Function at 0x1003c79
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push 0x16c
push 0x1006298
call fcn.01003fe4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], eax
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x6c], edi
push 0x40
push edi
lea eax, [ebp - 0x5c]
push eax
call sub.msvcrt.dll_memset
mov esi, 0xf8
push esi
push edi
lea eax, [ebp - 0x17c]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
xor eax, eax
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
push 0x80
push 3
push 0
push 7
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x64], edi
cmp edi, 0xffffffff
je 0x1003cf1
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1003d0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1003d05
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x60], eax
jmp 0x1003ea5
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x68]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push eax
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
call ebx
test eax, eax
jne 0x1003d46
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1003d3e
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x60], eax
jmp 0x1003e9e
cmp dword [ebp - 0x68], 0x40
je 0x1003d58
mov dword [ebp - 0x60], 0x800700c1
jmp 0x1003e9e
mov eax, 0x5a4d
cmp word [ebp - 0x5c], ax
jne 0x1003d4c
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x1003d4c
cmp eax, 0x10000000
jae 0x1003d4c
cdq
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], edx
push 0
push 0
push edx
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
call edi
test eax, eax
je 0x1003d4c
push 0
lea eax, [ebp - 0x68]
push eax
push esi
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 0x64]
call ebx
test eax, eax
je 0x1003d2a
cmp dword [ebp - 0x68], esi
jne 0x1003d4c
cmp dword [ebp - 0x17c], 0x4550
jne 0x1003d4c
movzx ecx, word [ebp - 0x176]
imul ecx, ecx, 0x28
movzx eax, word [ebp - 0x168]
lea eax, [ebp + eax - 0x164]
add eax, ecx
lea ecx, [ebp - 0x17c]
cmp eax, ecx
jbe 0x1003d4c
sub eax, ecx
mov dword [ebp - 0x70], eax
cmp eax, 0xffffffff
ja 0x1003d4c
mov eax, dword fs:[0x18]
push dword [ebp - 0x70]
push 8
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x6c], eax
xor esi, esi
cmp eax, esi
jne 0x1003e18
mov dword [ebp - 0x60], 0x8007000e
jmp 0x1003e9e
push esi
push esi
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x64]
call edi
test eax, eax
je 0x1003d4c
push esi
lea eax, [ebp - 0x68]
push eax
mov edi, dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
push dword [ebp - 0x64]
call ebx
test eax, eax
jne 0x1003e52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jmp 0x1003d32
cmp dword [ebp - 0x68], edi
jne 0x1003d4c
mov eax, dword [ebp - 0x7c]
lea ecx, [eax + 0x14]
push ecx
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x6c]
call main
cmp eax, esi
jge 0x1003e7f
or eax, 0x10000000
jmp 0x1003d3e
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x60], esi
jmp 0x1003ea5
mov dword [ebp - 4], 0xfffffffe
xor esi, esi
cmp dword [ebp - 0x6c], esi
je 0x1003ec2
push dword [ebp - 0x6c]
push esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x64], 0xffffffff
je 0x1003ed6
cmp dword [ebp - 0x64], esi
je 0x1003ed6
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
call fcn.0100402c
ret 8