Function at 0x442230
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x49e1a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x4c], 0
call fcn.00442c80
test al, al
je 0x44237f
lea ecx, [esp + 0x54]
call fcn.0049902a
mov dword [esp + 0x20], eax
lea esi, [edi + 0xae0]
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0041e220
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0041e360
lea ecx, [esp + 0x20]
add edi, 0xaa4
push ecx
mov ecx, edi
call fcn.0041e220
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.0041e360
push str.ZRGAP
mov ecx, esi
call fcn.0041e390
mov ebx, eax
push str.ZRGAP
mov ecx, edi
mov dword [esp + 0x3c], ebx
call fcn.0041e390
mov ebp, eax
test ebx, ebx
mov dword [esp + 0x3c], ebp
jl 0x44237f
lea eax, [ebx + 9]
mov ecx, esi
push eax
push ebx
call fcn.0041e360
lea eax, [ebp + 9]
mov ecx, edi
push eax
push ebp
call fcn.0041e360
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
call fcn.0041e320
lea eax, [esp + 0x40]
mov ecx, edi
push eax
call fcn.0041e320
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esp + 0x20]
call fcn.0048c4c3
mov edx, dword [0x4cc854]
mov dword [esp + 0x18], edx
push 0x4c8bc8
push 0
push 0xf001f
mov byte [esp + 0x58], 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
mov dword [esp + 0x24], eax
je 0x442363
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x30], eax
jne 0x4423a7
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 1
call fcn.0048c403
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 0
call fcn.0048c403
lea ecx, [esp + 0x54]
mov dword [esp + 0x4c], 0xffffffff
call fcn.0048c403
xor eax, eax
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
push eax
lea ecx, [esp + 0x1c]
call fcn.0048c58c
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
call fcn.0048c178
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov byte [esp + 0x54], 3
call fcn.00442c90
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x50], 4
call fcn.0048c53c
lea ecx, [esp + 0x34]
mov byte [esp + 0x4c], 3
call fcn.0048c403
mov eax, dword [0x4cc854]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], 5
call fcn.0048a80f
push 0x4c8bc4
lea ecx, [esp + 0x14]
call fcn.0048a476
cmp eax, 0xffffffff
je 0x4424f3
push 0x4c8bc4
lea ecx, [esp + 0x14]
call fcn.0048a476
push 0x4c8bc0
lea ecx, [esp + 0x14]
mov ebp, eax
call fcn.0048a476
mov ebx, eax
lea edx, [esp + 0x34]
mov ecx, ebx
sub ecx, ebp
dec ecx
inc ebp
push ecx
push ebp
push edx
lea ecx, [esp + 0x1c]
call fcn.0048a2ca
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x50], 6
call fcn.0048c53c
lea ecx, [esp + 0x34]
mov byte [esp + 0x4c], 5
call fcn.0048c403
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push eax
call fcn.0048a476
cmp eax, 0xffffffff
jne 0x4424eb
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
sub eax, ebx
dec eax
push eax
push edx
call fcn.0048a360
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x50], 7
call fcn.0048c53c
lea ecx, [esp + 0x30]
mov byte [esp + 0x4c], 5
call fcn.0048c403
push 0x4c8bc4
lea ecx, [esp + 0x14]
call fcn.0048a476
cmp eax, 0xffffffff
jne 0x442438
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x1c]
push 0x4c8bbc
lea ecx, [esp + 0x40]
push eax
push ecx
call fcn.0048c698
mov eax, dword [eax]
push 0x4d0e20
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 8
call fcn.0048a144
lea ecx, [esp + 0x3c]
mov byte [esp + 0x4c], 5
call fcn.0048c403
lea ecx, [esp + 0x14]
call fcn.0049902a
mov dword [esp + 0x28], eax
lea eax, [ebx + 9]
push eax
push ebx
mov ecx, esi
call fcn.0041e360
lea eax, [ebp + 9]
mov ecx, edi
push eax
push ebp
call fcn.0041e360
lea edx, [esp + 0x28]
mov ecx, esi
push edx
call fcn.0041e340
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call fcn.0041e340
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 3
call fcn.0048c403
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], 2
call fcn.0048c403
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 1
call fcn.0048c403
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 0
call fcn.0048c403
lea ecx, [esp + 0x54]
mov dword [esp + 0x4c], 0xffffffff
call fcn.0048c403
mov eax, 1
jmp 0x442392