Function at 0x10001cb0
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
cmp dword [ebp + 8], 0
jne 0x10001cf0
jmp 0x10001f29
push str.___Mapping_PE_File_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xc]
test ecx, ecx
jne 0x10001e5f
push str.___Creating_Map_View_of_File_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
mov esi, esp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.10001159
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10001d9c
push str.___Failed_to_open_PE_File_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
jmp 0x10001f29
mov esi, esp
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, esp
call fcn.10001159
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov esi, esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp esi, esp
call fcn.10001159
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10001e09
push str.___Failed_to_create_file_mapping_for_PE_File_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
jmp 0x10001f29
mov esi, esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp esi, esp
call fcn.10001159
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x10001e5f
push str.___Failed_to_obtain_a_map_view_of_PE_File_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
jmp 0x10001f29
push str.___Map_View_of_File_created_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10001ec4
push str.___DOS_Signature_invalid_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
jmp 0x10001f29
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
add eax, dword [ecx + 0x3c]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp dword [ecx], 0x4550
je 0x10001f0d
push str.___NT_Signature_mismatch_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
jmp 0x10001f29
mov eax, dword fs:[0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 8]
mov dword [eax + 0x18], edx
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x14], 0
je 0x10001f43
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10001159
nop
cmp dword [ebp - 8], 0
je 0x10001f5d
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10001159
nop
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.10001159
mov esp, ebp
pop ebp
ret