Function at 0x403b23
Capabilities:
Parse pe header
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x41ed70
push 0x405c40
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x20f8
call fcn.00416ca0
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x20e8], eax
mov esi, ecx
mov dword [ebp - 0x20cc], esi
mov dword [ebp - 0x210c], eax
or dword [ebp - 0x20dc], 0xffffffff
push 0x40
xor ebx, ebx
push ebx
lea eax, [ebp - 0x20a0]
push eax
call fcn.00405fe0
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x20c8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2028], ebx
mov dword [ebp - 0x2100], ebx
mov eax, ebx
mov dword [ebp - 0x20e4], eax
mov dword [ebp - 0x20fc], eax
mov dword [ebp - 0x20d4], ebx
push 0x34
push ebx
lea eax, [ebp - 0x205c]
push eax
call fcn.00405fe0
add esp, 0xc
mov eax, dword [ebp - 0x20e8]
test eax, eax
jne 0x403bec
mov edx, str.WDEP_1.0_501_Context_not_allocated_r_n
mov ecx, esi
call fcn.00404508
xor eax, eax
jmp 0x4042eb
mov esi, ebx
mov dword [ebp - 0x20f4], esi
mov dword [ebp - 4], ebx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2104], ecx
push ebx
push ebx
push 3
push ebx
push ecx
push 0x80100000
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x20dc], edi
cmp edi, 0xffffffff
jne 0x403c2b
mov edx, str.WDEP_1.0_404_File_not_found_or_can_not_be_accessed_r_n
jmp 0x40425f
lea eax, [ebp - 0x205c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x403c21
mov ecx, dword [ebp - 0x20e8]
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x20f8], eax
mov eax, dword [ecx + 0x24]
mov dword [ebp - 0x2104], eax
mov eax, dword [ebp - 0x2038]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x203c]
mov dword [ecx + 0x14], eax
mov dword [ebp - 0x2024], ebx
push ebx
lea eax, [ebp - 0x2024]
push eax
push 0x40
lea eax, [ebp - 0x20a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403c93
mov edx, str.WDEP_1.0_403_Can_not_read_file_headers_r_n
jmp 0x40425f
cmp dword [ebp - 0x2024], 0x40
jne 0x40425a
mov eax, 0x5a4d
cmp word [ebp - 0x20a0], ax
jne 0x40425a
mov ecx, dword [ebp - 0x2064]
test ecx, ecx
jle 0x40425a
mov dword [ebp - 0x2024], ebx
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20ac], ecx
lea eax, [ebp - 0x20b4]
push eax
lea eax, [ebp - 0x2024]
push eax
push 4
lea eax, [ebp - 0x2028]
push eax
push dword [ebp - 0x20dc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403c89
cmp dword [ebp - 0x2024], 4
jne 0x40425a
cmp dword [ebp - 0x2028], 0x4550
jne 0x40425a
mov dword [ebp - 0x2024], ebx
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2064]
add eax, 4
mov dword [ebp - 0x20ac], eax
lea eax, [ebp - 0x20b4]
push eax
lea eax, [ebp - 0x2024]
push eax
push 0x14
lea eax, [ebp - 0x20c8]
push eax
push dword [ebp - 0x20dc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403c89
cmp dword [ebp - 0x2024], 0x14
jne 0x40425a
mov dword [ebp - 0x2024], ebx
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2064]
add eax, 0x18
mov dword [ebp - 0x20ac], eax
push ebx
push ebx
push ebx
push 2
push ebx
mov edi, dword [ebp - 0x20dc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x20e0], eax
test eax, eax
je 0x403e98
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x20d0], esi
push dword [ebp - 0x20e0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x403e98
