Function at 0x1006a390
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push ebx
push esi
push edi
lea edi, [ebp - 0x160]
mov ecx, 0x58
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1012e014]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10132102
call fcn.100552fb
mov byte [ebp - 9], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x68], 0
mov esi, esp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.100553c8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x1006a51b
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
mov esi, esp
push 2
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp esi, esp
call fcn.100553c8
test eax, eax
je 0x1006a51b
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x74]
push eax
call fcn.10053ab9
add esp, 4
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x1006a48b
mov esi, esp
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100553c8
xor al, al
jmp 0x1006a57b
mov eax, dword [ebp - 0x74]
push eax
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.10053e88
add esp, 0xc
mov esi, esp
push 0
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp esi, esp
call fcn.100553c8
mov esi, esp
push 0
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, esp
call fcn.100553c8
test eax, eax
je 0x1006a51b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x1006a51b
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax], 0x4550
jne 0x1006a51b
mov eax, dword [ebp - 0x68]
add eax, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 9], 1
cmp dword [ebp - 0x24], 0
je 0x1006a565
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x158]
push ecx
call fcn.10055251
add esp, 4
cmp dword [ebp - 0x158], 0
jne 0x1006a54e
mov dword [ebp - 0x160], 0
jmp 0x1006a55e
mov dword [ebp - 0x24], 0x8123
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x24], 0
mov esi, esp
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100553c8
mov al, byte [ebp - 9]
push edx
mov ecx, ebp
push eax
lea edx, [0x1006a5ac]
call fcn.10055562
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10054f8b
add esp, 0x160
cmp ebp, esp
call fcn.100553c8
mov esp, ebp
pop ebp
ret