Function at 0x47c560
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f43fd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x80
mov eax, dword [0x54d104]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x68], eax
mov eax, 0x490
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x84], eax
xor edi, edi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x88], edi
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x8c], eax
xor al, al
mov byte [ebp - 0x51], al
mov byte [ebp - 0x61], al
mov byte [ebp - 0x52], al
mov byte [ebp - 0x62], al
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x80], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
mov dword [ebp - 0x7c], edi
cmp dword [ebp - 0x58], edi
jne 0x47c609
mov dword [ebp - 0x70], 0x57
xor edi, edi
jmp 0x47ce09
mov ecx, 0x105
cmp ax, cx
je 0x47c6e3
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x47c602
push 0
push 0
push 0
push 0x52534d42
mov ecx, esi
call dword [0x4f933c]
call esi
mov edi, eax
test edi, edi
je 0x47c602
xor ecx, ecx
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.004bbca0
add esp, 4
mov ecx, eax
mov dword [ebp - 0x78], ecx
test ecx, ecx
jne 0x47c67d
mov dword [ebp - 0x70], 8
mov edi, eax
jmp 0x47ce09
lea eax, [edi + 0x400]
push eax
push 0
push ecx
call fcn.004b23a0
add esp, 0xc
push edi
mov edi, dword [ebp - 0x78]
push edi
push 0
push 0x52534d42
mov ecx, esi
call dword [0x4f933c]
call esi
test eax, eax
je 0x47ce09
mov edx, edi
mov al, byte [edx + 1]
mov byte [ebp - 0x51], al
mov cl, byte [edx + 2]
mov byte [ebp - 0x52], cl
cmp al, 2
jae 0x47c6cb
mov dword [ebp - 0x70], 0x718
jmp 0x47ce09
lea edi, [edx + 8]
mov dword [ebp - 0x6c], edi
mov eax, dword [edx + 4]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x70], 0
jmp 0x47c96d
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x50], 0x2e002c
mov dword [ebp - 0x4c], str.DevicePhysicalMemory
mov dword [ebp - 4], 0
push str.NtOpenSection
push 0x530ad8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x47c8fd
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x50]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0x40
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x3c]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call dword [0x4f933c]
call esi
test eax, eax
js 0x47c8fd
push 0x10000
push 0xf0000
push 0
push 4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x7c], ecx
test ecx, ecx
je 0x47c8fd
mov esi, ecx
mov dword [ebp - 0x90], esi
mov eax, esi
sub eax, ecx
cmp eax, 0x10000
jae 0x47c7a5
cmp dword [esi], 0x5f4d535f
je 0x47c7ab
add esi, 0x10
jmp 0x47c787
je 0x47c8fd
mov al, byte [esi + 5]
cmp al, 0x1f
ja 0x47c8fd
cmp al, 0x1e
je 0x47c7c2
cmp al, 0x1f
jne 0x47c8fd
movzx eax, al
sub eax, ecx
add eax, esi
cmp eax, 0x10000
ja 0x47c8fd
movzx eax, word [esi + 0x16]
test ax, ax
je 0x47c8fd
mov ecx, 0x494d445f
cmp ecx, dword [esi + 0x10]
jne 0x47c8fd
mov ecx, 0x5f
cmp cl, byte [esi + 0x14]
jne 0x47c8fd
mov cl, byte [esi + 6]
mov byte [ebp - 0x51], cl
mov byte [ebp - 0x61], cl
mov dl, byte [esi + 7]
mov byte [ebp - 0x52], dl
mov byte [ebp - 0x62], dl
cmp cl, 2
jb 0x47c8fd
mov esi, dword [esi + 0x18]
mov edi, eax
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, esi
and ecx, 0xfff
mov dword [ebp - 0x74], ecx
lea eax, [edi + 0xfff]
add eax, ecx
and eax, 0xfffff000
push eax
sub esi, ecx
push esi
push 0
push 4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x7c], esi
test esi, esi
je 0x47c8fb
xor ecx, ecx
mov eax, edi
add eax, 0x400
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.004bbca0
add esp, 4
mov ecx, eax
mov dword [ebp - 0x80], ecx
test ecx, ecx
jne 0x47c89b
mov ecx, 8
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x84], ecx
xor edi, edi
mov dword [ebp - 4], 0xffffffff
jmp 0x47c951
lea eax, [edi + 0x400]
push eax
push 0
push ecx
call fcn.004b23a0
add esp, 0xc
push edi
mov eax, dword [ebp - 0x74]
add eax, esi
push eax
push dword [ebp - 0x80]
call fcn.004b1e20
add esp, 0xc
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x88], eax
mov eax, edi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x8c], eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x7c], 0
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x84], ecx
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 4], 0xffffffff
jmp 0x47c951
xor edi, edi
mov ecx, 0x490
mov dword [ebp - 4], 0xffffffff
jmp 0x47c951
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x47c962
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x70]
test ecx, ecx
jne 0x47cdf8
mov eax, dword [ebp - 0x60]
push 1
lea ecx, [ebp - 0x68]
push ecx
push 0
mov edx, eax
mov ecx, edi
call fcn.0047c4f0
add esp, 0xc
test eax, eax
jne 0x47ca57
mov dword [ebp - 0x20], eax
call fcn.004265f0
mov edi, eax
test edi, edi
je 0x47ce8a
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4f933c]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x68]
mov dl, byte [ecx + 8]
call fcn.0047c460
add esp, 4
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x47ca29
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
push str._d__d__d
push esi
call fcn.00422fe0
add esp, 0x14
cmp eax, 3
jne 0x47ca29
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp eax, 0x76c
jl 0x47ca14
sub eax, 0x76c
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x48]
push eax
call fcn.004c6d5a
add esp, 4
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x58], eax
mov dword [ecx + 0x5c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x47ca54
mov edi, dword [ecx]
mov eax, dword [edi]
mov esi, dword [eax + 4]
push ecx
mov ecx, esi
call dword [0x4f933c]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x6c]
push 1
lea eax, [ebp - 0x68]
push eax
push 1
mov edx, dword [ebp - 0x60]
mov ecx, edi
call fcn.0047c4f0
add esp, 0xc
test eax, eax
jne 0x47caa2
mov eax, dword [ebp - 0x58]
add eax, 4
push eax
mov esi, dword [ebp - 0x68]
mov dl, byte [esi + 7]
mov ecx, esi
call fcn.0047c460
add esp, 4
cmp byte [ebp - 0x51], 2
ja 0x47ca95
jne 0x47caa2
cmp byte [ebp - 0x52], 1
jb 0x47caa2
movups xmm0, xmmword [esi + 8]
mov esi, dword [ebp - 0x58]
movups xmmword [esi + 8], xmm0
jmp 0x47caa5
mov esi, dword [ebp - 0x58]
push 1
lea eax, [ebp - 0x68]
push eax
push 2
mov edx, dword [ebp - 0x60]
mov ecx, edi
call fcn.0047c4f0
add esp, 0xc
test eax, eax
jne 0x47cae6
lea eax, [esi + 0x18]
push eax
mov esi, dword [ebp - 0x68]
mov dl, byte [esi + 7]
mov ecx, esi
call fcn.0047c460
add esp, 4
mov eax, dword [ebp - 0x58]
add eax, 0x1c
push eax
mov dl, byte [esi + 8]
mov ecx, esi
call fcn.0047c460
add esp, 4
push 1
lea eax, [ebp - 0x68]
push eax
push 3
mov edx, dword [ebp - 0x60]
mov ecx, edi
call fcn.0047c4f0
add esp, 0xc
test eax, eax
jne 0x47cb2a
mov eax, dword [ebp - 0x58]
add eax, 0x20
push eax
mov esi, dword [ebp - 0x68]
mov dl, byte [esi + 7]
mov ecx, esi
call fcn.0047c460
add esp, 4
mov eax, dword [ebp - 0x58]
add eax, 0x24
push eax
mov dl, byte [esi + 8]
mov ecx, esi
call fcn.0047c460
add esp, 4
push 1
lea eax, [ebp - 0x68]
push eax
push 4
mov edx, dword [ebp - 0x60]
mov ecx, edi
call fcn.0047c4f0
add esp, 0xc
test eax, eax
jne 0x47cb85
mov esi, dword [ebp - 0x68]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edi, dword [ebp - 0x58]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
cmp byte [ebp - 0x51], 2
ja 0x47cb63
jne 0x47cb85
cmp byte [ebp - 0x52], 3
jb 0x47cb85
lea eax, [edi + 0x30]
push eax
mov dl, byte [esi + 0x20]
mov ecx, esi
call fcn.0047c460
add esp, 4
lea eax, [edi + 0x34]
push eax
mov dl, byte [esi + 0x21]
mov ecx, esi
call fcn.0047c460
add esp, 4
mov byte [ebp - 0x59], 1
nop dword [eax]
mov dword [ebp - 0x24], 0
call fcn.004265f0
mov edi, eax
test edi, edi
je 0x47ce8a
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4f933c]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 6
