Function at 0x10d5f00
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x41c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x10d61a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x44], 1
mov eax, dword [ebp - 4]
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov esi, eax
test esi, esi
jne 0x10d5f8d
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x41c]
call fcn.01013710
mov ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x418]
mov edx, 0x10d61bc
call fcn.0100703c
mov eax, dword [ebp - 0x418]
call fcn.0110b7bc
mov dword [ebx + 0x44], 6
jmp 0x10d6182
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push edi
push esi
call sub.KERNEL32.DLL_ReadProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x10d5fb9
mov dword [ebx + 0x44], 7
jmp 0x10d6182
cmp dword [ebp - 0xc], 0x5a4d
je 0x10d5fce
mov dword [ebx + 0x44], 4
jmp 0x10d6182
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 0x3c]
push eax
push esi
call sub.KERNEL32.DLL_ReadProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x10d5ff8
mov dword [ebx + 0x44], 7
jmp 0x10d6182
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
push esi
call sub.KERNEL32.DLL_ReadProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x10d6024
mov dword [ebx + 0x44], 7
jmp 0x10d6182
cmp dword [ebp - 0x10], 0x4550
je 0x10d6039
mov dword [ebx + 0x44], 5
jmp 0x10d6182
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
add eax, edi
add eax, 0x50
push eax
push esi
call sub.KERNEL32.DLL_ReadProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x10d6068
mov dword [ebx + 0x44], 7
jmp 0x10d6182
mov eax, dword [ebp - 0x10]
push eax
call fcn.010098c8
pop ecx
mov dword [ebx + 0x14], eax
cmp dword [ebx + 0x14], 0
jne 0x10d6087
mov dword [ebx + 0x44], 8
jmp 0x10d6182
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x14]
push eax
push edi
push esi
call sub.KERNEL32.DLL_ReadProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x10d60b3
mov eax, dword [ebp - 0x10]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.010d77e4
mov eax, ebx
call fcn.010d6fa8
xor eax, eax
mov dword [ebx + 0xc], eax
push 0x400
lea ecx, [ebp - 0x411]
mov edx, edi
mov eax, esi
call fcn.010d4454
lea eax, [ebx + 8]
lea edx, [ebp - 0x411]
mov ecx, 0x401
call fcn.01006d50
cmp dword [ebx + 8], 0
je 0x10d617f
push 0
push 0xa2
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebx + 8]
call fcn.01006bf4
push eax
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
mov dword [ebx + 0x10], esi
cmp esi, 0xffffffff
je 0x10d6182
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x10]
call fcn.010d3edc
mov dword [ebx + 0x4c], eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x10]
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov eax, dword [ebx + 0x24]
sub eax, dword [ebx + 0x14]
mov edx, dword [ebx + 0x20]
movzx edx, word [edx + 6]
add edx, edx
add edx, edx
add edx, edx
lea edx, [edx + edx*4]
add eax, edx
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebx + 0x10]
push eax
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [ebx + 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x18], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10d61a7
lea eax, [ebp - 0x41c]
mov edx, 2
call fcn.01006b60
ret