Function at 0x489955
Capabilities:
Clear file content
Copy file
Delete file
Enumerate pe sections
Move file
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7a68
push 0x4a8984
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov byte [ebp - 0x11c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x134], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x489a80
push 0
push 0
push 3
push 0
push 1
push 0x12019f
mov eax, dword [ebp + 8]
push eax
call dword [0x54e144]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
jne 0x489a7e
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0048989e
add esp, 8
test eax, eax
je 0x489a50
push 1
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x489a50
push 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x489a55
jmp 0x489dcb
push 0
push 0
push 3
push 0
push 1
push 0x12019f
mov ecx, dword [ebp + 8]
push ecx
call dword [0x54b4dc]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], 1
jmp 0x489a9f
push 0
push 0
push 3
push 0
push 1
push 0x120089
mov edx, dword [ebp + 8]
push edx
call dword [0x54b4dc]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
jne 0x489ab7
mov dword [ebp - 0x134], 0
jmp 0x489dcb
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 2
add eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x489af8
mov dword [ebp - 0x134], 0
jmp 0x489dcb
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
neg edx
sbb edx, edx
and edx, 0xfffffffe
add edx, 4
push edx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x489b37
mov dword [ebp - 0x134], 0
jmp 0x489dcb
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x138], ecx
mov edx, dword [ebp - 0x138]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x5a4d
je 0x489b61
jmp 0x489da8
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x124]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
cmp dword [eax], 0x4550
jne 0x489b94
mov ecx, dword [ebp - 0x144]
xor edx, edx
mov dx, word [ecx + 6]
test edx, edx
jne 0x489b99
jmp 0x489da8
mov eax, dword [ebp - 0x144]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp - 0x144]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x144]
xor edx, edx
mov dx, word [ecx + 6]
sub edx, 1
imul edx, edx, 0x28
mov eax, dword [ebp - 0x140]
add eax, edx
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0x140]
mov eax, dword [ecx + 0x28]
cmp eax, dword [edx + 0xc]
jb 0x489c06
mov ecx, dword [ebp - 0x140]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x140]
add edx, dword [eax + 8]
mov ecx, dword [ebp - 0x144]
cmp dword [ecx + 0x28], edx
jbe 0x489c0b
jmp 0x489da8
mov edx, dword [ebp - 0x140]
cmp dword [edx + 8], 0x1000
jne 0x489c38
mov eax, dword [ebp - 0x140]
cmp dword [eax + 0x10], 0x1000
jne 0x489c38
mov ecx, dword [ebp - 0x140]
cmp dword [ecx + 0x24], 0xe0000020
je 0x489c3d
jmp 0x489da8
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x124]
add eax, dword [edx + 0x14]
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0x140]
mov eax, dword [ecx + 0x28]
sub eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x148]
add ecx, eax
mov dword [ebp - 0x150], ecx
push 0x10
push 0x542954
mov edx, dword [ebp - 0x150]
push edx
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
je 0x489c91
jmp 0x489da8
mov dword [ebp - 0x14c], 0
push 0x16
push 0x542964
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x148]
push edx
call fcn.00430a2f
add esp, 0x10
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x489ccf
jmp 0x489da8
mov eax, dword [ebp - 0x14c]
add eax, 0x16
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
xor edx, edx
mov dl, byte [ecx]
cmp edx, 0xe9
je 0x489cf5
jmp 0x489da8
cmp dword [ebp + 0xc], 0
je 0x489d94
mov eax, dword [ebp - 0x13c]
add eax, 5
sub eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x140]
add eax, dword [ecx + 0xc]
mov edx, dword [ebp - 0x13c]
add eax, dword [edx + 1]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x154]
mov dword [eax + 0x28], ecx
mov edx, dword [ebp - 0x144]
mov ax, word [edx + 6]
sub ax, 1
mov ecx, dword [ebp - 0x144]
mov word [ecx + 6], ax
mov edx, dword [ebp - 0x140]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x144]
mov edx, dword [ecx + 0x38]
push edx
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.00489ea2
add esp, 8
mov edx, dword [ebp - 0x144]
mov dword [edx + 0x50], eax
push 0x28
push 0
mov eax, dword [ebp - 0x140]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x134], 1
xor ecx, ecx
test ecx, ecx
jne 0x489b3e
mov dword [ebp - 4], 0xffffffff
jmp 0x489dc1
xor edx, edx
test edx, edx
jne 0x4899d9
cmp dword [ebp - 0x124], 0
je 0x489de1
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x128], 0
je 0x489df7
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x130], 0xffffffff
je 0x489e89
cmp dword [ebp + 0xc], 0
je 0x489e7c
cmp dword [ebp - 0x134], 1
jne 0x489e4f
cmp dword [ebp - 0x120], 0
je 0x489e4f
push 0
push 0
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x130]
push eax
call dword [0x54b4e4]
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x489e4f
mov dword [ebp - 0x134], 0
cmp dword [ebp - 0x134], 1
jne 0x489e7c
cmp dword [ebp - 0x12c], 0
je 0x489e7c
push 4
push 0
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x134], 0xfffffffe
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8