Function at 0x428984
Capabilities:
Check if file exists
Enumerate pe sections
Get file attributes
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x428ba4
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
test eax, eax
je 0x4289b3
cmp dword [eax + 0xa8], 0
jne 0x428b57
lea eax, [ebp - 0x14]
push eax
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x4c]
mov ecx, 0x7fffffff
mov eax, 0x428bbc
call fcn.0041a0c0
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c]
mov ecx, 0x7fffffff
call fcn.0040411c
mov edx, 0x428bc8
mov eax, dword [ebp - 0x14]
call fcn.00419fe8
test al, al
jne 0x428a5e
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c]
call fcn.00403f18
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403f18
pop ecx
sub ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c]
mov edx, 1
call fcn.0040411c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x428bc8
call fcn.00403f64
mov eax, dword [ebp - 0x10]
call fcn.004040dc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x428a6f
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x4c]
call fcn.00403d34
jmp 0x428a6f
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x4c]
call fcn.00403d34
mov eax, dword [ebp - 0x10]
call fcn.004040dc
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x428b7b
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x428b7b
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
je 0x428b4f
push 0
push 0
push 0
push 4
push edi
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x428b49
mov eax, dword [ebp - 0xc]
call fcn.0041c608
test eax, eax
je 0x428b34
mov edx, eax
add edx, 0xf8
mov dword [ebp - 8], edx
movzx edx, word [eax + 6]
dec edx
shl edx, 3
lea edx, [edx + edx*4]
add dword [ebp - 8], edx
mov edx, dword [ebp - 8]
cmp dword [edx + 0x14], 0
je 0x428b40
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
cmp edx, dword [eax + 0xa8]
jne 0x428b40
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x14]
mov eax, dword [ebp - 0xc]
add ecx, eax
mov edx, ecx
push ebp
mov edx, dword [edx + 0x18]
add edx, eax
mov eax, edx
call fcn.00428890
pop ecx
mov ebx, eax
jmp 0x428b40
push ebp
mov eax, dword [ebp - 0xc]
call fcn.00428890
pop ecx
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push edi
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x428b7b
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 4]
mov ecx, dword [ecx + 0x38]
mov esi, ecx
add esi, dword [eax + 0xa8]
mov edx, esi
push ebp
mov eax, dword [ebp + 8]
mov eax, ecx
add eax, dword [edx + 0x14]
call fcn.00428890
pop ecx
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428bab
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403cc0
lea eax, [ebp - 4]
mov edx, dword [0x427d98]
call fcn.00405888
ret