Function at 0x4164ba
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4412dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
xor esi, esi
inc esi
cmp eax, esi
je 0x416502
mov eax, 0x1000000
jmp 0x416694
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x41651b
mov eax, 0x200
jmp 0x416694
mov eax, dword [ebp - 0x38]
xor ebx, ebx
mov edx, eax
and edx, esi
mov dword [ebp - 0x3c], ebx
je 0x41652c
mov dword [ebp - 0x3c], esi
test al, 2
je 0x416534
or dword [ebp - 0x3c], 2
test al, 4
je 0x41653c
or dword [ebp - 0x3c], 4
mov ecx, eax
and ecx, 0x10
je 0x416547
or dword [ebp - 0x3c], 0x10
test al, 0x20
je 0x41654f
or dword [ebp - 0x3c], 0x20
cmp ecx, ebx
je 0x41655c
or dword [ebp - 0x3c], 0x40000000
jmp 0x416563
or dword [ebp - 0x3c], 0x80000000
or dword [ebp - 0x3c], 0x1000000
cmp edx, ebx
jne 0x416575
or dword [ebp - 0x3c], 0x800000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x48], eax
cmp eax, 0x28
jbe 0x416616
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
push edi
call esi
push ebx
lea eax, [ebp - 0x4c]
push eax
push 2
lea eax, [ebp - 0x40]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
call edi
push ebx
push ebx
push 0x24
push dword [ebp - 0x44]
call esi
push ebx
lea eax, [ebp - 0x4c]
push eax
push 4
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
call edi
mov eax, 0x54ad
cmp word [ebp - 0x40], ax
jne 0x416616
mov eax, dword [ebp - 0x50]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x48], ecx
jbe 0x416616
push ebx
push ebx
push eax
push dword [ebp - 0x44]
call esi
push ebx
lea eax, [ebp - 0x4c]
push eax
push 4
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x44]
call edi
mov eax, dword [ebp - 0x64]
cmp eax, 0x5a4d
je 0x41660f
cmp eax, 0x454e
je 0x41660f
cmp eax, 0x454c
je 0x41660f
cmp eax, 0x4550
jne 0x416616
or dword [ebp - 0x3c], 0x400000
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x416622
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
cmp eax, ebx
je 0x41662e
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov esi, dword [ebp - 0x54]
cmp esi, ebx
je 0x41666a
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0041641a
push dword [ebp - 0x20]
mov dword [esi], eax
push dword [ebp - 0x24]
mov dword [esi + 4], edx
call fcn.0041641a
push dword [ebp - 0x30]
mov dword [esi + 8], eax
push dword [ebp - 0x34]
mov dword [esi + 0xc], edx
call fcn.0041641a
add esp, 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp - 0x5c]
cmp esi, ebx
je 0x416692
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx eax, word [ebp - 0x40]
movzx ecx, word [ebp - 0x3c]
shl eax, 0x10
or eax, ecx
mov dword [esi], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419542
leave
ret