Function at 0x10028990
Capabilities:
Enumerate pe sections
Get common file path
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e8018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
mov esi, ecx
push eax
mov dword [ebp - 0x10c], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x100289ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSystemDirectoryA_failed__with_error_code__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
push 0xe
push str.kernel32.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.1003be76
add esp, 0x10
test eax, eax
je 0x10028a37
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.strncat_s_failed__with_error_code__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x10028a69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileA_failed__with_error_code__d_n
jmp 0x10028ab3
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
jne 0x10028a8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileMapping_failed__with_error_code__d_n
jmp 0x10028ab3
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x118], ecx
test ecx, ecx
jne 0x10028acb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MapViewOfFile_failed__with_error_code__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
push str.GetMapViewOfFile_failed_n
jmp 0x10028b96
mov eax, 0x5a4d
cmp ax, word [ecx]
jne 0x10028b91
add ecx, dword [ecx + 0x3c]
cmp dword [ecx], 0x4550
jne 0x10028b91
movzx eax, word [ecx + 0x14]
push ebx
lea ebx, [ecx + 0x18]
add ebx, eax
mov dword [ebp - 0x114], ebx
jne 0x10028b14
mov eax, dword [ebp - 0x118]
xor esi, esi
pop ebx
add eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
movzx eax, word [ecx + 6]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x110], eax
push edi
cmp cx, ax
jae 0x10028b76
nop dword [eax + eax]
movzx eax, dx
lea eax, [eax + eax*4]
lea edi, [ebx + eax*8]
mov ebx, dword [edi + 0xc]
cmp esi, ebx
jb 0x10028b64
mov eax, dword [edi + 8]
add eax, ebx
cmp esi, eax
jae 0x10028b64
mov esi, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
sub esi, ebx
add esi, dword [ebp - 0x10c]
add eax, dword [edi + 0x14]
cmp esi, eax
jb 0x10028b78
mov esi, dword [ebp - 0x10c]
inc edx
cmp dx, word [ebp - 0x110]
jae 0x10028b76
mov ebx, dword [ebp - 0x114]
jmp 0x10028b30
xor esi, esi
mov eax, dword [ebp - 0x118]
pop edi
pop ebx
add eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
push str.File_is_not_PE_n
push dword [0x100ee8a4]
call fcn.1000f610
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop esi
call fcn.100313c7
mov esp, ebp
pop ebp
ret