mov ecx, dword [ebp - 0x20ac]
add ecx, esi
mov dword [ebp - 0x20f4], ecx
mov esi, dword [ebp - 0x2038]
inc esi
shr esi, 1
mov dword [ebp - 0x2108], esi
mov eax, dword [ebp - 0x20d0]
mov dword [ebp - 0x20f0], eax
mov edx, ebx
mov eax, esi
dec esi
mov dword [ebp - 0x2108], esi
test eax, eax
je 0x403e42
mov eax, dword [ebp - 0x20f0]
movzx eax, word [eax]
add edx, eax
mov dword [ebp - 0x20e4], edx
add dword [ebp - 0x20f0], 2
shr edx, 0x10
mov eax, dword [ebp - 0x20e4]
movzx eax, ax
add edx, eax
jmp 0x403e0d
mov eax, edx
shr eax, 0x10
add eax, edx
movzx eax, ax
mov dword [ebp - 0x20e4], eax
movzx edx, word [ecx + 0x40]
mov si, ax
cmp si, dx
sbb eax, eax
neg eax
add ax, dx
sub si, ax
movzx ecx, word [ecx + 0x42]
cmp si, cx
sbb eax, eax
neg eax
add ax, cx
sub si, ax
movzx eax, si
add eax, dword [ebp - 0x2038]
mov dword [ebp - 0x20e4], eax
mov dword [ebp - 0x20fc], eax
push dword [ebp - 0x20d0]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movzx eax, word [ebp - 0x20c6]
imul ecx, eax, 0x28
movzx eax, word [ebp - 0x20b8]
add ecx, eax
mov eax, 0x1000
cmp ecx, eax
cmovb ecx, eax
mov dword [ebp - 0x20d0], ecx
push 4
push 0x3000
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 0x20f4], esi
test esi, esi
jne 0x403ee7
mov edx, str.WDEP_1.0_500_Can_not_allocate_resources_r_n
jmp 0x40425f
lea eax, [ebp - 0x20b4]
push eax
lea eax, [ebp - 0x2024]
push eax
push dword [ebp - 0x20d0]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403c89
movzx edx, word [ebp - 0x20b8]
add edx, esi
mov dword [ebp - 0x20e0], edx
mov ax, word [esi]
mov ecx, dword [ebp - 0x20e8]
mov word [ecx + 0x18], ax
movzx eax, word [esi]
mov ecx, 0x10b
cmp ax, cx
je 0x403f42
mov ecx, 0x20b
cmp ax, cx
jne 0x40425a
cmp word [ebp - 0x20c6], 0
jne 0x403f65
mov ecx, dword [esi + 0x38]
cmp dword [ebp - 0x2064], ecx
cmova ecx, dword [ebp - 0x2064]
call fcn.00402656
mov edi, eax
jmp 0x403f68
mov edi, dword [edx + 0xc]
mov dword [ebp - 0x20ec], edi
mov ecx, ebx
mov dword [ebp - 0x20d8], ecx
movzx eax, word [ebp - 0x20c6]
cmp ecx, eax
jge 0x403ff5
imul ecx, ecx, 0x28
mov eax, dword [ecx + edx + 0xc]
mov dword [ebp - 0x20d0], eax
xor edx, edx
div dword [esi + 0x20]
test edx, edx
jne 0x40425a
cmp dword [ebp - 0x20d0], edi
jne 0x40425a
mov edx, dword [ebp - 0x20e0]
mov eax, dword [ecx + edx + 8]
mov dword [ebp - 0x20d0], eax
mov ecx, dword [ecx + edx + 0x10]
mov eax, ecx
mov edx, dword [ebp - 0x20d0]
or eax, edx
je 0x40425a
test edx, edx
cmovne ecx, edx
mov edx, dword [esi + 0x20]
call fcn.0040266b
add edi, eax
mov dword [ebp - 0x20ec], edi
mov ecx, dword [ebp - 0x20d8]
inc ecx
mov dword [ebp - 0x20d8], ecx
mov edx, dword [ebp - 0x20e0]
jmp 0x403f76
mov ecx, edi
call fcn.00402656
mov edx, eax
mov dword [ebp - 0x20ec], edx
mov ecx, dword [esi + 0x38]
call fcn.00402656
cmp edx, eax
jne 0x40425a
mov edi, 0x1000000
cmp dword [ebp - 0x20f8], 0
cmovne edi, dword [ebp - 0x2104]
mov dword [ebp - 0x20d8], edi
mov eax, dword [ebp - 0x20d4]
cmp edi, 0x40000000
jge 0x40406f
push 4
push 0x3000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x20d4], eax
test eax, eax
jne 0x404077
add edi, 0x10000
mov dword [ebp - 0x20d8], edi
mov edx, dword [ebp - 0x20ec]
jmp 0x404033
test eax, eax
je 0x403edd
mov dword [ebp - 0x2024], ebx
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, word [esi]
