Function at 0x49efe9
Capabilities:
Read file via mapping

Disassembly:
push 0x5c
mov eax, 0x5091b8
call fcn.00498132
xor ebx, ebx
mov esi, 0x490
mov eax, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x11], al
mov byte [ebp - 0x12], al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersion]
mov edi, dword [ebp + 8]
movzx ecx, ax
mov eax, ebx
mov dword [ebp - 0x20], eax
test edi, edi
jne 0x49f033
push 0x57
pop esi
jmp 0x49f5ad
mov eax, 0x105
cmp cx, ax
je 0x49f0e7
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x49f5ad
push ebx
push ebx
push ebx
push 0x52534d42
call eax
mov dword [ebp - 0x34], eax
test eax, eax
je 0x49f5ad
add eax, 0x400
push eax
mov dword [ebp + 8], eax
call fcn.004ad1f4
mov dword [ebp - 0x2c], eax
pop ecx
test eax, eax
jne 0x49f092
push 8
jmp 0x49f02d
push dword [ebp + 8]
push ebx
push eax
call fcn.004a1820
add esp, 0xc
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
push ebx
push 0x52534d42
call dword [ebp - 0x28]
test eax, eax
je 0x49f5ad
mov ecx, dword [ebp - 0x2c]
mov al, byte [ecx + 1]
mov dl, byte [ecx + 2]
mov byte [ebp - 0x11], al
mov byte [ebp - 0x12], dl
cmp al, 2
jae 0x49f0d3
mov esi, 0x718
jmp 0x49f5ad
mov eax, dword [ecx + 4]
lea esi, [ecx + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], ebx
jmp 0x49f2fe
push 0x2c
pop eax
push 0x2e
mov word [ebp - 0x50], ax
pop eax
push str.NtOpenSection
push str.ntdll.dll
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x4e], ax
mov dword [ebp - 0x4c], str.DevicePhysicalMemory
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x49f2dd
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x68], 0x18
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x68]
push ecx
push 4
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x64], ebx
push ecx
mov dword [ebp - 0x5c], 0x40
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
call eax
test eax, eax
js 0x49f2dd
push 0x10000
push 0xf0000
push ebx
push 4
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x49f2dd
mov esi, ecx
mov eax, ebx
mov dword [ebp + 8], esi
mov edx, 0x10000
cmp dword [esi], 0x5f4d535f
je 0x49f196
add esi, 0x10
add eax, 0x10
mov dword [ebp + 8], esi
cmp eax, edx
jb 0x49f181
mov eax, esi
sub eax, ecx
cmp eax, edx
je 0x49f2d8
mov al, byte [esi + 5]
cmp al, 0x1f
ja 0x49f2d8
cmp al, 0x1e
je 0x49f1b9
cmp al, 0x1f
jne 0x49f2d8
movzx eax, al
sub eax, ecx
add eax, esi
cmp eax, edx
ja 0x49f2d8
cmp word [esi + 0x16], bx
je 0x49f2d8
push 5
lea eax, [esi + 0x10]
push eax
push str._DMI_
call fcn.004a2039
add esp, 0xc
test eax, eax
jne 0x49f2d8
mov al, byte [esi + 6]
mov cl, byte [esi + 7]
mov byte [ebp - 0x11], al
mov byte [ebp - 0x12], cl
cmp al, 2
jb 0x49f2d8
mov eax, dword [ebp + 8]
push dword [ebp - 0x20]
mov esi, dword [esi + 0x18]
movzx eax, word [eax + 0x16]
mov dword [ebp + 8], eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
mov eax, dword [ebp + 8]
mov ecx, esi
and ecx, 0xfff
add eax, 0xfff
add eax, ecx
mov dword [ebp - 0x34], ecx
and eax, 0xfffff000
sub esi, ecx
push eax
push esi
push ebx
push 4
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x49f2d8
mov esi, dword [ebp + 8]
lea eax, [esi + 0x400]
push eax
call fcn.004ad1f4
pop ecx
mov ecx, eax
mov dword [ebp - 0x30], ecx
test ecx, ecx
jne 0x49f26d
push 8
pop esi
mov dword [ebp - 0x28], esi
jmp 0x49f2dd
lea eax, [esi + 0x400]
push eax
push ebx
push ecx
call fcn.004a1820
mov eax, dword [ebp - 0x34]
push esi
mov esi, dword [ebp - 0x20]
add eax, esi
push eax
push dword [ebp - 0x30]
call fcn.004a0d20
mov eax, dword [ebp - 0x30]
add esp, 0x18
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
mov dword [ebp - 0x20], ebx
mov esi, ebx
jmp 0x49f268
mov esi, 0x490
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0
je 0x49f2f0
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
jne 0x49f59f
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push 1
lea ecx, [ebp + 8]
push ecx
push 1
push eax
push esi
call fcn.0049fad3
add esp, 0x14
test eax, eax
jne 0x49f34c
mov ecx, dword [ebp + 8]
lea eax, [edi + 4]
push eax
movzx eax, byte [ecx + 7]
push eax
push ecx
