Function at 0x40552e
Capabilities:
Read file via mapping

Disassembly:
push 0x64
mov eax, 0x464f03
call fcn.00463b8b
mov edi, ecx
mov dword [ebp - 0x30], edi
mov esi, 0x490
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x3c], esi
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x11], al
mov byte [ebp - 0x13], al
mov byte [ebp - 0x12], al
mov byte [ebp - 0x14], al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
mov dword [ebp - 0x28], ebx
test edi, edi
jne 0x405584
push 0x57
pop esi
jmp 0x405af0
mov ecx, 0x105
cmp ax, cx
je 0x405638
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x405af0
push ebx
push ebx
push ebx
push 0x52534d42
call eax
mov dword [ebp - 0x24], eax
test eax, eax
je 0x405af0
add eax, 0x400
mov dword [ebp - 0x38], eax
push eax
call fcn.00445d23
pop ecx
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x4055e3
push 8
jmp 0x40557e
push dword [ebp - 0x38]
push ebx
push eax
call fcn.00441660
add esp, 0xc
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
push ebx
push 0x52534d42
call dword [ebp - 0x20]
test eax, eax
je 0x405af0
mov ecx, dword [ebp - 0x2c]
mov al, byte [ecx + 1]
mov byte [ebp - 0x11], al
mov dl, byte [ecx + 2]
mov byte [ebp - 0x12], dl
cmp al, 2
jae 0x405624
mov esi, 0x718
jmp 0x405af0
lea esi, [ecx + 8]
mov dword [ebp - 0x18], esi
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], ebx
jmp 0x405859
mov dword [ebp - 0x20], ebx
push 0x2c
pop eax
mov word [ebp - 0x58], ax
push 0x2e
pop eax
mov word [ebp - 0x56], ax
mov dword [ebp - 0x54], str.DevicePhysicalMemory
mov dword [ebp - 4], ebx
push str.NtOpenSection
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405804
mov dword [ebp - 0x70], 0x18
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], 0x40
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
lea ecx, [ebp - 0x70]
push ecx
push 4
lea ecx, [ebp - 0x20]
push ecx
call eax
test eax, eax
js 0x405804
push 0x10000
push 0xf0000
push ebx
push 4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x405804
mov esi, ecx
mov edx, 0x10000
mov dword [ebp - 0x48], esi
mov eax, esi
sub eax, ecx
cmp eax, edx
jae 0x4056e7
cmp dword [esi], 0x5f4d535f
je 0x4056e5
add esi, 0x10
jmp 0x4056cd
cmp eax, edx
je 0x4057ff
mov al, byte [esi + 5]
cmp al, 0x1f
ja 0x4057ff
cmp al, 0x1e
je 0x405704
cmp al, 0x1f
jne 0x4057ff
movzx eax, al
sub eax, ecx
add eax, esi
cmp eax, edx
ja 0x4057ff
movzx eax, word [esi + 0x16]
mov dword [ebp - 0x38], eax
test ax, ax
je 0x4057ff
mov eax, 0x494d445f
cmp eax, dword [esi + 0x10]
jne 0x4057ff
push 0x5f
pop eax
cmp al, byte [esi + 0x14]
jne 0x4057ff
mov al, byte [esi + 6]
mov byte [ebp - 0x11], al
mov byte [ebp - 0x13], al
mov dl, byte [esi + 7]
mov byte [ebp - 0x12], dl
mov byte [ebp - 0x14], dl
cmp al, 2
jb 0x4057ff
mov esi, dword [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, esi
and ecx, 0xfff
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x38]
movzx eax, dx
add eax, 0xfff
add eax, ecx
and eax, 0xfffff000
push eax
sub esi, ecx
push esi
push ebx
push 4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4057ff
mov eax, dword [ebp - 0x38]
movzx esi, ax
lea eax, [esi + 0x400]
mov dword [ebp - 0x24], eax
push eax
call fcn.00445d23
pop ecx
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x4057bd
push 8
pop esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x3c], esi
jmp 0x405804
push dword [ebp - 0x24]
push ebx
push eax
call fcn.00441660
push esi
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
add eax, esi
push eax
push dword [ebp - 0x34]
call fcn.004422a0
add esp, 0x18
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x38]
movzx eax, dx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x28], ebx
mov esi, ebx
jmp 0x4057b5
mov esi, 0x490
or dword [ebp - 4], 0xffffffff
jmp 0x40583c
cmp dword [ebp - 0x20], 0
je 0x40584b
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x405ae2
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push 1
lea ecx, [ebp - 0x38]
push ecx
push 1
mov edx, eax
mov ecx, esi
call fcn.004054cf
add esp, 0xc
test eax, eax
jne 0x4058a2
lea eax, [edi + 4]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 7]
