Function at 0x481950
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push 0x80
push 3
push 0
mov word [ebx], ax
mov eax, dword [ebp + 0xc]
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov dword [eax], 0
mov byte [ebp - 1], 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
je 0x4819b8
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x4819c1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 0x14], eax
test eax, eax
jne 0x4819f0
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x481bf0
mov esi, dword [eax + 0x3c]
add esi, eax
mov eax, 0x100
test word [esi + 0x16], ax
je 0x481a28
movzx eax, word [esi + 4]
mov ecx, 0x8664
cmp ax, cx
je 0x481a28
mov ecx, 0x200
cmp ax, cx
mov al, 1
jne 0x481a2a
mov al, 2
mov ecx, dword [ebp + 0xc]
mov byte [edi], al
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov ax, word [esi + 0x5e]
or ax, 1
mov word [ebx], ax
test byte [esi + 0x16], 1
movzx ecx, ax
je 0x481a51
and ecx, 0xffbf
mov word [ebx], cx
cmp byte [edi], 2
jne 0x481aff
mov eax, dword [ebp + 0x14]
push 0x108
mov edi, dword [eax + 0x3c]
add edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x481bf0
cmp dword [edi], 0x4550
jne 0x481bf0
lea edx, [edi + 0x108]
movzx edi, word [edi + 6]
lea esi, [eax + 1]
cmp edi, esi
jb 0x481bf0
cmp dword [edx + 0x10], 0
jne 0x481af2
cmp dword [edx], 0x7865742e
jne 0x481aae
cmp dword [edx + 4], 0x73736274
je 0x481af2
cmp dword [edx], 0x736c742e
jne 0x481abc
cmp dword [edx + 4], 0
je 0x481af2
cmp dword [edx], 0x7373622e
jne 0x481aca
cmp dword [edx + 4], 0
je 0x481af2
cmp dword [edx], 0x625f7472
jne 0x481adb
cmp dword [edx + 4], 0x7373
je 0x481af2
mov eax, dword [edx + 0x24]
test al, 0xc0
setne cl
bt eax, 0x1d
setb al
test al, cl
jne 0x481bec
inc esi
add edx, 0x28
cmp esi, edi
jle 0x481a97
jmp 0x481bf0
push 0xf8
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x481bf0
cmp dword [esi], 0x4550
jne 0x481bf0
lea edx, [esi + 0xf8]
movzx esi, word [esi + 6]
lea edi, [eax + 1]
cmp esi, edi
jb 0x481bf0
mov ebx, dword [edx + 0x24]
test bl, 0x20
je 0x481b54
mov eax, dword [edx + 8]
cmp eax, 0x1000
jbe 0x481b54
add eax, 0xfffff000
cmp dword [edx + 0x10], eax
jb 0x481bec
cmp dword [edx], 0x7865742e
jne 0x481b76
cmp dword [edx + 4], 0x74
jne 0x481b76
mov eax, dword [edx + 8]
cmp eax, 0x1000
jbe 0x481b76
add eax, 0xfffff000
cmp dword [edx + 0x10], eax
jb 0x481bec
cmp byte [edx], 0
jne 0x481b83
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 8]
jb 0x481bec
cmp dword [edx + 0x10], 0
jne 0x481bde
cmp dword [edx + 8], 0x1000
jb 0x481bde
cmp dword [edx], 0x7865742e
jne 0x481ba3
cmp dword [edx + 4], 0x73736274
je 0x481bde
cmp dword [edx], 0x736c742e
jne 0x481bb1
cmp dword [edx + 4], 0
je 0x481bde
cmp dword [edx], 0x7373622e
jne 0x481bbf
cmp dword [edx + 4], 0
je 0x481bde
cmp dword [edx], 0x7461642e
jne 0x481bcd
cmp dword [edx + 4], 0x61
je 0x481bde
test bl, 0xc0
setne cl
bt ebx, 0x1d
setb al
test al, cl
jne 0x481bec
inc edi
add edx, 0x28
cmp edi, esi
jle 0x481b34
jmp 0x481bf0
mov byte [ebp - 1], 1
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret