Function at 0x481b50
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push 0x80
push 3
push 0
mov word [ebx], ax
mov eax, dword [ebp + 0xc]
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov dword [eax], 0
mov byte [ebp - 1], 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
je 0x481bb8
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x481bc1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 0x14], eax
test eax, eax
jne 0x481bf0
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x481df7
mov esi, dword [eax + 0x3c]
add esi, eax
mov eax, 0x100
test word [esi + 0x16], ax
je 0x481c28
movzx eax, word [esi + 4]
mov ecx, 0x8664
cmp ax, cx
je 0x481c28
mov ecx, 0x200
cmp ax, cx
mov al, 1
jne 0x481c2a
mov al, 2
mov ecx, dword [ebp + 0xc]
mov byte [edi], al
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov ax, word [esi + 0x5e]
or ax, 1
mov word [ebx], ax
test byte [esi + 0x16], 1
movzx ecx, ax
je 0x481c51
and ecx, 0xffbf
mov word [ebx], cx
cmp byte [edi], 2
jne 0x481cff
mov eax, dword [ebp + 0x14]
push 0x108
mov edi, dword [eax + 0x3c]
add edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x481df7
cmp dword [edi], 0x4550
jne 0x481df7
lea edx, [edi + 0x108]
movzx edi, word [edi + 6]
lea esi, [eax + 1]
cmp edi, esi
jb 0x481df7
cmp dword [edx + 0x10], 0
jne 0x481cf2
cmp dword [edx], 0x7865742e
jne 0x481cae
cmp dword [edx + 4], 0x73736274
je 0x481cf2
cmp dword [edx], 0x736c742e
jne 0x481cbc
cmp dword [edx + 4], 0
je 0x481cf2
cmp dword [edx], 0x7373622e
jne 0x481cca
cmp dword [edx + 4], 0
je 0x481cf2
cmp dword [edx], 0x625f7472
jne 0x481cdb
cmp dword [edx + 4], 0x7373
je 0x481cf2
mov eax, dword [edx + 0x24]
test al, 0xc0
setne cl
bt eax, 0x1d
setb al
test al, cl
jne 0x481df3
inc esi
add edx, 0x28
cmp esi, edi
jle 0x481c97
jmp 0x481df7
push 0xf8
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x481df7
cmp dword [esi], 0x4550
jne 0x481df7
lea eax, [esi + 0xf8]
mov edi, 1
movzx esi, word [esi + 6]
cmp esi, edi
jb 0x481df7
test byte [eax + 0x24], 0x20
je 0x481d56
mov ecx, dword [eax + 8]
cmp ecx, 0x1000
jbe 0x481d56
add ecx, 0xfffff000
cmp dword [eax + 0x10], ecx
jb 0x481df3
cmp dword [eax], 0x7865742e
jne 0x481d7a
cmp dword [eax + 4], 0x74
jne 0x481d7a
mov ecx, dword [eax + 8]
cmp ecx, 0x1000
jbe 0x481d7a
add ecx, 0xfffff000
cmp dword [eax + 0x10], ecx
jb 0x481df3
cmp byte [eax], 0
jne 0x481d87
mov ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 8]
jb 0x481df3
cmp dword [eax + 0x10], 0
jne 0x481de5
cmp dword [eax + 8], 0x1000
jb 0x481de5
cmp dword [eax], 0x7865742e
jne 0x481da7
cmp dword [eax + 4], 0x73736274
je 0x481de5
cmp dword [eax], 0x736c742e
jne 0x481db5
cmp dword [eax + 4], 0
je 0x481de5
cmp dword [eax], 0x7373622e
jne 0x481dc3
cmp dword [eax + 4], 0
je 0x481de5
cmp dword [eax], 0x7461642e
jne 0x481dd1
cmp dword [eax + 4], 0x61
je 0x481de5
mov ecx, dword [eax + 0x24]
test cl, 0xc0
setne dl
bt ecx, 0x1d
setb cl
test cl, dl
jne 0x481df3
inc edi
add eax, 0x28
cmp edi, esi
jle 0x481d36
jmp 0x481df7
mov byte [ebp - 1], 1
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret