Function at 0x4832f0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de398
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x526f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov edi, dword [ebx + 0x18]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov esi, eax
or eax, ecx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ecx
jne 0x48337d
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.AddFile:_adding_0_bytes_file
push eax
call fcn.0046da40
add esp, 8
call fcn.00483040
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx + 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [ebx + 0xc]
mov dword [eax + 4], edx
xor edx, edx
lea ecx, [ecx]
cmp edx, dword [ebp - 0x34]
jg 0x4833a0
jl 0x48339b
cmp edi, esi
jae 0x4833a0
mov dword [ebp - 0x1c], edi
jmp 0x4833a3
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
add eax, 0x2000
mov dword [ebp - 0x10], eax
mov edi, edi
push 0
mov dword [ebp - 0x14], eax
xor ecx, ecx
add eax, dword [ebx + 8]
lea edx, [ebp - 0x4c]
adc ecx, dword [ebx + 0xc]
push edx
push eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebx]
push eax
mov dword [ebp - 0x4c], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [ebx]
push 0
push 0
push 0
push 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x483742
cmp dword [0x52cc20], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x2c], eax
jne 0x483418
push 0x52cc04
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x52cc20]
push 0
push ecx
push esi
push edi
call fcn.004c8f20
mov ecx, edi
sub ecx, eax
sbb esi, edx
mov edx, dword [ebp - 0x2c]
sub edi, ecx
lea eax, [edi + edx]
push eax
push ecx
mov ecx, dword [ebp - 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 6
push ecx
call esi
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x483453
add edi, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], 0
je 0x48377c
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0xc]
push edi
push edx
push eax
push 4
push ecx
call esi
mov esi, eax
test esi, esi
je 0x4837da
mov ecx, dword [ebx + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0xc]
push edi
push eax
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x20]
push eax
push esi
call edx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call esi
mov eax, dword [ebp - 0x2c]
push eax
call esi
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jb 0x4836f0
push ecx
mov edi, esp
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x30], edi
call fcn.004ad3ae
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4837ee
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov ecx, str._AddFile:_returned_chunk_bigger_than_the_original_
mov dword [ebp - 4], 0
test ecx, 0xffff0000
jne 0x4835e2
mov edx, ecx
movzx esi, dx
push esi
call fcn.004b5332
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x4836d5
mov ecx, esi
shr ecx, 4
inc ecx
movzx edx, cx
push 6
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4836d5
push esi
push eax
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004226f0
mov edx, eax
add esp, 0xc
mov dword [ebp - 0x2c], edx
test edx, edx
je 0x4836d5
mov eax, dword [edi]
movzx esi, word [edx]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x48356e
push esi
mov ecx, edi
call fcn.0042251a
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edi]
movzx eax, word [edx]
mov dword [ebp - 0x18], ecx
lea ecx, [edx + 2]
mov dword [ebp - 0x2c], ecx
cmp eax, 0xffffffff
jne 0x48358e
push ecx
call fcn.004bbaea
mov ecx, dword [ebp - 0x2c]
add esp, 4
inc eax
add eax, eax
push eax
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [esi + esi]
push edx
push ecx
mov dword [ebp - 0x2c], edx
call fcn.004bb571
add esp, 0x10
cmp eax, 0x50
ja case.0x4835b5.1
movzx edx, byte [eax + 0x48381c]
jmp dword [edx*4 + 0x48380c]
test esi, esi
jl 0x483802
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x483802
mov edx, dword [ebp - 0x2c]
mov dword [eax - 0xc], esi
mov eax, dword [edi]
xor ecx, ecx
mov word [edx + eax], cx
jmp 0x4836d5
push str._AddFile:_returned_chunk_bigger_than_the_original_
call fcn.004bbaea
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x48364f
mov ecx, dword [edi]
mov esi, dword [ecx - 0x10]
cmp dword [ecx - 0xc], ebx
lea eax, [ecx - 0x10]
je 0x4836d2
cmp dword [eax + 0xc], ebx
lea edx, [eax + 0xc]
jge 0x483626
cmp dword [ecx - 8], ebx
jl 0x483802
mov dword [ecx - 0xc], ebx
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
jmp 0x4836d2
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48363c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [edi], eax
jmp 0x4836d2
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x2c], ecx
mov esi, str._AddFile:_returned_chunk_bigger_than_the_original_
sub esi, eax
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
sar esi, 1
or eax, ecx
jge 0x483679
push ebx
mov ecx, edi
call fcn.0042251a
mov eax, dword [edi]
cmp esi, dword [ebp - 0x2c]
ja 0x48369c
mov edx, dword [eax - 8]
lea ecx, [ebx + ebx]
push ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + esi*2]
push ecx
add edx, edx
push edx
push eax
call fcn.004bb63f
mov esi, dword [ebp - 0x2c]
jmp 0x4836b1
mov ecx, dword [eax - 8]
lea esi, [ebx + ebx]
push esi
push str._AddFile:_returned_chunk_bigger_than_the_original_
add ecx, ecx
push ecx
push eax
call fcn.004bb571
add esp, 0x10
test ebx, ebx
jl 0x483802
mov eax, dword [edi]
cmp ebx, dword [eax - 8]
jg 0x483802
mov dword [eax - 0xc], ebx
mov edx, dword [edi]
xor eax, eax
mov word [esi + edx], ax
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00483040
add dword [ebp - 0x10], 0x100000
mov eax, dword [ebp - 0x10]
jmp 0x4833b0
xor ecx, ecx
add dword [ebx + 8], eax
adc dword [ebx + 0xc], ecx
xor edx, edx
cmp dword [ebp - 0x34], edx
jl 0x483714
jg 0x483709
mov esi, dword [ebp - 0x38]
cmp esi, dword [ebp - 0x24]
jbe 0x483714
mov esi, dword [ebp - 0x24]
sub dword [ebp - 0x38], esi
sbb dword [ebp - 0x34], edx
jmp 0x48371c
xor esi, esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
add dword [ebp - 0x40], edi
adc dword [ebp - 0x3c], 0
add dword [ebp - 0x48], eax
adc dword [ebp - 0x44], ecx
cmp dword [ebp - 0x34], 0
jl 0x4837ad
jg 0x483737
cmp dword [ebp - 0x38], 0
jbe 0x4837ad
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x24]
jmp 0x483390
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x14]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push edx
push str.AddFile:_error_extending_VFC_file_by__d_bytes__LE_d
push ecx
call fcn.0046da40
add esp, 0x10
call fcn.00483040
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push str._AddFile:_Dest_mapping_failed__LE_d
push ecx
call fcn.0046da40
add esp, 0xc
call fcn.00483040
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
mov ecx, dword [ebx + 8]
mov eax, dword [ebp + 0x10]
sub ecx, dword [eax]
mov edx, dword [ebx + 0xc]
sbb edx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push str._AddFile:_Src_mapping_failed__LE_d
jmp 0x48378e
push 0x80004005
call fcn.00422000
call fcn.004ad916
call fcn.004ad94e
push 0x80070057
call fcn.00422000
mov esp, 0xf8004835
aaa
dec eax
add ch, bh
aaa
dec eax
add ch, bh
aaa
dec eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3