Function at 0x403559
Capabilities:
Parse pe header
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x41ebd0
push 0x4055e0
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x20e8
call fcn.00416640
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x20d0], edx
mov dword [ebp - 0x20cc], ecx
push 0x40
xor ebx, ebx
push ebx
lea eax, [ebp - 0x20a0]
push eax
call fcn.00405980
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x20c8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2028], ebx
mov dword [ebp - 0x20f8], ebx
mov eax, ebx
mov dword [ebp - 0x20e4], eax
mov dword [ebp - 0x20f4], eax
mov dword [ebp - 0x20d4], ebx
push 0x34
push ebx
lea eax, [ebp - 0x205c]
push eax
call fcn.00405980
add esp, 0xc
mov esi, ebx
mov dword [ebp - 0x20ec], esi
push ebx
push ebx
push 3
push ebx
push 1
push 0x80100000
mov ecx, dword [ebp - 0x20d0]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x20e0], edi
cmp edi, 0xffffffff
jne 0x40363b
mov edx, str.WDEP_1.0_404_File_not_found_or_can_not_be_accessed_r_n
mov ecx, dword [ebp - 0x20cc]
call fcn.00403f84
xor eax, eax
jmp 0x403cda
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20d8], 1
lea eax, [ebp - 0x205c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x403664
mov edx, str.WDEP_1.0_404_File_not_found_or_can_not_be_accessed_r_n
jmp 0x403c55
mov eax, dword [ebp - 0x2038]
mov ecx, dword [ebp - 0x20d0]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x203c]
mov dword [ecx + 0x14], eax
mov dword [ebp - 0x2024], ebx
push ebx
lea eax, [ebp - 0x2024]
push eax
push 0x40
lea eax, [ebp - 0x20a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4036a8
mov edx, str.WDEP_1.0_403_Can_not_read_file_headers_r_n
jmp 0x403c55
cmp dword [ebp - 0x2024], 0x40
jne 0x403c50
mov eax, 0x5a4d
cmp word [ebp - 0x20a0], ax
jne 0x403c50
mov ecx, dword [ebp - 0x2064]
test ecx, ecx
jle 0x403c50
mov dword [ebp - 0x2024], ebx
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20ac], ecx
lea eax, [ebp - 0x20b4]
push eax
lea eax, [ebp - 0x2024]
push eax
push 4
lea eax, [ebp - 0x2028]
push eax
push dword [ebp - 0x20e0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40369e
cmp dword [ebp - 0x2024], 4
jne 0x403c50
cmp dword [ebp - 0x2028], 0x4550
jne 0x403c50
mov dword [ebp - 0x2024], ebx
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2064]
add eax, 4
mov dword [ebp - 0x20ac], eax
lea eax, [ebp - 0x20b4]
push eax
lea eax, [ebp - 0x2024]
push eax
push 0x14
lea eax, [ebp - 0x20c8]
push eax
push dword [ebp - 0x20e0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40369e
cmp dword [ebp - 0x2024], 0x14
jne 0x403c50
mov dword [ebp - 0x2024], ebx
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2064]
add eax, 0x18
mov dword [ebp - 0x20ac], eax
push ebx
push ebx
push ebx
push 2
push ebx
push dword [ebp - 0x20e0]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x403897
push ebx
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0x20d8], edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x403897
mov ecx, dword [ebp - 0x20ac]
add ecx, edi
mov dword [ebp - 0x20ec], ecx
mov esi, dword [ebp - 0x2038]
inc esi
shr esi, 1
mov dword [ebp - 0x20fc], esi