mov ecx, 0x10b
cmp ax, cx
je 0x4040a5
mov ecx, 0x20b
cmp ax, cx
jne 0x40425a
cmp word [ebp - 0x20c6], 0
jne 0x4040c6
mov ecx, dword [esi + 0x38]
cmp dword [ebp - 0x2064], ecx
cmova ecx, dword [ebp - 0x2064]
call fcn.00402656
jmp 0x4040de
mov ecx, dword [esi + 0x3c]
cmp dword [ebp - 0x2064], ecx
cmova ecx, dword [ebp - 0x2064]
mov edx, dword [esi + 0x24]
call fcn.0040266b
lea ecx, [ebp - 0x20b4]
push ecx
lea ecx, [ebp - 0x2024]
push ecx
push eax
push dword [ebp - 0x20d4]
push dword [ebp - 0x20dc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403c89
mov ecx, ebx
mov dword [ebp - 0x20d8], ecx
mov edx, dword [ebp - 0x20e0]
movzx eax, word [ebp - 0x20c6]
cmp ecx, eax
jge 0x4041d3
imul eax, ecx, 0x28
mov dword [ebp - 0x20d0], eax
cmp dword [eax + edx + 0x14], ebx
je 0x4041c7
xor eax, eax
lea edi, [ebp - 0x20b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x20e0]
mov eax, dword [ebp - 0x20d0]
mov ecx, dword [eax + edi + 0x14]
mov eax, ecx
xor edx, edx
div dword [esi + 0x24]
sub ecx, edx
mov dword [ebp - 0x20ac], ecx
mov ecx, dword [ebp - 0x20d0]
mov eax, dword [ecx + edi + 8]
mov ecx, dword [ecx + edi + 0x10]
mov edx, ecx
test eax, eax
cmovne edx, eax
cmp edx, ecx
cmovb ecx, edx
mov edx, dword [esi + 0x24]
call fcn.0040266b
mov dword [ebp - 0x2024], ebx
lea ecx, [ebp - 0x20b4]
push ecx
lea ecx, [ebp - 0x2024]
push ecx
push eax
mov eax, dword [ebp - 0x20d0]
mov eax, dword [eax + edi + 0xc]
add eax, dword [ebp - 0x20d4]
push eax
push dword [ebp - 0x20dc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403c89
mov ecx, dword [ebp - 0x20d8]
mov edx, edi
inc ecx
mov dword [ebp - 0x20d8], ecx
jmp 0x404115
cmp dword [ebp - 0x20f8], 0
je 0x404248
movzx eax, word [esi]
mov ecx, 0x10b
cmp ax, cx
je 0x404214
mov ecx, 0x20b
cmp ax, cx
jne 0x404248
cmp dword [esi + 0x6c], 5
jbe 0x404207
mov eax, dword [esi + 0x98]
mov ecx, dword [esi + 0x9c]
jmp 0x40420b
mov eax, ebx
mov ecx, ebx
test eax, eax
je 0x404248
mov edx, dword [esi + 0x18]
jmp 0x404233
cmp dword [esi + 0x5c], 5
jbe 0x404228
mov eax, dword [esi + 0x88]
mov ecx, dword [esi + 0x8c]
jmp 0x40422c
mov eax, ebx
mov ecx, ebx
test eax, eax
je 0x404248
mov edx, dword [esi + 0x1c]
push ecx
add eax, dword [ebp - 0x20d4]
push eax
mov ecx, dword [ebp - 0x20d4]
call fcn.00402683
pop ecx
pop ecx
mov dword [ebp - 0x2100], 1
mov edi, dword [ebp - 0x20cc]
jmp 0x40426c
mov edx, str.WDEP_1.0_415_Invalid_file_headers_or_signatures_r_n
mov edi, dword [ebp - 0x20cc]
mov ecx, edi
call fcn.00404508
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x2104], 0
call fcn.0040432b
mov ebx, dword [ebp - 0x20d4]
test ebx, ebx
je 0x4042e9
push dword [ebp - 0x20e4]
push dword [ebp - 0x2038]
push dword [ebp - 0x203c]
push dword [ebp - 0x2044]
push dword [ebp - 0x2048]
push dword [ebp - 0x2054]
push dword [ebp - 0x2058]
push dword [ebp - 0x205c]
push str.WDEP_1.0_200_OK_r_n_fileinfo_:_FileAttributes_:_u__CreationTimeLow_:_u__CreationTimeHigh_:_u__LastWriteTimeLow_:_u__LastWriteTimeHigh_:_u__FileSizeHigh_:_u__FileSizeLow_:_u__RealChecksum_:_u_r_n
push 0x1000
lea eax, [ebp - 0x2020]
push eax
call fcn.00401486
add esp, 0x2c
push dword [ebp - 0x20e8]
lea edx, [ebp - 0x2020]
mov ecx, edi
call fcn.00404537
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00404f0e
leave
ret