Function at 0x30004660
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x30215e88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x144], 0xffffffff
mov ebx, edx
mov dword [ebp - 0x154], ebx
push edi
test esi, esi
jne 0x300046af
push str.VerifyHeaders:_Error___no_address_supplied._n
call fcn.3000a0d0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
call fcn.300042b0
test eax, eax
jle 0x3000469b
push 0x1c
lea eax, [ebp - 0x170]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x3000469b
mov eax, dword [ebp - 0x15c]
test al, 0xee
je 0x3000469b
test eax, 0x101
jne 0x3000469b
test eax, eax
je 0x3000469b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x3000469b
mov edi, dword [esi + 0x3c]
add edi, esi
mov ecx, edi
call fcn.30002a00
test eax, eax
je 0x3000469b
cmp dword [edi], 0x4550
jne 0x3000469b
mov eax, dword [esi + 0x3c]
movzx ecx, word [edi + 0x14]
add eax, 0x18
push 0
push 0x80
push 3
push 0
push 1
push closesocket
add eax, ecx
push ebx
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x3000469b
push 0
lea eax, [ebp - 0x148]
push eax
push 0x40
lea eax, [ebp - 0x48]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x300048dd
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
jne 0x300048dd
push 0
push 0
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x148]
push eax
push 0xf8
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x300048dd
movzx eax, word [edi + 6]
mov cx, word [ebp - 0x13a]
cmp cx, ax
je 0x300047d8
push eax
movzx eax, cx
push eax
push str.VerifyHeaders:_Number_of_sections_mismatch:__d_vs__d
call fcn.3000a0d0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x144]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
test cx, cx
jne 0x30004808
push str.VerifyHeaders:_Number_of_sections_zero
call fcn.3000a0d0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x144]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
push 0
push 0
push dword [ebp - 0x14c]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx ecx, word [ebp - 0x13a]
mov edx, 0x28
call fcn.300011a0
mov ecx, eax
movzx eax, word [ebp - 0x13a]
mov dword [ebp - 0x150], ecx
test ecx, ecx
jne 0x3000485f
push eax
push str.VerifyHeaders:_Error_allocating_memory_for__d_section_headers
call fcn.3000a0d0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
push 0
lea edi, [eax + eax*4]
lea eax, [ebp - 0x148]
shl edi, 3
push eax
push edi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x30004896
push dword [ebp - 0x154]
push str.VerifyHeaders:_Error_reading_section_headers_of__ws
call fcn.3000a0d0
mov esi, dword [ebp - 0x150]
add esp, 8
jmp 0x300048d6
mov eax, dword [ebp - 0x14c]
push edi
add eax, esi
mov esi, dword [ebp - 0x150]
push eax
push esi
call dword [0x30267730]
cmp eax, edi
jne 0x300048bd
mov dword [ebp - 0x144], 1
jmp 0x300048d6
push edi
push eax
push str.VerifyHeaders:_PE_header_does_not_match__0x_x_of_0x_x_matching_n
call fcn.3000a0d0
add esp, 0xc
mov dword [ebp - 0x144], 0
mov ecx, esi
call fcn.300011f0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x144]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.30159c2d
mov esp, ebp
pop ebp
ret