Function at 0x42f5b0
Capabilities:
Get file size
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x42f860
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42f856
cmp dword [ebp - 0xc], 0
jne 0x42f856
push 0
lea eax, [ebp - 0x174]
push eax
push 0x40
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [0x54b4c4]
test eax, eax
je 0x42f856
cmp dword [ebp - 0x174], 0x40
jne 0x42f856
mov eax, dword [ebp - 0x50]
and eax, 0xffff
cmp eax, 0x5a4d
jne 0x42f856
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [0x54b4e4]
cmp eax, dword [ebp - 0x14]
jne 0x42f856
push 0
lea eax, [ebp - 0x174]
push eax
push 0xf8
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [0x54b4c4]
test eax, eax
je 0x42f856
cmp dword [ebp - 0x148], 0x4550
jne 0x42f856
mov eax, dword [ebp - 0x142]
and eax, 0xffff
test eax, eax
je 0x42f856
mov ecx, dword [ebp - 0x134]
and ecx, 0xffff
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x142]
and ecx, 0xffff
sub ecx, 1
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x178]
add edx, ecx
mov dword [ebp - 0x178], edx
push 0
push 0
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x54b4e4]
cmp eax, dword [ebp - 0x178]
jne 0x42f856
push 0
lea edx, [ebp - 0x174]
push edx
push 0x28
lea eax, [ebp - 0x170]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x54b4c4]
test eax, eax
je 0x42f856
cmp dword [ebp - 0x174], 0x28
jne 0x42f856
mov edx, dword [ebp - 0x15c]
add edx, dword [ebp - 0x160]
mov dword [ebp - 0x17c], edx
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x10]
jae 0x42f856
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x17c]
mov dword [ebp - 0x184], ecx
push 4
push 0x1000
mov edx, dword [ebp - 0x184]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
je 0x42f856
push 0
push 0
mov eax, dword [ebp - 0x17c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x54b4e4]
cmp eax, dword [ebp - 0x17c]
jne 0x42f842
push 0
lea edx, [ebp - 0x174]
push edx
mov eax, dword [ebp - 0x184]
push eax
mov ecx, dword [ebp - 0x180]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [0x54b4c4]
test eax, eax
je 0x42f842
mov eax, dword [ebp - 0x174]
cmp eax, dword [ebp - 0x184]
jne 0x42f842
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
je 0x42f810
push 0xf8
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
cmp dword [ebp + 0x18], 0
je 0x42f821
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0x184]
mov dword [ecx], edx
cmp dword [ebp + 0x14], 0
je 0x42f82f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp dword [ebp + 0x10], 0
je 0x42f840
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x17c]
mov dword [edx], eax
jmp 0x42f856
push 0x8000
push 0
mov ecx, dword [ebp - 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret