Function at 0x475e71
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov dword [ebp - 0x160], ecx
push 0
push 0
push 3
push 0
push 1
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x40000000
or eax, 0x80000000
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
jne 0x475ebc
xor eax, eax
jmp 0x47616f
push 0
lea edx, [ebp - 0x108]
push edx
push 0x40
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x475f4d
mov edx, dword [ebp - 0x148]
and edx, 0xffff
cmp edx, 0x5a4d
jne 0x475f4d
push 0
push 0
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x108]
push edx
push 0xf8
lea eax, [ebp - 0xfc]
push eax
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x475f4d
cmp dword [ebp - 0xfc], 0x4550
jne 0x475f4d
mov edx, dword [ebp - 0xf6]
and edx, 0xffff
test edx, edx
jne 0x475f61
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x47616f
mov ecx, dword [ebp - 0xf6]
and ecx, 0xffff
imul ecx, ecx, 0x28
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x154]
mov dword [ebp - 0x100], edx
cmp dword [ebp - 0x100], 0
jne 0x475fa8
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x47616f
mov ecx, dword [ebp - 0xf6]
and ecx, 0xffff
imul ecx, ecx, 0x28
mov dword [ebp - 0x108], ecx
push 0
push 0
mov edx, dword [ebp - 0xe8]
and edx, 0xffff
mov eax, dword [ebp - 0x10c]
lea ecx, [eax + edx + 0x18]
push ecx
mov edx, dword [ebp - 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x100]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47603c
mov ecx, dword [ebp - 0x100]
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x158]
push edx
call fcn.004a90a8
add esp, 4
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x47616f
mov dword [ebp - 0x104], 0
mov ecx, dword [ebp - 0xd4]
push ecx
mov edx, dword [ebp - 0xac]
push edx
mov eax, dword [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xf6]
push ecx
mov edx, dword [ebp - 0x100]
push edx
mov eax, dword [ebp - 0x14c]
push eax
mov ecx, dword [ebp - 0x160]
call fcn.00475cda
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xd4]
je 0x476141
mov dword [ebp - 0x104], 0x65
cmp dword [ebp + 0xc], 0
je 0x476141
mov edx, dword [ebp - 0xf6]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x100]
add eax, edx
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp - 0x150]
mov eax, dword [edx - 0x1c]
mov ecx, dword [ebp - 0x150]
add eax, dword [ecx - 0x20]
mov dword [ebp - 0xac], eax
push 0
push 0
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x108]
push ecx
push 0xf8
lea edx, [ebp - 0xfc]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
mov ecx, dword [ebp - 0x150]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp - 0x15c]
push eax
call fcn.004a90a8
add esp, 4
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x104]
mov esp, ebp
pop ebp
ret 8