Function at 0x4a381a
Capabilities:
Read file via mapping

Disassembly:
push 0x5c
mov eax, 0x50e9db
call fcn.0049cac9
xor ebx, ebx
mov esi, 0x490
mov eax, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x11], al
mov byte [ebp - 0x12], al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersion]
mov edi, dword [ebp + 8]
movzx ecx, ax
mov eax, ebx
mov dword [ebp - 0x20], eax
test edi, edi
jne 0x4a3864
push 0x57
pop esi
jmp 0x4a3dde
mov eax, 0x105
cmp cx, ax
je 0x4a3918
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4a3dde
push ebx
push ebx
push ebx
push 0x52534d42
call eax
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4a3dde
add eax, 0x400
push eax
mov dword [ebp + 8], eax
call fcn.004b1a24
mov dword [ebp - 0x2c], eax
pop ecx
test eax, eax
jne 0x4a38c3
push 8
jmp 0x4a385e
push dword [ebp + 8]
push ebx
push eax
call fcn.004a6050
add esp, 0xc
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
push ebx
push 0x52534d42
call dword [ebp - 0x28]
test eax, eax
je 0x4a3dde
mov ecx, dword [ebp - 0x2c]
mov al, byte [ecx + 1]
mov dl, byte [ecx + 2]
mov byte [ebp - 0x11], al
mov byte [ebp - 0x12], dl
cmp al, 2
jae 0x4a3904
mov esi, 0x718
jmp 0x4a3dde
mov eax, dword [ecx + 4]
lea esi, [ecx + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], ebx
jmp 0x4a3b2f
push 0x2c
pop eax
push 0x2e
mov word [ebp - 0x50], ax
pop eax
push str.NtOpenSection
push str.ntdll.dll
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x4e], ax
mov dword [ebp - 0x4c], str.DevicePhysicalMemory
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x4a3b0e
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x68], 0x18
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x68]
push ecx
push 4
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x64], ebx
push ecx
mov dword [ebp - 0x5c], 0x40
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
call eax
test eax, eax
js 0x4a3b0e
push 0x10000
push 0xf0000
push ebx
push 4
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x4a3b0e
mov esi, ecx
mov eax, ebx
mov dword [ebp + 8], esi
mov edx, 0x10000
cmp dword [esi], 0x5f4d535f
je 0x4a39c7
add esi, 0x10
add eax, 0x10
mov dword [ebp + 8], esi
cmp eax, edx
jb 0x4a39b2
mov eax, esi
sub eax, ecx
cmp eax, edx
je 0x4a3b09
mov al, byte [esi + 5]
cmp al, 0x1f
ja 0x4a3b09
cmp al, 0x1e
je 0x4a39ea
cmp al, 0x1f
jne 0x4a3b09
movzx eax, al
sub eax, ecx
add eax, esi
cmp eax, edx
ja 0x4a3b09
cmp word [esi + 0x16], bx
je 0x4a3b09
push 5
lea eax, [esi + 0x10]
push eax
push str._DMI_
call fcn.004a6869
add esp, 0xc
test eax, eax
jne 0x4a3b09
mov al, byte [esi + 6]
mov cl, byte [esi + 7]
mov byte [ebp - 0x11], al
mov byte [ebp - 0x12], cl
cmp al, 2
jb 0x4a3b09
mov eax, dword [ebp + 8]
push dword [ebp - 0x20]
mov esi, dword [esi + 0x18]
movzx eax, word [eax + 0x16]
mov dword [ebp + 8], eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
mov eax, dword [ebp + 8]
mov ecx, esi
and ecx, 0xfff
add eax, 0xfff
add eax, ecx
mov dword [ebp - 0x34], ecx
and eax, 0xfffff000
sub esi, ecx
push eax
push esi
push ebx
push 4
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4a3b09
mov esi, dword [ebp + 8]
lea eax, [esi + 0x400]
push eax
call fcn.004b1a24
pop ecx
mov ecx, eax
mov dword [ebp - 0x30], ecx
test ecx, ecx
jne 0x4a3a9e
push 8
pop esi
mov dword [ebp - 0x28], esi
jmp 0x4a3b0e
lea eax, [esi + 0x400]
push eax
push ebx
push ecx
call fcn.004a6050
mov eax, dword [ebp - 0x34]
push esi
mov esi, dword [ebp - 0x20]
add eax, esi
push eax
push dword [ebp - 0x30]
call fcn.004a5550
mov eax, dword [ebp - 0x30]
add esp, 0x18
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
mov dword [ebp - 0x20], ebx
mov esi, ebx
jmp 0x4a3a99
mov esi, 0x490
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0
je 0x4a3b21
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
jne 0x4a3dd0
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push 1
lea ecx, [ebp + 8]
push ecx
push 1
push eax
push esi
call fcn.004a4304
add esp, 0x14
test eax, eax
jne 0x4a3b7d
mov ecx, dword [ebp + 8]
lea eax, [edi + 4]
push eax
movzx eax, byte [ecx + 7]
push eax
push ecx
