Function at 0x48c6b0
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
mov byte [ebp - 9], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
cmp edi, 0x40
jl 0x48c995
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x5a4d
jne 0x48c995
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x3c]
mov edx, eax
add edx, 0xf8
cmp edi, edx
jl 0x48c995
mov ebx, eax
add ebx, dword [ebp - 0x10]
cmp dword [ebx], 0x4550
jne 0x48c995
movzx eax, word [ebx + 0x16]
test ah, 0x20
jne 0x48c995
test al, 2
je 0x48c995
movzx eax, word [ebx + 0x14]
cmp eax, 0xe0
jne 0x48c995
mov eax, ebx
add eax, 0xf8
mov dword [ebp - 0x14], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
push eax
mov ecx, ebx
mov edx, edi
mov eax, dword [ebp - 0x10]
call fcn.0048c5c4
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x48c995
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x48c995
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x18], eax
movzx edi, word [ebx + 6]
dec edi
test edi, edi
jl 0x48c7fe
inc edi
xor ebx, ebx
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + eax*8 + 0x14]
test eax, eax
je 0x48c7fa
cmp eax, dword [ebp - 0x18]
jae 0x48c7fa
mov dword [ebp - 0x18], eax
inc ebx
dec edi
jne 0x48c7e4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.004035b8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add eax, dword [edx + 0x3c]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 0xf8
mov dword [esi], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [eax + 0x38]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
call fcn.0048c5b0
mov edx, dword [ebp + 0xc]
add eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
movzx edi, word [eax + 6]
dec edi
test edi, edi
jl 0x48c943
inc edi
xor ebx, ebx
lea eax, [ebx + ebx*4]
mov edx, dword [esi]
mov eax, dword [edx + eax*8 + 0xc]
test eax, eax
je 0x48c8a6
mov edx, dword [ebp + 0xc]
add eax, dword [edx]
mov dword [ebp - 0x1c], eax
lea eax, [ebx + ebx*4]
mov edx, dword [esi]
cmp dword [edx + eax*8 + 0x10], 0
je 0x48c91f
lea eax, [ebx + ebx*4]
mov edx, dword [esi]
mov ecx, dword [edx + eax*8 + 0x10]
lea eax, [ebx + ebx*4]
mov edx, dword [esi]
mov eax, dword [edx + eax*8 + 0x14]
add eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.004035b8
lea eax, [ebx + ebx*4]
mov edx, dword [esi]
mov eax, dword [edx + eax*8 + 8]
lea edx, [ebx + ebx*4]
mov ecx, dword [esi]
cmp eax, dword [ecx + edx*8 + 0x10]
jae 0x48c901
lea eax, [ebx + ebx*4]
mov edx, dword [esi]
mov eax, dword [edx + eax*8 + 0x10]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov edx, dword [edx + 0x38]
call fcn.0048c5b0
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x48c93b
lea eax, [ebx + ebx*4]
mov edx, dword [esi]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov edx, dword [edx + 0x38]
call fcn.0048c5b0
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x48c93b
lea eax, [ebx + ebx*4]
mov edx, dword [esi]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov edx, dword [edx + 0x38]
call fcn.0048c5b0
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
inc ebx
dec edi
jne 0x48c891
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp - 9], 1
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc