Function at 0x48aed0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f73b8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x5470b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov edi, dword [ebx + 0x18]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov esi, eax
or eax, ecx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ecx
jne 0x48af5d
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.AddFile:_adding_0_bytes_file
push eax
call fcn.00475230
add esp, 8
call fcn.0048ac20
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx + 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [ebx + 0xc]
mov dword [eax + 4], edx
xor edx, edx
lea ecx, [ecx]
cmp edx, dword [ebp - 0x34]
jg 0x48af80
jl 0x48af7b
cmp edi, esi
jae 0x48af80
mov dword [ebp - 0x1c], edi
jmp 0x48af83
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
add eax, 0x2000
mov dword [ebp - 0x10], eax
mov edi, edi
push 0
mov dword [ebp - 0x14], eax
xor ecx, ecx
add eax, dword [ebx + 8]
lea edx, [ebp - 0x4c]
adc ecx, dword [ebx + 0xc]
push edx
push eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebx]
push eax
mov dword [ebp - 0x4c], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [ebx]
push 0
push 0
push 0
push 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x48b322
cmp dword [0x54d1b0], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x2c], eax
jne 0x48aff8
push 0x54d194
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x54d1b0]
push 0
push ecx
push esi
push edi
call fcn.004dfa00
mov ecx, edi
sub ecx, eax
sbb esi, edx
mov edx, dword [ebp - 0x2c]
sub edi, ecx
lea eax, [edi + edx]
push eax
push ecx
mov ecx, dword [ebp - 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 6
push ecx
call esi
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x48b033
add edi, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], 0
je 0x48b35c
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0xc]
push edi
push edx
push eax
push 4
push ecx
call esi
mov esi, eax
test esi, esi
je 0x48b3ba
mov ecx, dword [ebx + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0xc]
push edi
push eax
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x20]
push eax
push esi
call edx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call esi
mov eax, dword [ebp - 0x2c]
push eax
call esi
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jb 0x48b2d0
push ecx
mov edi, esp
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x30], edi
call fcn.004c31da
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x48b3ce
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov ecx, str._AddFile:_returned_chunk_bigger_than_the_original_
mov dword [ebp - 4], 0
test ecx, 0xffff0000
jne 0x48b1c2
mov edx, ecx
movzx esi, dx
push esi
call fcn.004cb124
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x48b2b5
mov ecx, esi
shr ecx, 4
inc ecx
movzx edx, cx
push 6
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48b2b5
push esi
push eax
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004226f9
mov edx, eax
add esp, 0xc
mov dword [ebp - 0x2c], edx
test edx, edx
je 0x48b2b5
mov eax, dword [edi]
movzx esi, word [edx]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x48b14e
push esi
mov ecx, edi
call fcn.00422524
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edi]
movzx eax, word [edx]
mov dword [ebp - 0x18], ecx
lea ecx, [edx + 2]
mov dword [ebp - 0x2c], ecx
cmp eax, 0xffffffff
jne 0x48b16e
push ecx
call fcn.004d1e6a
mov ecx, dword [ebp - 0x2c]
add esp, 4
inc eax
add eax, eax
push eax
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [esi + esi]
push edx
push ecx
mov dword [ebp - 0x2c], edx
call fcn.004d18eb
add esp, 0x10
cmp eax, 0x50
ja case.0x48b195.1
movzx edx, byte [eax + 0x48b3fc]
jmp dword [edx*4 + 0x48b3ec]
test esi, esi
jl 0x48b3e2
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x48b3e2
mov edx, dword [ebp - 0x2c]
mov dword [eax - 0xc], esi
mov eax, dword [edi]
xor ecx, ecx
mov word [edx + eax], cx
jmp 0x48b2b5
push str._AddFile:_returned_chunk_bigger_than_the_original_
call fcn.004d1e6a
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x48b22f
mov ecx, dword [edi]
mov esi, dword [ecx - 0x10]
cmp dword [ecx - 0xc], ebx
lea eax, [ecx - 0x10]
je 0x48b2b2
cmp dword [eax + 0xc], ebx
lea edx, [eax + 0xc]
jge 0x48b206
cmp dword [ecx - 8], ebx
jl 0x48b3e2
mov dword [ecx - 0xc], ebx
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
jmp 0x48b2b2
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48b21c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [edi], eax
jmp 0x48b2b2
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x2c], ecx
mov esi, str._AddFile:_returned_chunk_bigger_than_the_original_
sub esi, eax
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
sar esi, 1
or eax, ecx
jge 0x48b259
push ebx
mov ecx, edi
call fcn.00422524
mov eax, dword [edi]
cmp esi, dword [ebp - 0x2c]
ja 0x48b27c
mov edx, dword [eax - 8]
lea ecx, [ebx + ebx]
push ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + esi*2]
push ecx
add edx, edx
push edx
push eax
call fcn.004d19b9
mov esi, dword [ebp - 0x2c]
jmp 0x48b291
mov ecx, dword [eax - 8]
lea esi, [ebx + ebx]
push esi
push str._AddFile:_returned_chunk_bigger_than_the_original_
add ecx, ecx
push ecx
push eax
call fcn.004d18eb
add esp, 0x10
test ebx, ebx
jl 0x48b3e2
mov eax, dword [edi]
cmp ebx, dword [eax - 8]
jg 0x48b3e2
mov dword [eax - 0xc], ebx
mov edx, dword [edi]
xor eax, eax
mov word [esi + edx], ax
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.0048ac20
add dword [ebp - 0x10], 0x100000
mov eax, dword [ebp - 0x10]
jmp 0x48af90
xor ecx, ecx
add dword [ebx + 8], eax
adc dword [ebx + 0xc], ecx
xor edx, edx
cmp dword [ebp - 0x34], edx
jl 0x48b2f4
jg 0x48b2e9
mov esi, dword [ebp - 0x38]
cmp esi, dword [ebp - 0x24]
jbe 0x48b2f4
mov esi, dword [ebp - 0x24]
sub dword [ebp - 0x38], esi
sbb dword [ebp - 0x34], edx
jmp 0x48b2fc
xor esi, esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
add dword [ebp - 0x40], edi
adc dword [ebp - 0x3c], 0
add dword [ebp - 0x48], eax
adc dword [ebp - 0x44], ecx
cmp dword [ebp - 0x34], 0
jl 0x48b38d
jg 0x48b317
cmp dword [ebp - 0x38], 0
jbe 0x48b38d
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x24]
jmp 0x48af70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x14]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push edx
push str.AddFile:_error_extending_VFC_file_by__d_bytes__LE_d
push ecx
call fcn.00475230
add esp, 0x10
call fcn.0048ac20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push str._AddFile:_Dest_mapping_failed__LE_d
push ecx
call fcn.00475230
add esp, 0xc
call fcn.0048ac20
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
mov ecx, dword [ebx + 8]
mov eax, dword [ebp + 0x10]
sub ecx, dword [eax]
mov edx, dword [ebx + 0xc]
sbb edx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push str._AddFile:_Src_mapping_failed__LE_d
jmp 0x48b36e
push 0x80004005
call fcn.00422000
call fcn.004c3742
call fcn.004c377a
push 0x80070057
call fcn.00422000
pushfd
mov cl, 72
add al, bl
mov bl, 0x48
add ch, bl
mov bl, 0x48
add ch, bl
mov bl, 0x48
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3