Function at 0x10001370
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x1002e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x410
lea eax, [ebp - 0x414]
mov dword [ebp - 0x66c], 0
push 0
push eax
call fcn.10009740
add esp, 0xc
mov dword [ebp - 0x668], 0
lea eax, [ebp - 0x414]
mov dword [ebp - 0x664], 0
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001403
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007493
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x660]
push 0
push eax
push 0x40
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x660], 0
push eax
push esi
call ebx
cmp dword [ebp - 0x660], 0x40
je 0x10001449
xor edi, edi
jmp 0x10001525
mov eax, 0x5a4d
cmp word [ebp - 0x45c], ax
je 0x1000145e
xor edi, edi
jmp 0x10001525
push 0
push 0
push dword [ebp - 0x420]
push esi
call edi
cmp eax, dword [ebp - 0x420]
je 0x1000147a
xor edi, edi
jmp 0x10001525
push 0
lea eax, [ebp - 0x660]
mov dword [ebp - 0x660], 0
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x554]
push eax
push esi
call ebx
cmp dword [ebp - 0x660], 0xf8
je 0x100014ac
xor edi, edi
jmp 0x10001525
cmp dword [ebp - 0x554], 0x4550
je 0x100014bc
xor edi, edi
jmp 0x10001525
mov eax, 0x14c
cmp word [ebp - 0x550], ax
je 0x1000151f
push 1
push 0
push 0xffffff08
push esi
call edi
push 0
lea eax, [ebp - 0x660]
mov dword [ebp - 0x660], 0
push eax
push 0x108
lea eax, [ebp - 0x65c]
push eax
push esi
call ebx
cmp dword [ebp - 0x660], 0x108
je 0x10001508
xor edi, edi
jmp 0x10001525
mov edi, dword [ebp - 0x5b0]
xor eax, eax
cmp dword [ebp - 0x65c], 0x4550
cmovne edi, eax
jmp 0x10001525
mov edi, dword [ebp - 0x4b8]
push 2
push 0
mov eax, 0xfffffe00
sub eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x664]
push eax
push 8
lea eax, [ebp - 0x41c]
push eax
push esi
call ebx
test eax, eax
je 0x10001610
cmp dword [ebp - 0x664], 8
jne 0x10001610
push 4
lea eax, [ebp - 0x41c]
push str.TRL
push eax
call fcn.1000cce3
add esp, 0xc
test eax, eax
jne 0x10001610
push 2
push eax
mov eax, 0xfffffe08
sub eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x664]
push eax
push 4
lea eax, [ebp - 0x668]
push eax
push esi
call ebx
test eax, eax
je 0x10001610
cmp dword [ebp - 0x664], 4
jne 0x10001610
push 4
lea eax, [ebp - 0x668]
push str.PCA
push eax
call fcn.1000cce3
add esp, 0xc
test eax, eax
je 0x100015e8
push 4
lea eax, [ebp - 0x668]
push str.PSA
push eax
call fcn.1000cce3
add esp, 0xc
test eax, eax
jne 0x100015f2
mov dword [ebp - 0x66c], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x66c]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007493
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.10007493
mov esp, ebp
pop ebp
ret