Function at 0x4846b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
cmp ebx, 0x200
jb 0x484950
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x484854
mov ecx, dword [esi + 0x3c]
cmp ecx, 0x1000
jae 0x484854
lea eax, [ecx + 0x200]
cmp eax, ebx
ja 0x484854
test cl, 7
jne 0x484854
add ecx, esi
cmp dword [ecx], 0x4550
jne 0x484854
movzx edi, word [ecx + 4]
cmp edi, 0x200
ja 0x484765
je 0x48475e
lea eax, [edi - 0x14c]
cmp eax, 0x78
ja case.0x484749.333
movzx eax, byte [eax + 0x484b10]
jmp dword [eax*4 + 0x484b00]
mov edx, 0x3030501
jmp 0x4847a0
mov edx, 0x3030701
jmp 0x4847a0
mov edx, 0x3030401
jmp 0x4847a0
cmp edi, 0x8664
ja 0x48478f
je case.0x484749.332
mov eax, edi
sub eax, 0x5032
je 0x484781
sub eax, 0x32
jne case.0x484749.333
mov edx, 0xb
jmp 0x4847a0
mov edx, 0x3030103
jmp 0x4847a0
cmp edi, 0xaa64
jne case.0x484749.333
mov edx, 0xa
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
mov dword [ebp - 8], eax
cmp eax, 0x400
ja 0x48484e
movzx eax, word [ecx + 0x18]
add ecx, 0x18
mov dword [ebp - 0xc], 0x10b
cmp ax, word [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
je 0x4847de
mov eax, 0x20b
cmp word [ebp - 0x10], ax
mov eax, dword [ebp - 8]
jne 0x48484e
sub eax, esi
add eax, ecx
cmp eax, dword [ebp - 4]
ja 0x48483d
add ecx, dword [ebp - 8]
cmp ebx, 0x40
ja 0x48483d
cmp edi, 0x8664
jne 0x48483d
xor edi, edi
test ebx, ebx
je 0x48483d
mov eax, ecx
sub eax, esi
mov esi, dword [ebp - 4]
add eax, 0x28
cmp eax, esi
ja 0x48483d
cmp dword [ecx], 0x3436612e
jne 0x48481c
cmp dword [ecx + 4], 0x6d7278
je 0x484838
inc edi
add ecx, 0x28
add eax, 0x28
cmp edi, ebx
jb 0x484807
mov edi, dword [ebp + 8]
mov eax, 1
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0xa
mov edi, dword [ebp + 8]
mov eax, 1
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
mov edi, dword [ebp + 8]
cmp byte [esi + 6], 1
jne 0x484948
cmp dword [esi], 0x464c457f
jne case.0x4848c3.4
movzx eax, byte [esi + 4]
sub eax, 1
je 0x48487c
sub eax, 1
jne case.0x4848c3.4
movzx eax, byte [esi + 5]
sub eax, 1
je 0x4848a5
sub eax, 1
jne case.0x4848c3.4
movzx ecx, byte [esi + 0x13]
lea edx, [eax + 1]
movzx eax, byte [esi + 0x12]
shl ax, 8
or cx, ax
movzx eax, cx
jmp 0x4848ab
movzx eax, word [esi + 0x12]
xor edx, edx
movzx eax, ax
add eax, 0xfffffffe
cmp eax, 0xf1
ja case.0x4848c3.4
movzx eax, byte [eax + 0x484ba8]
jmp dword [eax*4 + 0x484b8c]
mov edx, 0x3030103
mov eax, 1
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x3030805
mov eax, 1
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je case.0x4848c3.4
mov edx, 0x3030205
mov eax, 1
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jne case.0x4848c3.4
mov edx, 0x3030501
mov eax, 1
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jne case.0x4848c3.4
mov edx, 0xa
mov dword [edi], edx
pop edi
pop esi
lea eax, [edx - 9]
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jne case.0x4848c3.4
mov edx, 0xb
mov dword [edi], edx
pop edi
pop esi
lea eax, [edx - 0xa]
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x200
jae case.0x4848c3.4
cmp ebx, 0x2c
jae 0x484a42
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
cmp eax, 0xfeedface
ja 0x48498b
je 0x484996
cmp eax, 0xcefaedfe
je 0x48497f
cmp eax, 0xcffaedfe
jne 0x484a42
mov eax, dword [esi + 4]
mov ecx, 1
bswap eax
jmp 0x48499b
cmp eax, 0xfeedfacf
jne 0x484a42
mov eax, dword [esi + 4]
xor ecx, ecx
cmp eax, 0x12
ja 0x4849fe
je 0x484a0f
sub eax, 7
je 0x484a2d
sub eax, 5
je 0x4849d2
sub eax, 2
jne 0x484a42
test ecx, ecx
je 0x484a42
mov eax, dword [esi + 0x10]
mov edx, 0x3030805
mov ecx, dword [esi + 0x14]
bswap eax
bswap ecx
jmp 0x4849e1
test ecx, ecx
jne 0x484a42
mov edx, 0x3030501
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp ecx, 0x1000000
ja 0x484a42
cmp eax, 0x40000
ja 0x484a42
mov dword [edi], edx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, 0x1000007
je 0x484a2d
sub eax, 5
je 0x484a24
sub eax, 6
jne 0x484a42
test ecx, ecx
je 0x484a42
mov eax, dword [esi + 0x10]
mov edx, 0x3030205
mov ecx, dword [esi + 0x14]
bswap eax
bswap ecx
jmp 0x4849e1
test ecx, ecx
jne 0x484a42
lea edx, [ecx + 0xa]
jmp 0x4849db
mov eax, dword [esi + 0x10]
mov edx, 0x3030103
test ecx, ecx
je 0x4849de
mov ecx, dword [esi + 0x14]
bswap eax
bswap ecx
jmp 0x4849e1
cmp dword [esi], 0x46464952
jne 0x484959
cmp dword [esi + 8], 0x45564157
jne 0x484959
cmp dword [esi + 0xc], 0x20746d66
jne 0x484959
mov ecx, dword [esi + 0x10]
lea eax, [ecx - 0x10]
cmp eax, 2
ja 0x484959
cmp word [esi + 0x14], 1
jne 0x484959
movzx eax, word [esi + 0x22]
test al, 7
jne 0x484959
movzx edi, word [esi + 0x16]
shr eax, 3
imul edi, eax
test edi, edi
je 0x484959
cmp edi, 0x100
ja 0x484959
add ecx, 0x14
xor edx, edx
lea eax, [ecx + 8]
cmp eax, ebx
ja 0x484959
cmp dword [ecx + esi], 0x61746164
je 0x484ae8
mov eax, dword [ecx + esi + 4]
cmp eax, 0x10000
ja 0x484959
add ecx, 8
inc edx
add ecx, eax
cmp edx, 0xa
jl 0x484ab1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], 3
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret