Function at 0x459fb0
Capabilities:
Enumerate pe sections
Get common file path
Read file via mapping

Disassembly:
mov eax, 0x1018
call fcn.00422b10
push ebx
push ebp
push esi
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push 0x1000
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [esp + 0x102c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xor ebp, ebp
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push ebp
push 0x80
mov ecx, ebx
push 3
push ebp
and ecx, 3
push 1
lea eax, [esp + 0x3c]
push closesocket
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x45a1d5
push ebp
push ebp
push ebp
push 2
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebp
push ebp
push ebp
push 4
push eax
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebp
mov dword [esp + 0x18], eax
je 0x45a1d5
mov ecx, dword [eax + 0x3c]
xor esi, esi
add ecx, eax
mov dword [esp + 0x10], ebp
mov edx, dword [ecx + 0x34]
mov si, word [ecx + 0x14]
mov dword [esp + 0x1c], edx
xor edx, edx
mov dx, word [ecx + 6]
lea edi, [esi + ecx + 0x18]
cmp edx, 1
jb 0x45a1d5
mov dword [esp + 0x14], edx
mov esi, str.PAGE
mov ecx, edi
mov dl, byte [ecx]
mov bl, dl
cmp dl, byte [esi]
jne 0x45a0be
test bl, bl
je 0x45a0ba
mov dl, byte [ecx + 1]
mov bl, dl
cmp dl, byte [esi + 1]
jne 0x45a0be
add ecx, 2
add esi, 2
test bl, bl
jne 0x45a09a
xor ecx, ecx
jmp 0x45a0c3
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x45a0cb
mov ebp, edi
jmp 0x45a103
mov esi, str..text
mov ecx, edi
mov dl, byte [ecx]
mov bl, dl
cmp dl, byte [esi]
jne 0x45a0f6
test bl, bl
je 0x45a0f2
mov dl, byte [ecx + 1]
mov bl, dl
cmp dl, byte [esi + 1]
jne 0x45a0f6
add ecx, 2
add esi, 2
test bl, bl
jne 0x45a0d2
xor ecx, ecx
jmp 0x45a0fb
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x45a103
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x14]
add edi, 0x28
dec ecx
mov dword [esp + 0x14], ecx
jne 0x45a093
test ebp, ebp
je 0x45a1d5
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x45a1d5
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor esi, esi
add ecx, eax
lea edi, [edx - 0x14]
xor ebx, ebx
test edi, edi
jbe 0x45a1ab
mov al, 0xf
mov dl, byte [ecx]
cmp dl, 0x3b
je 0x45a146
cmp dl, 0x39
jne 0x45a1a1
cmp byte [ecx + 2], al
jne 0x45a1a1
cmp byte [ecx + 3], 0x84
jne 0x45a1a1
mov dl, byte [ecx + 8]
cmp dl, 0x3b
je 0x45a15e
cmp dl, 0x39
jne 0x45a1a1
cmp byte [ecx + 0xa], al
jne 0x45a1a1
cmp byte [ecx + 0xb], 0x85
jne 0x45a1a1
cmp byte [ecx + 0x10], 0x68
jne 0x45a1a1
mov dl, byte [ecx + 0x15]
cmp dl, 0x50
jbe 0x45a1a1
cmp dl, 0x60
jae 0x45a1a1
cmp byte [ecx + 0x16], 0xe8
jne 0x45a1a1
mov esi, dword [ecx + 0x11]
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
sub esi, edx
mov edx, dword [ebp + 0xc]
cmp esi, edx
jb 0x45a19f
mov ebp, dword [ebp + 8]
add ebp, edx
cmp esi, ebp
jb 0x45a1a7
xor esi, esi
inc ebx
inc ecx
cmp ebx, edi
jb 0x45a13a
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x20]
push ecx
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1018
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1018
ret 4