mov edx, edi
mov dword [ebp - 0x20f0], edx
mov edi, ebx
mov eax, esi
dec esi
mov dword [ebp - 0x20fc], esi
test eax, eax
je 0x403841
movzx eax, word [edx]
add edi, eax
add edx, 2
mov dword [ebp - 0x20f0], edx
mov edx, edi
shr edx, 0x10
movzx edi, di
add edi, edx
mov edx, dword [ebp - 0x20f0]
jmp 0x403814
mov eax, edi
shr eax, 0x10
add eax, edi
movzx eax, ax
mov dword [ebp - 0x20e4], eax
movzx edx, word [ecx + 0x40]
mov si, ax
cmp si, dx
sbb eax, eax
neg eax
add ax, dx
sub si, ax
movzx ecx, word [ecx + 0x42]
cmp si, cx
sbb eax, eax
neg eax
add ax, cx
sub si, ax
movzx eax, si
add eax, dword [ebp - 0x2038]
mov dword [ebp - 0x20e4], eax
mov dword [ebp - 0x20f4], eax
push dword [ebp - 0x20d8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movzx eax, word [ebp - 0x20c6]
imul edi, eax, 0x28
movzx eax, word [ebp - 0x20b8]
add edi, eax
mov eax, 0x1000
cmp edi, eax
cmovb edi, eax
push 4
push 0x3000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 0x20ec], esi
test esi, esi
jne 0x4038e0
mov edx, str.WDEP_1.0_500_Can_not_allocate_resources_r_n
jmp 0x403c55
lea eax, [ebp - 0x20b4]
push eax
lea eax, [ebp - 0x2024]
push eax
push edi
push esi
push dword [ebp - 0x20e0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40369e
movzx edx, word [ebp - 0x20b8]
add edx, esi
mov dword [ebp - 0x20d8], edx
mov edi, 0x10b
xor eax, eax
cmp word [esi], di
sete al
mov ecx, dword [ebp - 0x20d0]
mov dword [ecx + 0x18], eax
movzx ecx, word [esi]
cmp cx, di
je 0x40393f
mov eax, 0x20b
cmp cx, ax
jne 0x403c50
cmp word [ebp - 0x20c6], 0
jne 0x403962
mov ecx, dword [esi + 0x38]
cmp dword [ebp - 0x2064], ecx
cmova ecx, dword [ebp - 0x2064]
call fcn.0040201e
mov edi, eax
jmp 0x403965
mov edi, dword [edx + 0xc]
mov dword [ebp - 0x20e8], edi
mov ecx, ebx
mov dword [ebp - 0x20dc], ecx
movzx eax, word [ebp - 0x20c6]
cmp ecx, eax
jge 0x4039f2
imul ecx, ecx, 0x28
mov eax, dword [ecx + edx + 0xc]
mov dword [ebp - 0x20d0], eax
xor edx, edx
div dword [esi + 0x20]
test edx, edx
jne 0x403c50
cmp dword [ebp - 0x20d0], edi
jne 0x403c50
mov edx, dword [ebp - 0x20d8]
mov eax, dword [ecx + edx + 8]
mov dword [ebp - 0x20d0], eax
mov ecx, dword [ecx + edx + 0x10]
mov eax, ecx
mov edx, dword [ebp - 0x20d0]
or eax, edx
je 0x403c50
test edx, edx
cmovne ecx, edx
mov edx, dword [esi + 0x20]
call fcn.00402033
add edi, eax
mov dword [ebp - 0x20e8], edi
mov ecx, dword [ebp - 0x20dc]
inc ecx
mov dword [ebp - 0x20dc], ecx
mov edx, dword [ebp - 0x20d8]
jmp 0x403973
mov ecx, edi
call fcn.0040201e
mov edx, eax
mov dword [ebp - 0x20e8], edx
mov ecx, dword [esi + 0x38]
call fcn.0040201e
cmp edx, eax
jne 0x403c50
mov eax, 0x1000000
cmp dword [ebp + 8], 0
mov edi, dword [ebp + 0xc]
cmove edi, eax
mov dword [ebp - 0x20dc], edi
mov eax, dword [ebp - 0x20d4]
cmp edi, 0x40000000
jge 0x403a68
push 4
push 0x3000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x20d4], eax
test eax, eax
jne 0x403a70
add edi, 0x10000
mov dword [ebp - 0x20dc], edi
mov edx, dword [ebp - 0x20e8]
jmp 0x403a2c
test eax, eax
je 0x4038d6
mov dword [ebp - 0x2024], ebx
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, word [esi]
mov ecx, 0x10b
cmp ax, cx
je 0x403a9e
