Function at 0x48e8f0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ef878
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x53f100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov edi, dword [ebx + 0x18]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov esi, eax
or eax, ecx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ecx
jne 0x48e97d
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.AddFile:_adding_0_bytes_file
push eax
call fcn.00478610
add esp, 8
call fcn.0048e640
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx + 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [ebx + 0xc]
mov dword [eax + 4], edx
xor edx, edx
lea ecx, [ecx]
cmp edx, dword [ebp - 0x34]
jg 0x48e9a0
jl 0x48e99b
cmp edi, esi
jae 0x48e9a0
mov dword [ebp - 0x1c], edi
jmp 0x48e9a3
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
add eax, 0x2000
mov dword [ebp - 0x10], eax
mov edi, edi
push 0
mov dword [ebp - 0x14], eax
xor ecx, ecx
add eax, dword [ebx + 8]
lea edx, [ebp - 0x4c]
adc ecx, dword [ebx + 0xc]
push edx
push eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebx]
push eax
mov dword [ebp - 0x4c], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [ebx]
push 0
push 0
push 0
push 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x48ed42
cmp dword [0x544f54], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x2c], eax
jne 0x48ea18
push 0x544f38
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x544f54]
push 0
push ecx
push esi
push edi
call fcn.004da160
mov ecx, edi
sub ecx, eax
sbb esi, edx
mov edx, dword [ebp - 0x2c]
sub edi, ecx
lea eax, [edi + edx]
push eax
push ecx
mov ecx, dword [ebp - 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 6
push ecx
call esi
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x48ea53
add edi, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], 0
je 0x48ed7c
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0xc]
push edi
push edx
push eax
push 4
push ecx
call esi
mov esi, eax
test esi, esi
je 0x48edda
mov ecx, dword [ebx + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0xc]
push edi
push eax
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x20]
push eax
push esi
call edx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call esi
mov eax, dword [ebp - 0x2c]
push eax
call esi
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jb 0x48ecf0
push ecx
mov edi, esp
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x30], edi
call fcn.004bcd4c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x48edee
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov ecx, str._AddFile:_returned_chunk_bigger_than_the_original_
mov dword [ebp - 4], 0
test ecx, 0xffff0000
jne 0x48ebe2
mov edx, ecx
movzx esi, dx
push esi
call fcn.004c4eeb
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x48ecd5
mov ecx, esi
shr ecx, 4
inc ecx
movzx edx, cx
push 6
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48ecd5
push esi
push eax
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004226d5
mov edx, eax
add esp, 0xc
mov dword [ebp - 0x2c], edx
test edx, edx
je 0x48ecd5
mov eax, dword [edi]
movzx esi, word [edx]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x48eb6e
push esi
mov ecx, edi
call fcn.004224ff
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edi]
movzx eax, word [edx]
mov dword [ebp - 0x18], ecx
lea ecx, [edx + 2]
mov dword [ebp - 0x2c], ecx
cmp eax, 0xffffffff
jne 0x48eb8e
push ecx
call fcn.004cbe7a
mov ecx, dword [ebp - 0x2c]
add esp, 4
inc eax
add eax, eax
push eax
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [esi + esi]
push edx
push ecx
mov dword [ebp - 0x2c], edx
call fcn.004cb905
add esp, 0x10
cmp eax, 0x50
ja case.0x48ebb5.1
movzx edx, byte [eax + 0x48ee1c]
jmp dword [edx*4 + 0x48ee0c]
test esi, esi
jl 0x48ee02
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x48ee02
mov edx, dword [ebp - 0x2c]
mov dword [eax - 0xc], esi
mov eax, dword [edi]
xor ecx, ecx
mov word [edx + eax], cx
jmp 0x48ecd5
push str._AddFile:_returned_chunk_bigger_than_the_original_
call fcn.004cbe7a
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x48ec4f
mov ecx, dword [edi]
mov esi, dword [ecx - 0x10]
cmp dword [ecx - 0xc], ebx
lea eax, [ecx - 0x10]
je 0x48ecd2
cmp dword [eax + 0xc], ebx
lea edx, [eax + 0xc]
jge 0x48ec26
cmp dword [ecx - 8], ebx
jl 0x48ee02
mov dword [ecx - 0xc], ebx
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
jmp 0x48ecd2
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48ec3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [edi], eax
jmp 0x48ecd2
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x2c], ecx
mov esi, str._AddFile:_returned_chunk_bigger_than_the_original_
sub esi, eax
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
sar esi, 1
or eax, ecx
jge 0x48ec79
push ebx
mov ecx, edi
call fcn.004224ff
mov eax, dword [edi]
cmp esi, dword [ebp - 0x2c]
ja 0x48ec9c
mov edx, dword [eax - 8]
lea ecx, [ebx + ebx]
push ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + esi*2]
push ecx
add edx, edx
push edx
push eax
call fcn.004cb9d3
mov esi, dword [ebp - 0x2c]
jmp 0x48ecb1
mov ecx, dword [eax - 8]
lea esi, [ebx + ebx]
push esi
push str._AddFile:_returned_chunk_bigger_than_the_original_
add ecx, ecx
push ecx
push eax
call fcn.004cb905
add esp, 0x10
test ebx, ebx
jl 0x48ee02
mov eax, dword [edi]
cmp ebx, dword [eax - 8]
jg 0x48ee02
mov dword [eax - 0xc], ebx
mov edx, dword [edi]
xor eax, eax
mov word [esi + edx], ax
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.0048e640
add dword [ebp - 0x10], 0x100000
mov eax, dword [ebp - 0x10]
jmp 0x48e9b0
xor ecx, ecx
add dword [ebx + 8], eax
adc dword [ebx + 0xc], ecx
xor edx, edx
cmp dword [ebp - 0x34], edx
jl 0x48ed14
jg 0x48ed09
mov esi, dword [ebp - 0x38]
cmp esi, dword [ebp - 0x24]
jbe 0x48ed14
mov esi, dword [ebp - 0x24]
sub dword [ebp - 0x38], esi
sbb dword [ebp - 0x34], edx
jmp 0x48ed1c
xor esi, esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
add dword [ebp - 0x40], edi
adc dword [ebp - 0x3c], 0
add dword [ebp - 0x48], eax
adc dword [ebp - 0x44], ecx
cmp dword [ebp - 0x34], 0
jl 0x48edad
jg 0x48ed37
cmp dword [ebp - 0x38], 0
jbe 0x48edad
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x24]
jmp 0x48e990
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x14]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push edx
push str.AddFile:_error_extending_VFC_file_by__d_bytes__LE_d
push ecx
call fcn.00478610
add esp, 0x10
call fcn.0048e640
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push str._AddFile:_Dest_mapping_failed__LE_d
push ecx
call fcn.00478610
add esp, 0xc
call fcn.0048e640
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
mov ecx, dword [ebx + 8]
mov eax, dword [ebp + 0x10]
sub ecx, dword [eax]
mov edx, dword [ebx + 0xc]
sbb edx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push str._AddFile:_Src_mapping_failed__LE_d
jmp 0x48ed8e
push 0x80004005
call fcn.00422000
call fcn.004bd2b4
call fcn.004bd2ec
push 0x80070057
call fcn.00422000
mov esp, 0xf80048eb
in eax, dx
dec eax
add ch, bh
in eax, dx
dec eax
add ch, bh
in eax, dx
dec eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3