Function at 0x44f490
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xec], edx
mov dword [ebp - 0xf8], edi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [0x549e18]
mov ebx, eax
push ecx
push ecx
push str.EDC4A979__d_404A__X_6BB9CDCE5510
lea eax, [ebp - 0xd0]
mov byte [ebp - 0xe1], 0
push 0x64
xor esi, esi
push eax
mov dword [ebp - 0xe8], esi
call fcn.00407ae0
add esp, 0x14
lea eax, [ebp - 0xd0]
push eax
push esi
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0xf0], eax
test eax, eax
je 0x44f535
push esi
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x44f527
cmp dword [eax + 0x1c], esi
push eax
setne byte [ebp - 0xe1]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xf0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44f540
mov esi, 2
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xd4], 0
test edi, edi
js 0x44f581
mov ecx, dword [0x548f44]
mov eax, 0x38e38e39
sub ecx, dword [0x548f40]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x44f581
mov ecx, dword [0x548f40]
lea eax, [edi + edi*8]
lea eax, [ecx + eax*8]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xec]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
test eax, eax
js 0x44f628
cmp eax, 5
jg 0x44f628
mov dword [ebp - 0x128], 0x1200
mov dword [ebp - 0x124], 0x520880
mov dword [ebp - 0x120], 0x1201
mov dword [ebp - 0x11c], 0x52088c
mov dword [ebp - 0x118], 0x1202
mov dword [ebp - 0x114], 0x5208d8
mov dword [ebp - 0x110], 0x1203
mov dword [ebp - 0x10c], 0x5208e8
mov dword [ebp - 0x108], 0x1204
mov dword [ebp - 0x104], 0x5208b4
mov dword [ebp - 0x100], 0x1205
mov dword [ebp - 0xfc], 0x5208c8
push dword [ebp + eax*8 - 0x124]
push dword [ebp + eax*8 - 0x128]
push esi
push ebx
call edi
push 0x520934
push 0x1105
push esi
push ebx
call edi
push 0x520944
push 0x1106
push esi
push ebx
call edi
cmp dword [0x548fec], 0
je 0x44f666
cmp dword [0x548ff0], 7
mov eax, 0x548fdc
cmova eax, dword [0x548fdc]
test eax, eax
je 0x44f68d
jmp 0x44f66b
mov eax, 0x51b3ac
cmp word [eax], 0
je 0x44f68d
push 0x5208fc
push 0x1108
push esi
push ebx
call edi
push 0x520910
push 0x1109
push esi
push ebx
call edi
push 0x51c510
push 0x1107
push esi
push ebx
call edi
push 0x51b3ac
push 0
push 0x800
push ebx
call edi
cmp byte [ebp - 0xe1], 0
je 0x44f6bf
push 0x520988
push 0x1100
jmp 0x44f6c9
push str.Pbk
push 0x1101
push esi
push ebx
call edi
push 0x51b3ac
push 0
push 0x800
push ebx
call edi
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xf0], ecx
test eax, eax
je 0x44f7db
mov ecx, dword [eax + 0xc]
call fcn.00466280
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 0xdc], edx
call fcn.0043b570
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.004521a0
mov esi, dword [0x549f24]
mov ecx, 0x548eec
mov dword [ebp - 0xdc], 0
mov eax, dword [eax + 4]
test eax, eax
cmovne esi, eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00451630
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xd4], 0
push eax
lea eax, [ebp - 0xd4]
mov ecx, 0x548f0c
push eax
call fcn.00451630
xor eax, eax
lea ecx, [esi + 0x10]
cmp esi, dword [0x549f24]
cmove ecx, eax
mov eax, dword [ebp - 0xdc]
cmp eax, dword [0x548ef0]
je 0x44f7b8
add eax, 0xc
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xd4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
mov esi, dword [ebp - 0xe8]
cmp eax, dword [0x548f10]
je 0x44f7db
add eax, 0xc
mov dword [ebp - 0xf0], eax
push 0
push ecx
lea ecx, [ebp - 0xf4]
mov dword [0x549e24], ebx
call fcn.0044f8c0
push 0x10
push dword [ebp - 0xec]
lea ecx, [ebp - 0xf4]
mov dword [0x549e28], eax
call fcn.0044f8c0
push 0x20
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xf4]
mov dword [0x549e2c], eax
call fcn.0044f8c0
push 0x520960
push dword [0x549e28]
or esi, 0x10
mov dword [0x549e30], eax
push esi
push ebx
call edi
push 0x520974
push dword [0x549e2c]
push esi
push ebx
call edi
push 0x5209c8
push dword [0x549e30]
push esi
push ebx
call edi
push 0x51b3ac
push 0
push 0x800
push ebx
call edi
mov esi, dword [ebp - 0xe8]
push 0x5209dc
push 0x1102
push esi
push ebx
call edi
push 0x5209a8
push 0x1103
push esi
push ebx
call edi
push 0
push dword [0x549e00]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dadd7
mov esp, ebp
pop ebp
ret