Function at 0x100526c2
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x9c
push edi
mov edi, ecx
mov dword [esp + 0x1c], edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x100526e5
mov eax, 0x1000000
jmp 0x1005294f
lea eax, [esp + 0x4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x100526ff
mov eax, 0x200
jmp 0x1005294f
push ebx
push ebp
push esi
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x90]
push eax
call esi
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0xa0]
push eax
call esi
push 8
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x28]
push eax
call sub.VCRUNTIME140.dll_memcpy
push 8
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x28]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x84]
mov ebp, dword [esp + 0x3c]
add esp, 0x18
sub ebx, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x64]
sbb ebp, dword [esp + 0x18]
xor esi, esi
mov dword [esp + 0x30], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x34], eax
push 8
push dword [esp + esi*4 + 0x30]
lea eax, [esp + 0x40]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
sub ecx, ebx
push 8
sbb eax, ebp
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], eax
lea eax, [esp + 0x50]
push eax
push dword [esp + esi*4 + 0x40]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
inc esi
cmp esi, 3
jl 0x10052794
mov ecx, dword [esp + 0x58]
mov edx, ecx
and edx, 1
mov eax, edx
test cl, 2
je 0x100527e4
or eax, 2
test cl, 4
je 0x100527ec
or eax, 4
mov esi, ecx
and esi, 0x10
je 0x100527f6
or eax, 0x10
test cl, 0x20
je 0x100527fe
or eax, 0x20
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x81000000
or esi, eax
test edx, edx
jne 0x1005281a
or esi, 0x800000
xor ebp, ebp
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0x28
jbe 0x100528c8
push ebp
push ebp
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call ebp
push 0
lea eax, [esp + 0x20]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0x24
push edi
call ebp
push 0
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [esp + 0x10], ax
jne 0x100528c8
mov ecx, dword [esp + 0x14]
lea eax, [ecx + 0x34]
cmp ebx, eax
jbe 0x100528c8
push 0
push 0
push ecx
push edi
call ebp
push 0
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x20]
cmp eax, 0x5a4d
je 0x100528c2
cmp eax, 0x454e
je 0x100528c2
cmp eax, 0x454c
je 0x100528c2
cmp eax, 0x4550
jne 0x100528c8
or esi, 0x400000
mov eax, dword [esp + 0x28]
test eax, eax
je 0x100528d2
mov dword [eax], esi
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x100528df
mov dword [eax], ebx
mov esi, dword [esp + 0xb4]
test esi, esi
je 0x10052919
push dword [esp + 0x68]
push dword [esp + 0x68]
call fcn.10053b54
push dword [esp + 0x70]
mov dword [esi], eax
push dword [esp + 0x70]
call fcn.10053b54
push dword [esp + 0x60]
mov dword [esi + 4], eax
push dword [esp + 0x60]
call fcn.10053b54
mov dword [esi + 8], eax
mov esi, dword [esp + 0xb8]
test esi, esi
je 0x1005294a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx ecx, word [esp + 0x10]
movzx eax, word [esp + 0x14]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
pop esi
pop ebp
xor eax, eax
pop ebx
pop edi
add esp, 0x9c
ret 0xc