Function at 0x444250
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x50c3ab
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x1d4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x1ec]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1fc]
mov edi, ecx
mov esi, edx
call fcn.004477f0
test al, al
je 0x4442c0
mov dword [esp + 0x1c], str.CreateShareble
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.0044b240
mov ecx, eax
mov eax, str.CreateShareble
call fcn.0044b680
xor ebx, ebx
mov dword [esp + 0x1f4], ebx
cmp dword [edi + 4], ebx
je 0x444314
push str._rYeR
push ebp
call fcn.00439500
add esp, 8
mov byte [esp + 0x1b], al
mov dword [esp + 0x1f4], 0xffffffff
call fcn.004477f0
test al, al
je 0x44430b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.0044b240
cmp byte [eax], 0
je 0x44430b
call fcn.0044b720
mov al, byte [esp + 0x1b]
jmp 0x4445c9
cmp esi, ebx
je 0x4443d1
push 6
push 0x528ff4
push esi
lea ebx, [esp + 0x2c]
call fcn.004cde12
add esp, 0xc
test eax, eax
je 0x44435e
push 0x528ff4
mov eax, ebx
push 0xe2
push eax
call fcn.004cd5f0
add esp, 0xc
push 0xc2
push esi
mov ecx, ebx
push 0xe2
push ecx
call fcn.004d0ae8
jmp 0x444373
push 0xc8
push esi
lea edx, [esp + 0x28]
push 0xe2
push edx
call fcn.004cf75d
xor eax, eax
add esp, 0x10
mov word [esp + 0x1b0], ax
cmp byte [esp + 0x204], al
je 0x4443a8
call fcn.00442f80
add eax, 0x4be
je 0x4443a8
push eax
lea ecx, [esp + 0x24]
push 0xe2
push ecx
call fcn.004cd573
add esp, 0xc
cmp byte [esp + 0x208], 0
je 0x4443d1
call fcn.00442f80
add eax, 0x49c
je 0x4443d1
push eax
lea edx, [esp + 0x24]
push 0xe2
push edx
call fcn.004cd573
add esp, 0xc
xor esi, esi
test ebx, ebx
je 0x444481
push ebx
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x444481
mov dword [edi + 0xc], 2
mov ecx, dword [esp + 0x20c]
push ecx
push 0
push 0
push 6
push esi
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
jne 0x44459c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x444437
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi + 8], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x44444c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
mov ecx, ebp
call fcn.00439450
mov edi, esi
mov esi, eax
call fcn.00439ca0
mov ecx, ebp
call fcn.00439450
test ebx, ebx
jne 0x44454f
push 0x52aa2c
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
jmp 0x4444c6
cmp byte [esp + 0x200], 0
je 0x444515
mov eax, dword [esp + 0x20c]
push ebx
push eax
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x4444f7
test ebx, ebx
jne 0x4444e1
push 0x52a9bc
mov ebx, ebp
call fcn.00439c70
mov ecx, eax
call fcn.00439dd0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1f4], 0xffffffff
call fcn.004477c0
xor al, al
jmp 0x4445c9
push ebx
push 0x52a9d8
mov ebx, ebp
call fcn.00439c70
mov ecx, eax
call fcn.00439dd0
jmp 0x4444bf
mov dword [edi + 0xc], 1
test ebx, ebx
je 0x444515
push 6
push esi
call fcn.00444ea0
push 6
push esi
call fcn.00444ef0
add esp, 0x10
test esi, esi
jne 0x4443f7
cmp byte [esp + 0x200], 0
jne 0x4443f7
test ebx, ebx
jne 0x444536
push 0x52a9f4
jmp 0x4444b8
push ebx
push 0x52aa10
mov ebx, ebp
call fcn.00439c70
mov ecx, eax
call fcn.00439dd0
jmp 0x4444bf
mov esi, eax
push 0x52aa50
push 0x52139c
mov edx, esi
call fcn.0043a8a0
push ebx
push 0x52139c
mov edx, esi
call fcn.0043a8a0
push 0x52aa74
push 0x52139c
mov edx, esi
call fcn.0043a8a0
mov edx, dword [esp + 0x224]
push edx
push 0x529348
mov edx, esi
call fcn.0043a8a0
add esp, 0x20
jmp 0x4444c6
mov dword [esp + 0x1f4], 0xffffffff
call fcn.004477f0
test al, al
je 0x4445c7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.0044b240
cmp byte [eax], 0
je 0x4445c7
call fcn.0044b720
mov al, 1
mov ecx, dword [esp + 0x1ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.004ccee1
add esp, 0x1e4
ret 0x14