Function at 0x489fe4
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x48a01b
xor eax, eax
jmp 0x48a273
lea edx, [ebp - 4]
push 0
push edx
lea ecx, [ebp - 0x54]
push 0x40
push ecx
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x48a091
cmp dword [ebp - 4], 0x40
jne 0x48a091
movzx edi, word [ebp - 0x54]
cmp edi, 0x5a4d
jne 0x48a091
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
push esi
call sub.kernel32.dll_SetFilePointer
cmp eax, dword [ebp - 0x18]
jne 0x48a091
lea edx, [ebp - 4]
push 0
push edx
lea ecx, [ebp - 0x14c]
push 0xf8
push ecx
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x48a091
cmp dword [ebp - 4], 0xf8
jne 0x48a091
cmp dword [ebp - 0x14c], 0x4550
jne 0x48a091
cmp word [ebp - 0x146], 0
jne 0x48a09e
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
jmp 0x48a273
mov edx, dword [ebp - 0xc4]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 8], edx
cmp dword [ebp - 0xc], 0
jne 0x48a0c3
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
jmp 0x48a273
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 4], eax
push 4
push 0x1000
mov edx, dword [ebp - 4]
push edx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
jne 0x48a0f3
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
jmp 0x48a273
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp - 4]
push ecx
push ebx
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x48a12e
push 0x8000
push 0
push ebx
call sub.kernel32.dll_VirtualFree_1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
jmp 0x48a273
push esi
call sub.kernel32.dll_CloseHandle
mov esi, ebx
add esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
push eax
push esi
push ebx
call fcn.00489f84
add esp, 0xc
mov edx, eax
add edx, ebx
lea eax, [edx + 0x10]
movzx edi, word [edx + 0xe]
movzx ecx, word [edx + 0xc]
add edi, ecx
jmp 0x48a252
test byte [eax + 3], 0x80
jne 0x48a24f
movzx ecx, word [eax]
cmp ecx, 0xa
jne 0x48a24f
mov eax, dword [eax + 4]
and eax, 0x7fffffff
add eax, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
movzx edi, word [edi + 0xc]
movzx ecx, word [ecx + 0xe]
add eax, 0x10
add ecx, edi
jmp 0x48a240
movzx edi, word [eax]
cmp edi, 0x360
jne 0x48a23d
test byte [eax + 7], 0x80
je 0x48a1c6
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov ecx, edx
add eax, ecx
add eax, 0x10
mov edi, dword [eax + 4]
add edi, ecx
jmp 0x48a1cb
mov edi, dword [eax + 4]
add edi, edx
xor eax, eax
mov dword [esi + 0x58], eax
xor edx, edx
mov dword [esi + 0x98], edx
xor ecx, ecx
mov dword [esi + 0x9c], ecx
mov dword [ebp - 0x164], 0x18
mov dword [ebp - 0x160], ebx
mov ecx, dword [ebp - 0xc]
push ecx
push esi
push ebx
call fcn.00489f84
add esp, 0xc
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x158], eax
mov edx, dword [edi + 4]
mov dword [ebp - 0x150], edx
mov ecx, dword [edi]
push ecx
push esi
push ebx
call fcn.00489f84
add esp, 0xc
add eax, ebx
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x164]
push eax
call fcn.0048a27c
pop ecx
mov dword [ebp - 0x10], eax
jmp 0x48a25f
add eax, 8
mov edi, ecx
add ecx, 0xffffffff
test edi, edi
jne 0x48a19b
jmp 0x48a25f
add eax, 8
mov ecx, edi
add edi, 0xffffffff
test ecx, ecx
jne 0x48a15d
test ebx, ebx
je 0x48a270
push 0x8000
push 0
push ebx
call sub.kernel32.dll_VirtualFree_1
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret