Function at 0x6c295a50
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov esi, dword [esp + 0xa0]
mov edi, dword [esp + 0xa4]
mov ebx, dword [esp + 0xac]
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_GetFileInformationByHandle
sub esp, 8
test eax, eax
jne 0x6c295a98
mov eax, 0x200
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x3c]
mov cl, dl
and ecx, 1
movzx eax, cl
mov ebp, eax
or ebp, 2
test dl, 2
cmovne eax, ebp
mov ebp, eax
or ebp, 4
test dl, 4
cmovne eax, ebp
mov ebp, eax
or ebp, 0x10
mov dword [esp + 0x2c], ebp
mov ebp, edx
and ebp, 0x10
mov dword [esp + 0x24], ebp
cmovne eax, dword [esp + 0x2c]
mov ebp, eax
or ebp, 0x20
and edx, 0x20
cmovne eax, ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
jne 0x6c295c30
or eax, 0x80000000
mov ebp, eax
or ebp, 0x1000000
or eax, 0x1800000
test cl, cl
cmove ebp, eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov edx, eax
cmp eax, 0x28
ja 0x6c295c3c
test edi, edi
je 0x6c295b23
mov dword [edi], ebp
mov ecx, dword [esp + 0xa8]
test ecx, ecx
je 0x6c295b38
mov ebp, dword [esp + 0xa8]
mov dword [ebp], edx
test ebx, ebx
je 0x6c295bd5
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
add eax, 0x2ac18000
adc edx, 0xfe624e21
mov dword [esp + 8], 0x989680
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6c2d997c
mov dword [ebx], eax
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
add eax, 0x2ac18000
adc edx, 0xfe624e21
mov dword [esp + 8], 0x989680
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6c2d997c
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
add eax, 0x2ac18000
adc edx, 0xfe624e21
mov dword [esp + 8], 0x989680
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6c2d997c
mov dword [ebx + 8], eax
mov edx, dword [esp + 0xb0]
test edx, edx
je 0x6c295d7c
lea eax, [esp + 0x7e]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x7c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6c2958f0
movzx eax, word [esp + 0x7c]
shl eax, 0x10
movzx edx, word [esp + 0x7e]
or eax, edx
mov ebp, dword [esp + 0xb0]
mov dword [ebp], eax
xor eax, eax
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
or eax, 0x40000000
jmp 0x6c295aed
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 0x28], eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
mov dword [esp + 0x10], 0
lea eax, [esp + 0x70]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
lea eax, [esp + 0x7c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x24
mov dword [esp], esi
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
mov dword [esp + 0x10], 0
lea eax, [esp + 0x70]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
lea eax, [esp + 0x74]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
cmp word [esp + 0x7c], 0x54ad
mov edx, dword [esp + 0x28]
jne 0x6c295b1d
mov eax, dword [esp + 0x74]
lea ecx, [eax + 0x34]
cmp edx, ecx
jbe 0x6c295b1d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
mov dword [esp + 0x10], 0
lea eax, [esp + 0x70]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
lea eax, [esp + 0x78]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov eax, dword [esp + 0x78]
cmp eax, 0x5a4d
mov edx, dword [esp + 0x28]
je 0x6c295d6e
cmp eax, 0x454e
je 0x6c295d6e
cmp eax, 0x454c
je 0x6c295d6e
cmp eax, 0x4550
jne 0x6c295b1d
or ebp, 0x400000
jmp 0x6c295b1d
xor eax, eax
jmp 0x6c295a8b