call fcn.0049f5d0
add esp, 0xc
cmp byte [ebp - 0x11], 2
ja 0x49f337
jne 0x49f34c
cmp byte [ebp - 0x12], 1
jb 0x49f34c
mov eax, dword [ebp + 8]
add eax, 8
push 0x10
push eax
lea eax, [edi + 8]
push eax
call fcn.004a0d20
add esp, 0xc
push 1
lea eax, [ebp + 8]
push eax
push 2
push dword [ebp - 0x1c]
push esi
call fcn.0049fad3
add esp, 0x14
test eax, eax
jne 0x49f38b
mov esi, dword [ebp + 8]
lea eax, [edi + 0x18]
push eax
movzx eax, byte [esi + 7]
push eax
push esi
call fcn.0049f5d0
lea eax, [edi + 0x1c]
push eax
movzx eax, byte [esi + 8]
push eax
push esi
call fcn.0049f5d0
mov esi, dword [ebp - 0x18]
add esp, 0x18
push 1
lea eax, [ebp + 8]
push eax
push 3
push dword [ebp - 0x1c]
push esi
call fcn.0049fad3
add esp, 0x14
test eax, eax
jne 0x49f3ca
mov esi, dword [ebp + 8]
lea eax, [edi + 0x20]
push eax
movzx eax, byte [esi + 7]
push eax
push esi
call fcn.0049f5d0
lea eax, [edi + 0x24]
push eax
movzx eax, byte [esi + 8]
push eax
push esi
call fcn.0049f5d0
mov esi, dword [ebp - 0x18]
add esp, 0x18
push 1
lea eax, [ebp + 8]
push eax
push 4
push dword [ebp - 0x1c]
push esi
call fcn.0049fad3
add esp, 0x14
test eax, eax
jne 0x49f423
cmp byte [ebp - 0x11], 2
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
ja 0x49f3ff
jne 0x49f420
cmp byte [ebp - 0x12], 3
jb 0x49f420
lea eax, [edi + 0x30]
push eax
movzx eax, byte [esi + 0x20]
push eax
push esi
call fcn.0049f5d0
lea eax, [edi + 0x34]
push eax
movzx eax, byte [esi + 0x21]
push eax
push esi
call fcn.0049f5d0
add esp, 0x18
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0x34], 1
lea ecx, [ebp + 8]
call fcn.0049d8cb
push dword [ebp - 0x34]
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 2
push eax
push 0x11
push dword [ebp - 0x1c]
push esi
call fcn.0049fad3
add esp, 0x14
test eax, eax
jne 0x49f4f1
cmp byte [ebp - 0x11], 2
ja 0x49f461
jne 0x49f4d6
cmp byte [ebp - 0x12], 3
jb 0x49f4d6
mov esi, dword [ebp - 0x48]
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x1a]
push eax
push esi
call fcn.0049f5d0
add esp, 0xc
test eax, eax
jne 0x49f489
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x38]
push dword [eax - 0xc]
push eax
call fcn.0049ddfb
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x18]
push eax
push esi
call fcn.0049f5d0
add esp, 0xc
test eax, eax
jne 0x49f4ae
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x3c]
push dword [eax - 0xc]
push eax
call fcn.0049ddfb
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x19]
push eax
push esi
call fcn.0049f5d0
add esp, 0xc
test eax, eax
jne 0x49f4d3
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x40]
push dword [eax - 0xc]
push eax
call fcn.0049ddfb
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.0049fa63
add byte [ebp - 0x34], 1
jne 0x49f427
jmp 0x49f500
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.0049fa63
mov al, byte [ebp - 0x11]
cmp al, 2
ja 0x49f514
jne 0x49f59c
mov al, byte [ebp - 0x12]
cmp al, 1
jb 0x49f54d
push 1
lea eax, [ebp + 8]
push eax
push 0x16
push dword [ebp - 0x1c]
push esi
call fcn.0049fad3
add esp, 0x14
test eax, eax
jne 0x49f541
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x44]
push eax
movzx eax, byte [ecx + 7]
push eax
push ecx
call fcn.0049f5d0
add esp, 0xc
mov al, byte [ebp - 0x11]
cmp al, 2
ja 0x49f551
jne 0x49f59c
mov al, byte [ebp - 0x12]
cmp al, 3
jb 0x49f59c
push 1
lea eax, [ebp + 8]
push eax
push 0x27
push dword [ebp - 0x1c]
push esi
call fcn.0049fad3
add esp, 0x14
test eax, eax
jne 0x49f59c
mov esi, dword [ebp + 8]
lea eax, [edi + 0x48]
push eax
movzx eax, byte [esi + 0xa]
push eax
push esi
call fcn.0049f5d0
lea eax, [edi + 0x4c]
push eax
movzx eax, byte [esi + 8]
push eax
push esi
call fcn.0049f5d0
lea eax, [edi + 0x50]
push eax
movzx eax, byte [esi + 9]
push eax
push esi
call fcn.0049f5d0
add esp, 0x24
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x49f5ad
push eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
push ebx
call fcn.004ad1d7
push dword [ebp - 0x2c]
call fcn.004ad1d7
push dword [ebp - 0x30]
call fcn.004ad1d7
add esp, 0xc
mov dword [edi], esi
mov eax, esi
call fcn.00498097
ret