Function at 0x4a56b4
Capabilities:
Copy file
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404678
mov eax, dword [ebp - 0xc]
call fcn.00404678
lea esi, [ebp - 0x17c]
xor eax, eax
push ebp
push 0x4a5a79
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00404688
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4a5744
push 0x10
push 0x4a5a8c
push 0x4a5a94
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4a5a4e
xor edx, edx
push ebp
push 0x4a5a47
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
lea eax, [ebp - 0x18]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile
cmp word [ebp - 0x5c], 0x5a4d
je 0x4a578e
push 0x10
push 0x4a5a8c
push 0x4a5aa4
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00403c10
jmp 0x4a5a4e
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x18]
push eax
push 0xf8
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile
cmp dword [ebp - 0x154], 0x4550
je 0x4a57e5
push 0x10
push 0x4a5a8c
push 0x4a5aa4
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00403c10
jmp 0x4a5a4e
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], eax
movzx ebx, word [ebp - 0x14e]
dec ebx
test ebx, ebx
jl 0x4a5866
inc ebx
push 0
lea eax, [ebp - 0x18]
push eax
push 0x28
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0x180]
mov edx, esi
call fcn.004043a4
mov eax, dword [ebp - 0x180]
mov edx, 0x4a5acc
call fcn.004045d4
jne 0x4a5849
push 0x40
push 0x4a5a8c
push 0x4a5ad4
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00403c10
jmp 0x4a5a4e
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x10]
cmp edi, eax
jae 0x4a5855
mov edi, eax
mov eax, dword [esi + 0xc]
add eax, dword [esi + 8]
cmp eax, dword [ebp - 0x14]
jbe 0x4a5863
mov dword [ebp - 0x14], eax
dec ebx
jne 0x4a57f9
cmp byte [ebp + 8], 0
je 0x4a589b
push 0
lea eax, [ebp - 0x184]
mov ecx, 0x4a5afc
mov edx, dword [ebp - 8]
call fcn.004044d4
mov eax, dword [ebp - 0x184]
call fcn.00404688
push eax
mov eax, dword [ebp - 8]
call fcn.00404688
push eax
call sub.kernel32.dll_CopyFileA
mov ebx, 0x4a56b0
sub ebx, fcn.004a4ed0
add ebx, 0x50f
mov edx, esi
mov ecx, 5
mov eax, 0x4a5b0c
call fcn.00402910
mov dword [esi + 8], ebx
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
xor eax, eax
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], 0
mov eax, dword [esi + 0xc]
mov edx, eax
and edx, 0xfff
test edx, edx
jbe 0x4a58f5
shr eax, 0xc
inc eax
shl eax, 0xc
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
mov edx, eax
and edx, 0x1ff
test edx, edx
jbe 0x4a590e
shr eax, 9
inc eax
shl eax, 9
mov dword [esi + 0x14], eax
mov dword [esi + 0x24], 0xe00000e0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x28
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0x12c]
mov dword [0x4c01d7], eax
mov eax, dword [ebp - 0x120]
mov dword [0x4c01d3], eax
mov eax, dword [esi + 0xc]
add eax, 0x50f
add eax, 0x4a4edc
sub eax, fcn.004a4ed0
mov dword [ebp - 0x12c], eax
add dword [ebp - 0x104], ebx
mov eax, dword [ebp - 0xc]
call fcn.00404488
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404688
push eax
call fcn.004a5634
mov dword [0x4c0052], eax
inc word [ebp - 0x14e]
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xf8
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
push 0
push 0
mov eax, dword [esi + 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x50f
push 0x4bfccc
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x4a56b0
sub eax, fcn.004a4ed0
push eax
mov eax, fcn.004a4ed0
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
push 0x40
push 0x4a5a8c
push 0x4a5b1c
push dword [ebp - 8]
push 0x4a5afc
lea eax, [ebp - 0x188]
mov edx, 3
call fcn.00404548
mov eax, dword [ebp - 0x188]
call fcn.00404688
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5a4e
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5a80
lea eax, [ebp - 0x188]
mov edx, 3
call fcn.004041d0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004041d0
ret