mov ecx, 0x20b
cmp ax, cx
jne 0x403c50
cmp word [ebp - 0x20c6], 0
jne 0x403abf
mov ecx, dword [esi + 0x38]
cmp dword [ebp - 0x2064], ecx
cmova ecx, dword [ebp - 0x2064]
call fcn.0040201e
jmp 0x403ad7
mov ecx, dword [esi + 0x3c]
cmp dword [ebp - 0x2064], ecx
cmova ecx, dword [ebp - 0x2064]
mov edx, dword [esi + 0x24]
call fcn.00402033
lea ecx, [ebp - 0x20b4]
push ecx
lea ecx, [ebp - 0x2024]
push ecx
push eax
push dword [ebp - 0x20d4]
push dword [ebp - 0x20e0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40369e
mov ecx, ebx
mov dword [ebp - 0x20dc], ecx
mov edx, dword [ebp - 0x20d8]
movzx eax, word [ebp - 0x20c6]
cmp ecx, eax
jge 0x403bcc
imul eax, ecx, 0x28
mov dword [ebp - 0x20d0], eax
cmp dword [eax + edx + 0x14], ebx
je 0x403bc0
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x20d8]
mov eax, dword [ebp - 0x20d0]
mov ecx, dword [eax + edi + 0x14]
mov eax, ecx
xor edx, edx
div dword [esi + 0x24]
sub ecx, edx
mov dword [ebp - 0x20ac], ecx
mov ecx, dword [ebp - 0x20d0]
mov eax, dword [ecx + edi + 8]
mov ecx, dword [ecx + edi + 0x10]
mov edx, ecx
test eax, eax
cmovne edx, eax
cmp edx, ecx
cmovb ecx, edx
mov edx, dword [esi + 0x24]
call fcn.00402033
mov dword [ebp - 0x2024], ebx
lea ecx, [ebp - 0x20b4]
push ecx
lea ecx, [ebp - 0x2024]
push ecx
push eax
mov eax, dword [ebp - 0x20d0]
mov eax, dword [eax + edi + 0xc]
add eax, dword [ebp - 0x20d4]
push eax
push dword [ebp - 0x20e0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40369e
mov ecx, dword [ebp - 0x20dc]
mov edx, edi
inc ecx
mov dword [ebp - 0x20dc], ecx
jmp 0x403b0e
cmp dword [ebp + 8], 0
je 0x403c3e
movzx eax, word [esi]
mov ecx, 0x10b
cmp ax, cx
je 0x403c0a
mov ecx, 0x20b
cmp ax, cx
jne 0x403c3e
cmp dword [esi + 0x6c], 5
jbe 0x403bfd
mov eax, dword [esi + 0x98]
mov ecx, dword [esi + 0x9c]
jmp 0x403c01
mov eax, ebx
mov ecx, ebx
test eax, eax
je 0x403c3e
mov edx, dword [esi + 0x18]
jmp 0x403c29
cmp dword [esi + 0x5c], 5
jbe 0x403c1e
mov eax, dword [esi + 0x88]
mov ecx, dword [esi + 0x8c]
jmp 0x403c22
mov eax, ebx
mov ecx, ebx
test eax, eax
je 0x403c3e
mov edx, dword [esi + 0x1c]
push ecx
add eax, dword [ebp - 0x20d4]
push eax
mov ecx, dword [ebp - 0x20d4]
call fcn.0040204b
pop ecx
pop ecx
mov dword [ebp - 0x20f8], 1
mov edi, dword [ebp - 0x20cc]
jmp 0x403c62
mov edx, str.WDEP_1.0_415_Invalid_file_headers_or_signatures_r_n
mov edi, dword [ebp - 0x20cc]
mov ecx, edi
call fcn.00403f84
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x20d8], 0
call fcn.00403d0e
mov ebx, dword [ebp - 0x20d4]
test ebx, ebx
je 0x403cd8
push dword [ebp - 0x20e4]
push dword [ebp - 0x2038]
push dword [ebp - 0x203c]
push dword [ebp - 0x2044]
push dword [ebp - 0x2048]
push dword [ebp - 0x2054]
push dword [ebp - 0x2058]
push dword [ebp - 0x205c]
push str.WDEP_1.0_200_OK_r_n_fileinfo_:_FileAttributes_:_u__CreationTimeLow_:_u__CreationTimeHigh_:_u__LastWriteTimeLow_:_u__LastWriteTimeHigh_:_u__FileSizeHigh_:_u__FileSizeLow_:_u__RealChecksum_:_u_r_n
push 0x1000
lea eax, [ebp - 0x2020]
push eax
call fcn.00401033
add esp, 0x2c
lea edx, [ebp - 0x2020]
mov ecx, edi
call fcn.00403f84
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004048a4
leave
ret