mov ecx, eax
call fcn.00405467
pop ecx
mov al, byte [ebp - 0x11]
cmp al, 2
ja 0x405892
jne 0x4058a2
cmp byte [ebp - 0x12], 1
jb 0x4058a2
mov esi, dword [ebp - 0x38]
add esi, 8
add edi, 8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
push 1
lea eax, [ebp - 0x50]
push eax
push 2
mov edx, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004054cf
add esp, 0xc
mov edi, dword [ebp - 0x30]
test eax, eax
jne 0x4058e2
lea eax, [edi + 0x18]
push eax
mov esi, dword [ebp - 0x50]
mov dl, byte [esi + 7]
mov ecx, esi
call fcn.00405467
lea eax, [edi + 0x1c]
push eax
mov dl, byte [esi + 8]
mov ecx, esi
call fcn.00405467
pop ecx
pop ecx
mov esi, dword [ebp - 0x18]
push 1
lea eax, [ebp - 0x50]
push eax
push 3
mov edx, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004054cf
add esp, 0xc
test eax, eax
jne 0x40591f
lea eax, [edi + 0x20]
push eax
mov esi, dword [ebp - 0x50]
mov dl, byte [esi + 7]
mov ecx, esi
call fcn.00405467
lea eax, [edi + 0x24]
push eax
mov dl, byte [esi + 8]
mov ecx, esi
call fcn.00405467
pop ecx
pop ecx
mov esi, dword [ebp - 0x18]
push 1
lea eax, [ebp - 0x50]
push eax
push 4
mov edx, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004054cf
add esp, 0xc
test eax, eax
jne 0x405977
mov esi, dword [ebp - 0x50]
mov eax, dword [esi + 8]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x2c], eax
mov al, byte [ebp - 0x11]
cmp al, 2
ja 0x405956
jne 0x405974
cmp byte [ebp - 0x12], 3
jb 0x405974
lea eax, [edi + 0x30]
push eax
mov dl, byte [esi + 0x20]
mov ecx, esi
call fcn.00405467
lea eax, [edi + 0x34]
push eax
mov dl, byte [esi + 0x21]
mov ecx, esi
call fcn.00405467
pop ecx
pop ecx
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0x38], 1
call fcn.004068d0
push eax
lea ecx, [ebp - 0x20]
call fcn.00405f99
mov dword [ebp - 4], 3
push dword [ebp - 0x38]
lea eax, [ebp - 0x50]
push eax
push 0x11
mov edx, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004054cf
add esp, 0xc
test eax, eax
jne 0x405a3b
mov al, byte [ebp - 0x11]
cmp al, 2
ja 0x4059bd
jne 0x405a20
cmp byte [ebp - 0x12], 3
jb 0x405a20
lea eax, [ebp - 0x20]
push eax
mov esi, dword [ebp - 0x50]
mov dl, byte [esi + 0x1a]
mov ecx, esi
call fcn.00405467
pop ecx
test eax, eax
jne 0x4059df
lea ecx, [edi + 0x38]
lea eax, [ebp - 0x20]
push eax
call fcn.004060da
lea eax, [ebp - 0x20]
push eax
mov dl, byte [esi + 0x18]
mov ecx, esi
call fcn.00405467
pop ecx
test eax, eax
jne 0x4059fe
lea ecx, [edi + 0x3c]
lea eax, [ebp - 0x20]
push eax
call fcn.004060da
lea eax, [ebp - 0x20]
push eax
mov dl, byte [esi + 0x19]
mov ecx, esi
call fcn.00405467
pop ecx
test eax, eax
jne 0x405a1d
lea ecx, [edi + 0x40]
lea eax, [ebp - 0x20]
push eax
call fcn.004060da
mov esi, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 0x10]
call fcn.00406985
add byte [ebp - 0x38], 1
jne 0x40597b
jmp 0x405a4a
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 0x10]
call fcn.00406985
mov al, byte [ebp - 0x11]
cmp al, 2
ja 0x405a5a
jne 0x405a88
mov al, byte [ebp - 0x12]
cmp al, 1
jb 0x405a8f
push 1
lea eax, [ebp - 0x50]
push eax
push 0x16
mov edx, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004054cf
add esp, 0xc
test eax, eax
jne 0x405a83
lea eax, [edi + 0x44]
push eax
mov ecx, dword [ebp - 0x50]
mov dl, byte [ecx + 7]
call fcn.00405467
pop ecx
mov al, byte [ebp - 0x11]
cmp al, 2
ja 0x405a93
jne 0x405adc
mov al, byte [ebp - 0x12]
cmp al, 3
jb 0x405adc
push 1
lea eax, [ebp - 0x50]
push eax
push 0x27
mov edx, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004054cf
add esp, 0xc
test eax, eax
jne 0x405adc
lea eax, [edi + 0x48]
push eax
mov esi, dword [ebp - 0x50]
mov dl, byte [esi + 0xa]
mov ecx, esi
call fcn.00405467
lea eax, [edi + 0x4c]
push eax
mov dl, byte [esi + 8]
mov ecx, esi
call fcn.00405467
lea eax, [edi + 0x50]
push eax
mov dl, byte [esi + 9]
mov ecx, esi
call fcn.00405467
add esp, 0xc
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x405af0
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call fcn.00445d2e
push dword [ebp - 0x2c]
call fcn.00445d2e
push dword [ebp - 0x34]
call fcn.00445d2e
add esp, 0xc
mov dword [edi], esi
mov eax, esi
call fcn.00463ae9
ret