Function at 0x4c4c00
Capabilities:
Enumerate pe sections
Get common file path
Overwrite dll .text section to remove hooks
Read file via mapping

Disassembly:
mov eax, 0x1020
call fcn.00454250
push ebx
push ebp
push esi
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x30]
xor ebp, ebp
push 0x1000
push eax
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [esp + 0x1034]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Wow64DisableWow64FsRedirection
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push str.kernel32.dll
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
mov esi, eax
call edi
push eax
call ebx
test esi, esi
mov ebx, eax
je 0x4c4ca4
lea eax, [esp + 0x24]
push eax
call esi
mov ebp, eax
push 0
push 0x80
push 3
push 0
push 1
lea ecx, [esp + 0x44]
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test ebp, ebp
mov dword [esp + 0x28], esi
je 0x4c4cd6
test ebx, ebx
je 0x4c4cd6
mov edx, dword [esp + 0x24]
push edx
call ebx
cmp esi, 0xffffffff
jne 0x4c4cea
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1020
ret 4
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
push 4
push eax
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x18], eax
jne 0x4c4d25
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1020
ret 4
mov ecx, dword [eax + 0x3c]
xor ebp, ebp
add ecx, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], ecx
cmp word [ecx + 0x18], 0x10b
jne 0x4c4f1d
mov edx, dword [ecx + 0x34]
xor eax, eax
mov ax, word [ecx + 6]
mov dword [esp + 0x1c], edx
xor edx, edx
cmp eax, 1
mov dx, word [ecx + 0x14]
lea edi, [edx + ecx + 0x18]
jb 0x4c4d16
mov edx, eax
mov esi, str.PAGE
mov eax, edi
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4c4d89
test cl, cl
je 0x4c4d85
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4c4d89
add eax, 2
add esi, 2
test cl, cl
jne 0x4c4d65
xor eax, eax
jmp 0x4c4d8e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4c4d96
mov ebp, edi
jmp 0x4c4dce
mov esi, str..text
mov eax, edi
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4c4dc1
test cl, cl
je 0x4c4dbd
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4c4dc1
add eax, 2
add esi, 2
test cl, cl
jne 0x4c4d9d
xor eax, eax
jmp 0x4c4dc6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4c4dce
mov dword [esp + 0x20], edi
add edi, 0x28
dec edx
jne 0x4c4d5e
test ebp, ebp
je 0x4c4d16
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4c4d16
mov eax, dword [ebp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [ebp + 0x10]
add eax, edx
xor edx, edx
xor edi, edi
lea esi, [ecx - 0x14]
cmp esi, edx
jbe 0x4c4f19
mov cl, byte [eax]
cmp cl, 0x3b
je 0x4c4e0f
cmp cl, 0x39
jne 0x4c4e6e
cmp byte [eax + 2], 0xf
jne 0x4c4e6e
cmp byte [eax + 3], 0x84
jne 0x4c4e6e
mov cl, byte [eax + 8]
cmp cl, 0x3b
je 0x4c4e28
cmp cl, 0x39
jne 0x4c4e6e
cmp byte [eax + 0xa], 0xf
jne 0x4c4e6e
cmp byte [eax + 0xb], 0x85
jne 0x4c4e6e
cmp byte [eax + 0x10], 0x68
jne 0x4c4e6e
mov cl, byte [eax + 0x15]
cmp cl, 0x50
jbe 0x4c4e6e
cmp cl, 0x60
jae 0x4c4e6e
cmp byte [eax + 0x16], 0xe8
jne 0x4c4e6e
mov ebx, dword [eax + 0x11]
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
sub ebx, ecx
mov ecx, dword [ebp + 0xc]
cmp ebx, ecx
jb 0x4c4e6a
mov ebp, dword [ebp + 8]
add ebp, ecx
cmp ebx, ebp
jb 0x4c4e78
mov dword [esp + 0x10], edx
inc edi
inc eax
cmp edi, esi
jb 0x4c4e03
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp word [ecx + 0x18], 0x20b
jne 0x4c4f38
xor edi, edi
lea eax, [ecx + 0x108]
mov di, word [ecx + 6]
xor esi, esi
test edi, edi
mov dword [esp + 0x1c], eax
jbe 0x4c4ebf
mov ebp, eax
push str.PAGE
push ebp
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x4c4ebb
inc esi
add ebp, 0x28
cmp esi, edi
jb 0x4c4ea0
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
lea ecx, [esi + esi*4]
lea esi, [eax + ecx*8]
mov eax, dword [eax + ecx*8 + 0x14]
mov ecx, dword [esi + 0x10]
add eax, edi
add ecx, 0xffffffec
xor edi, edi
test ecx, ecx
jbe 0x4c4f38
cmp byte [eax], 0x48
jne 0x4c4f11
cmp byte [eax + 1], 0x3b
jne 0x4c4f11
mov dl, byte [eax + 2]
cmp dl, 0xc7
je 0x4c4ef3
cmp dl, 0xcf
jne 0x4c4f11
cmp byte [eax + 3], 0xf
jne 0x4c4f11
cmp byte [eax + 4], 0x85
jne 0x4c4f11
cmp byte [eax + 9], 0x48
jne 0x4c4f11
cmp byte [eax + 0xa], 0x8d
jne 0x4c4f11
cmp byte [eax + 0xb], 0x15
je 0x4c4f26
inc edi
inc eax
cmp edi, ecx
jb 0x4c4edb
jmp 0x4c4f38
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
jmp 0x4c4e7c
mov edx, dword [eax + 0xc]
mov eax, dword [esi + 0xc]
add edx, eax
lea eax, [edx + edi + 0x10]
mov dword [esp + 0x10], eax
mov ebx, eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x28]
push eax
call esi
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x1020
ret 4