mov dl, 1
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x60]
test eax, eax
je 0x47cd31
test ecx, ecx
je 0x47cd31
mov esi, eax
lea edi, [ecx + eax]
mov dword [ebp - 0x74], edi
add eax, 4
mov dword [ebp - 0x20], eax
cmp eax, edi
ja 0x47cd37
mov dh, byte [ebp - 0x59]
cmp byte [esi], 0x11
jne 0x47cc00
cmp dh, dl
je 0x47cc26
inc dl
movzx ecx, byte [esi + 1]
add ecx, esi
cmp byte [ecx], 0
jne 0x47cc11
cmp byte [ecx + 1], 0
je 0x47cc14
inc ecx
jmp 0x47cc06
lea esi, [ecx + 2]
lea eax, [ecx + 6]
cmp eax, edi
jbe 0x47cbf5
mov eax, dword [ebp - 0x20]
jmp 0x47cd37
cmp byte [ebp - 0x51], 2
ja 0x47cc34
jne 0x47cc9a
cmp byte [ebp - 0x52], 3
jb 0x47cc9a
lea eax, [ebp - 0x24]
push eax
mov dl, byte [esi + 0x1a]
mov ecx, esi
call fcn.0047c460
add esp, 4
mov edi, dword [ebp - 0x58]
test eax, eax
jne 0x47cc58
lea eax, [ebp - 0x24]
push eax
lea ecx, [edi + 0x38]
call fcn.0047d390
lea eax, [ebp - 0x24]
push eax
mov dl, byte [esi + 0x18]
mov ecx, esi
call fcn.0047c460
add esp, 4
test eax, eax
jne 0x47cc79
lea eax, [ebp - 0x24]
push eax
lea ecx, [edi + 0x3c]
call fcn.0047d390
lea eax, [ebp - 0x24]
push eax
mov dl, byte [esi + 0x19]
mov ecx, esi
call fcn.0047c460
add esp, 4
test eax, eax
jne 0x47cc9a
lea eax, [ebp - 0x24]
push eax
lea ecx, [edi + 0x40]
call fcn.0047d390
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x47ccc8
mov edi, dword [ecx]
mov eax, dword [edi]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4f933c]
mov ecx, edi
call esi
add byte [ebp - 0x59], 1
jne 0x47cb90
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x74]
mov dh, byte [ebp - 0x51]
cmp dh, 2
ja 0x47ccf0
jne 0x47cdf8
cmp byte [ebp - 0x52], 1
jb 0x47cdab
mov dl, 1
mov edi, dword [ebp - 0x6c]
test edi, edi
je 0x47cda4
cmp dword [ebp - 0x60], 0
je 0x47cda4
mov esi, edi
cmp ecx, eax
ja 0x47cda4
cmp byte [esi], 0x16
jne 0x47cd1d
cmp dl, 1
je 0x47cd8d
inc dl
movzx ecx, byte [esi + 1]
add ecx, esi
cmp byte [ecx], 0
jne 0x47cd2e
cmp byte [ecx + 1], 0
je 0x47cd80
inc ecx
jmp 0x47cd23
lea edi, [eax + ecx]
add eax, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x74], edi
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x47ccd2
mov edi, dword [ecx]
mov eax, dword [edi]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4f933c]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
jmp 0x47ccd8
lea esi, [ecx + 2]
lea eax, [esi + 4]
cmp eax, dword [ebp - 0x74]
jbe 0x47cd11
jmp 0x47cda4
mov eax, dword [ebp - 0x58]
add eax, 0x44
push eax
mov dl, byte [esi + 7]
mov ecx, esi
call fcn.0047c460
add esp, 4
mov dh, byte [ebp - 0x51]
cmp dh, 2
ja 0x47cdb4
jne 0x47cdf8
cmp byte [ebp - 0x52], 3
jb 0x47cdf8
mov edi, dword [ebp - 0x6c]
mov dl, 1
test edi, edi
je 0x47cdf8
cmp dword [ebp - 0x60], 0
je 0x47cdf8
mov esi, dword [ebp - 0x74]
cmp dword [ebp - 0x20], esi
ja 0x47cdf8
cmp byte [edi], 0x27
jne 0x47cdd4
cmp dl, 1
je 0x47ce4f
inc dl
movzx ecx, byte [edi + 1]
add ecx, edi
nop word [eax + eax]
cmp byte [ecx], 0
jne 0x47cdeb
cmp byte [ecx + 1], 0
je 0x47cdee
inc ecx
jmp 0x47cde0
lea edi, [ecx + 2]
lea eax, [edi + 4]
cmp eax, esi
jbe 0x47cdc8
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x47ce06
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0x78]
push 0
call fcn.004bbcb0
add esp, 4
push edi
call fcn.004bbcb0
add esp, 4
push dword [ebp - 0x80]
call fcn.004bbcb0
add esp, 4
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004af3ab
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov esi, dword [ebp - 0x58]
lea eax, [esi + 0x48]
push eax
mov dl, byte [edi + 0xa]
mov ecx, edi
call fcn.0047c460
add esp, 4
lea eax, [esi + 0x4c]
push eax
mov dl, byte [edi + 8]
mov ecx, edi
call fcn.0047c460
add esp, 4
lea eax, [esi + 0x50]
push eax
mov dl, byte [edi + 9]
mov ecx, edi
call fcn.0047c460
add esp, 4
jmp 0x47cdf8
push 0x80004005
call fcn.004264a0
int3