call fcn.004a3e01
add esp, 0xc
cmp byte [ebp - 0x11], 2
ja 0x4a3b68
jne 0x4a3b7d
cmp byte [ebp - 0x12], 1
jb 0x4a3b7d
mov eax, dword [ebp + 8]
add eax, 8
push 0x10
push eax
lea eax, [edi + 8]
push eax
call fcn.004a5550
add esp, 0xc
push 1
lea eax, [ebp + 8]
push eax
push 2
push dword [ebp - 0x1c]
push esi
call fcn.004a4304
add esp, 0x14
test eax, eax
jne 0x4a3bbc
mov esi, dword [ebp + 8]
lea eax, [edi + 0x18]
push eax
movzx eax, byte [esi + 7]
push eax
push esi
call fcn.004a3e01
lea eax, [edi + 0x1c]
push eax
movzx eax, byte [esi + 8]
push eax
push esi
call fcn.004a3e01
mov esi, dword [ebp - 0x18]
add esp, 0x18
push 1
lea eax, [ebp + 8]
push eax
push 3
push dword [ebp - 0x1c]
push esi
call fcn.004a4304
add esp, 0x14
test eax, eax
jne 0x4a3bfb
mov esi, dword [ebp + 8]
lea eax, [edi + 0x20]
push eax
movzx eax, byte [esi + 7]
push eax
push esi
call fcn.004a3e01
lea eax, [edi + 0x24]
push eax
movzx eax, byte [esi + 8]
push eax
push esi
call fcn.004a3e01
mov esi, dword [ebp - 0x18]
add esp, 0x18
push 1
lea eax, [ebp + 8]
push eax
push 4
push dword [ebp - 0x1c]
push esi
call fcn.004a4304
add esp, 0x14
test eax, eax
jne 0x4a3c54
cmp byte [ebp - 0x11], 2
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
ja 0x4a3c30
jne 0x4a3c51
cmp byte [ebp - 0x12], 3
jb 0x4a3c51
lea eax, [edi + 0x30]
push eax
movzx eax, byte [esi + 0x20]
push eax
push esi
call fcn.004a3e01
lea eax, [edi + 0x34]
push eax
movzx eax, byte [esi + 0x21]
push eax
push esi
call fcn.004a3e01
add esp, 0x18
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0x34], 1
lea ecx, [ebp + 8]
call fcn.004a20fc
push dword [ebp - 0x34]
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 2
push eax
push 0x11
push dword [ebp - 0x1c]
push esi
call fcn.004a4304
add esp, 0x14
test eax, eax
jne 0x4a3d22
cmp byte [ebp - 0x11], 2
ja 0x4a3c92
jne 0x4a3d07
cmp byte [ebp - 0x12], 3
jb 0x4a3d07
mov esi, dword [ebp - 0x48]
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x1a]
push eax
push esi
call fcn.004a3e01
add esp, 0xc
test eax, eax
jne 0x4a3cba
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x38]
push dword [eax - 0xc]
push eax
call fcn.004a262c
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x18]
push eax
push esi
call fcn.004a3e01
add esp, 0xc
test eax, eax
jne 0x4a3cdf
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x3c]
push dword [eax - 0xc]
push eax
call fcn.004a262c
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x19]
push eax
push esi
call fcn.004a3e01
add esp, 0xc
test eax, eax
jne 0x4a3d04
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x40]
push dword [eax - 0xc]
push eax
call fcn.004a262c
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.004a4294
add byte [ebp - 0x34], 1
jne 0x4a3c58
jmp 0x4a3d31
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.004a4294
mov al, byte [ebp - 0x11]
cmp al, 2
ja 0x4a3d45
jne 0x4a3dcd
mov al, byte [ebp - 0x12]
cmp al, 1
jb 0x4a3d7e
push 1
lea eax, [ebp + 8]
push eax
push 0x16
push dword [ebp - 0x1c]
push esi
call fcn.004a4304
add esp, 0x14
test eax, eax
jne 0x4a3d72
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x44]
push eax
movzx eax, byte [ecx + 7]
push eax
push ecx
call fcn.004a3e01
add esp, 0xc
mov al, byte [ebp - 0x11]
cmp al, 2
ja 0x4a3d82
jne 0x4a3dcd
mov al, byte [ebp - 0x12]
cmp al, 3
jb 0x4a3dcd
push 1
lea eax, [ebp + 8]
push eax
push 0x27
push dword [ebp - 0x1c]
push esi
call fcn.004a4304
add esp, 0x14
test eax, eax
jne 0x4a3dcd
mov esi, dword [ebp + 8]
lea eax, [edi + 0x48]
push eax
movzx eax, byte [esi + 0xa]
push eax
push esi
call fcn.004a3e01
lea eax, [edi + 0x4c]
push eax
movzx eax, byte [esi + 8]
push eax
push esi
call fcn.004a3e01
lea eax, [edi + 0x50]
push eax
movzx eax, byte [esi + 9]
push eax
push esi
call fcn.004a3e01
add esp, 0x24
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4a3dde
push eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
push ebx
call fcn.004b1a07
push dword [ebp - 0x2c]
call fcn.004b1a07
push dword [ebp - 0x30]
call fcn.004b1a07
add esp, 0xc
mov dword [edi], esi
mov eax, esi
call fcn.0049ca2e
ret