Function at 0x4f7fa0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x24
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], 0
test esi, esi
je 0x4f81af
movzx edx, byte [esi]
push edx
call fcn.005e3ae6
add esp, 4
cmp eax, 0x4d
jne 0x4f81c6
movzx eax, byte [esi + 1]
push eax
call fcn.005e3ae6
add esp, 4
cmp eax, 0x5a
jne 0x4f81c6
cmp byte [esi + 4], 0
mov ebx, dword [esi + 0x3c]
jne 0x4f8020
cmp byte [esi + 5], 0
je 0x4f8056
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], 1
test eax, eax
je 0x4f8036
mov dword [eax], 1
test edi, edi
je 0x4f804b
cmp byte [edi], 0
jne 0x4f804b
push 0x62577c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [esp + 0x14], 0
je 0x4f81af
xor eax, eax
mov byte [esp + 0x28], 0
mov dword [esp + 0x29], eax
mov byte [esp + 0x2d], al
mov dword [esp + 0x18], eax
push eax
cmp ebp, eax
je 0x4f8089
push ebx
push ebp
call fcn.005e0626
push ebp
push 6
lea ecx, [esp + 0x3c]
push 1
push ecx
call fcn.005e057f
add esp, 0x1c
jmp 0x4f80b4
push 0
push ebx
mov ebx, dword [esp + 0x30]
push ebx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x24]
push edx
push 6
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [esp + 0x28]
mov cl, byte [esp + 0x2c]
mov dl, byte [esp + 0x2d]
push eax
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], dl
call fcn.005e3ae6
add esp, 4
cmp eax, 0x50
jne 0x4f8133
movzx ecx, byte [esp + 0x29]
push ecx
call fcn.005e3ae6
add esp, 4
cmp eax, 0x45
jne 0x4f8133
cmp byte [esp + 0x2a], 0
jne 0x4f8133
cmp byte [esp + 0x2b], 0
jne 0x4f8133
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4f8106
mov dword [eax], 1
test edi, edi
je 0x4f811b
cmp byte [edi], 0
jne 0x4f811b
push 0x62577c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], 1
test eax, eax
je 0x4f8137
mov dword [eax], 1
jmp 0x4f8137
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp ecx, 0x14c
je 0x4f8155
cmp ecx, 0x8664
je 0x4f8155
test eax, eax
je 0x4f8155
mov dword [eax], 0
cmp dword [esp + 0x10], 0
jne 0x4f81af
cmp dword [esp + 0x48], 0
je 0x4f81af
cmp byte [esi], 0x30
jne 0x4f81af
cmp byte [esi + 1], 0x26
jne 0x4f81af
cmp byte [esi + 2], 0xb2
jne 0x4f81af
cmp byte [esi + 3], 0x75
jne 0x4f81af
cmp byte [esi + 4], 0x8e
jne 0x4f81af
cmp byte [esi + 5], 0x66
jne 0x4f81af
cmp byte [esi + 6], 0xcf
jne 0x4f81af
cmp byte [esi + 7], 0x11
jne 0x4f81af
test edi, edi
je 0x4f81a7
cmp byte [edi], 0
jne 0x4f81a7
push 0x649d38
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 0xa
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x24
ret
mov al, byte [esi]
cmp al, 0xd7
jne 0x4f81fb
cmp byte [esi + 1], 0xcd
jne 0x4f81fb
test ebx, ebx
je 0x4f81dc
mov dword [ebx], 1
test edi, edi
je 0x4f81f1
cmp byte [edi], 0
jne 0x4f81f1
push 0x649d34
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 2
jmp 0x4f81af
cmp al, 0x50
jne 0x4f8224
cmp byte [esi + 1], 0x4b
jne 0x4f8224
test edi, edi
je 0x4f821a
cmp byte [edi], 0
jne 0x4f821a
push 0x62f418
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 3
jmp 0x4f81af
push esi
call fcn.004da1b0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4f827e
push 5
push str.begin
push ebp
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4f827e
mov al, byte [ebp + 5]
cmp al, 0x20
je 0x4f8252
cmp al, 9
jne 0x4f827e
test ebx, ebx
je 0x4f825c
mov dword [ebx], 1
test edi, edi
je 0x4f8271
cmp byte [edi], 0
jne 0x4f8271
push str.UUENCODED
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 4
jmp 0x4f81af
push str.Standard_Jet_DB
lea ebp, [esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.Standard_Jet_DB
push ebp
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4f82c0
test edi, edi
je 0x4f82b3
cmp byte [edi], al
jne 0x4f82b3
push str.JETDB
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 5
jmp 0x4f81af
cmp byte [esi], 0x52
jne 0x4f832c
mov al, byte [esi + 1]
cmp al, 0x61
jne 0x4f82fa
cmp byte [esi + 2], 0x72
jne 0x4f82fa
cmp byte [esi + 3], 0x21
jne 0x4f82fa
test edi, edi
je 0x4f82ed
cmp byte [edi], 0
jne 0x4f82ed
push 0x63ad98
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 6
jmp 0x4f81af
cmp al, 0x49
jne 0x4f832c
cmp byte [esi + 2], 0x46
jne 0x4f832c
cmp byte [esi + 3], 0x46
jne 0x4f832c
test edi, edi
je 0x4f831f
cmp byte [edi], 0
jne 0x4f831f
push str.RIFF
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 7
jmp 0x4f81af
push 0
push str.wscript
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4f836d
test ebx, ebx
je 0x4f834b
mov dword [ebx], 1
test edi, edi
je 0x4f8360
cmp byte [edi], 0
jne 0x4f8360
push str.WSCRIPT
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 9
jmp 0x4f81af
cmp byte [esi], 0x58
jne 0x4f83b0
cmp byte [esi + 1], 0x35
jne 0x4f83b0
cmp byte [esi + 2], 0x4f
jne 0x4f83b0
cmp byte [esi + 3], 0x21
jne 0x4f83b0
test ebx, ebx
je 0x4f838e
mov dword [ebx], 1
test edi, edi
je 0x4f83a3
cmp byte [edi], 0
jne 0x4f83a3
push str.EICAR
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 0xb
jmp 0x4f81af
push 0
push str.autorun
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4f83f1
test ebx, ebx
je 0x4f83cf
mov dword [ebx], 1
test edi, edi
je 0x4f83e4
cmp byte [edi], 0
jne 0x4f83e4
push 0x63f824
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 0xd
jmp 0x4f81af
mov al, byte [esi]
cmp al, 0x4d
jne 0x4f842b
cmp byte [esi + 1], 0x53
jne 0x4f842b
cmp byte [esi + 2], 0x43
jne 0x4f842b
cmp byte [esi + 3], 0x46
jne 0x4f842b
test edi, edi
je 0x4f841e
cmp byte [edi], 0
jne 0x4f841e
push 0x63b0d8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 0xe
jmp 0x4f81af
cmp al, 0x7b
jne 0x4f815c
lea edx, [esi + 1]
push 0x6410f8
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4f815c
test edi, edi
je 0x4f8460
cmp byte [edi], al
jne 0x4f8460
push 0x62f42c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 0xf
jmp 0x4f81af