja 0x1004c96
mov eax, dword fs:[0x18]
push dword [ebp - 0x70]
push 8
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x6c], eax
xor esi, esi
cmp eax, esi
jne 0x1004d62
mov dword [ebp - 0x60], 0x8007000e
jmp 0x1004de8
push esi
push esi
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x64]
call edi
test eax, eax
je 0x1004c96
push esi
lea eax, [ebp - 0x68]
push eax
mov edi, dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
push dword [ebp - 0x64]
call ebx
test eax, eax
jne 0x1004d9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jmp 0x1004c7c
cmp dword [ebp - 0x68], edi
jne 0x1004c96
mov eax, dword [ebp - 0x7c]
lea ecx, [eax + 0x14]
push ecx
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x6c]
call fcn.01004f9f
cmp eax, esi
jge 0x1004dc9
or eax, 0x10000000
jmp 0x1004c88
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x60], esi
jmp 0x1004def
mov dword [ebp - 4], 0xfffffffe
xor esi, esi
cmp dword [ebp - 0x6c], esi
je 0x1004e0c
push dword [ebp - 0x6c]
push esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x64], 0xffffffff
je 0x1004e20
cmp dword [ebp - 0x64], esi
je 0x1004e20
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
call fcn.01004f74
ret 8