Function at 0x44a380
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x60], rdx
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xb8], 0
lea rcx, [rbp + 0x90]
mov rdx, qword [0x00444a98]
call fcn.00412bc0
nop
xor rax, rax
mov byte [rbp + 0x4f], al
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x44a42e
mov rcx, qword [rbp + 0x60]
call fcn.00411e10
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x50], rax
jmp 0x44a482
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x60]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x88]
call fcn.00411320
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
cmp rax, 0xffffffffffffffff
je 0x44aa28
mov rcx, qword [rbp + 0x50]
xor rdx, rdx
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x44aa1f
mov rcx, qword [rbp + 0x58]
mov edx, 4
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
test rax, rax
je 0x44aa16
mov rcx, qword [rbp + 0x50]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize
cmp eax, 0x22
jbe 0x44a538
mov rcx, qword [rbp + 0x50]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize
mov ecx, 4
xor edx, edx
div ecx
test edx, edx
jne 0x44a538
mov rax, qword [rbp + 0x68]
cmp dword [rax], 0x4742444a
jne 0x44a538
mov rax, qword [rbp + 0x68]
cmp byte [rax + 4], 1
je 0x44a53d
xor rax, rax
jmp 0x44a53f
mov al, 1
mov byte [rbp + 0x4f], al
movzx rax, byte [rbp + 0x4f]
test al, al
je 0x44a5be
mov rax, qword [rbp + 0x68]
cmp byte [rax + 0x21], 0
je 0x44a5be
mov rax, qword [rbp + 0x68]
mov esi, dword [rax + 0x1d]
neg esi
mov rbx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x50]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize
mov ecx, 1
mov r8d, 4
xor edx, edx
div r8d
mov dword [rbp + 0xcc], ecx
cmp dword [rbp + 0xcc], eax
jg 0x44a5a6
add eax, 1
add esi, dword [rbx]
add rbx, 4
add dword [rbp + 0xcc], 1
cmp dword [rbp + 0xcc], eax
jne 0x44a591
nop
mov eax, esi
shr eax, 8
shl esi, 0x18
or eax, esi
mov rcx, qword [rbp + 0x68]
cmp eax, dword [rcx + 0x1d]
sete al
mov byte [rbp + 0x4f], al
movzx rax, byte [rbp + 0x4f]
test al, al
je 0x44aa0d
mov rcx, qword [rbp + 0x68]
movsxd rax, dword [rcx + 9]
lea rax, [rcx + rax]
mov qword [rbp + 0xc0], rax
xor rbx, rbx
xor rsi, rsi
jmp 0x44a6af
add ebx, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a340
add esi, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0x80]
mov r8, qword [rbp + 0x68]
mov r9d, esi
call fcn.0044a290
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x80]
call fcn.00410750
lea rcx, [0x0044ab08]
mov rdx, qword [rbp + 0xb8]
mov r8d, 0x7fffffff
mov r9d, 1
mov rax, qword [0x00bb7940]
call qword [rax]
lea rcx, [rbp + 0xb8]
mov edx, 1
mov r8d, eax
call fcn.004124e0
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov dl, 1
mov r8b, 1
mov r9d, ebx
mov dword [rsp + 0x20], 1
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x38], 0
call fcn.00445e00
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a340
test al, al
jne 0x44a5e9
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
cmp dword [rax + 0x18], 0
jle 0x44a7d6
mov rcx, qword [rbp + 0x40]
xor rdx, rdx
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov r8, rbp
neg r8
mov rax, qword [rax + r8]
mov r8d, dword [rax + 0x18]
sub r8d, 1
call fcn.00448d90
mov rcx, qword [rbp + 0x40]
xor rdx, rdx
call fcn.004492f0
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
cmp qword [rax + 0x70], 0
jbe 0x44a7d6
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rax, qword [rax + 0x10]
mov rcx, qword [rbp + 0x40]
lea rcx, [rcx + rbp + 0x80]
mov rdx, rbp
neg rdx
mov rcx, qword [rcx + rdx]
movsxd rcx, dword [rcx + 0x18]
lea rcx, [rcx + rcx*4]
mov rdx, qword [rbp + 0x40]
lea rdx, [rdx + rbp + 0x80]
mov r8, rbp
neg r8
mov rdx, qword [rdx + r8]
mov r8, qword [rbp + 0x40]
lea r8, [r8 + rbp + 0x80]
mov r9, rbp
neg r9
mov r8, qword [r8 + r9]
mov r8, qword [r8 + 0x10]
mov r9, qword [rbp + 0x40]
lea r9, [r9 + rbp + 0x80]
mov r10, rbp
neg r10
mov r9, qword [r9 + r10]
movsxd r9, dword [r9 + 0x18]
lea r9, [r9 + r9*4]
mov edx, dword [rdx + 0x70]
sub edx, dword [r8 + r9*8 - 0x20]
mov dword [rax + rcx*8 - 0x18], edx
xor rbx, rbx
xor rsi, rsi
xor rdi, rdi
mov rcx, qword [rbp + 0x68]
movsxd rax, dword [rcx + 0xd]
lea rax, [rcx + rax]
mov qword [rbp + 0xc0], rax
jmp 0x44a957
add ebx, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a340
add esi, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a340
add edi, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0x78]
mov r8, qword [rbp + 0x68]
mov r9d, esi
call fcn.0044a290
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x78]
call fcn.00410750
test edi, edi
jle 0x44a92b
mov rcx, rbp
lea rdx, [rbp + 0x70]
mov r8, qword [rbp + 0x68]
mov r9d, edi
call fcn.0044a290
lea rcx, [rbp + 0xb8]
mov edx, 3
mov r8, qword [rbp + 0xb8]
lea r9, [0x0044ab18]
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.00412390
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
lea rdx, [rbp + 0x90]
mov r8b, 1
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov r9, rbp
neg r9
mov rax, qword [rax + r9]
mov rax, qword [rax + 0x68]
movsxd r9, ebx
lea r9, [rax + r9]
call fcn.0044d780
cmp byte [rbp + 0x90], 0
je 0x44a92b
mov rcx, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xb8]
mov rax, qword [0x00bb8d10]
call qword [rax]
test al, al
je 0x44a92b
mov rcx, qword [rbp + 0xa8]
call fcn.004108a0
lea rcx, [rbp + 0xb8]
mov edx, 1
mov r8d, eax
add r8d, 1
call fcn.004124e0
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov dl, 1
mov r8, qword [rbp + 0xb8]
mov r9d, ebx
mov byte [rsp + 0x20], 0
call fcn.00446280
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a340
test al, al
jne 0x44a7f7
xor rbx, rbx
xor rsi, rsi
mov rcx, qword [rbp + 0x68]
movsxd rax, dword [rcx + 0x11]
lea rax, [rcx + rax]
mov qword [rbp + 0xc0], rax
jmp 0x44a9f3
add ebx, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a340
add esi, dword [rbp + 0xcc]
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov edx, esi
movsxd rax, ebx
mov r8, qword [rbp + 0x40]
lea r8, [r8 + rbp + 0x80]
mov r9, rbp
neg r9
mov r8, qword [r8 + r9]
mov r8, qword [r8 + 0x68]
lea r8, [rax + r8]
xor r9, r9
call fcn.00446930
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a340
test al, al
jne 0x44a990
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_UnmapViewOfFile
mov rcx, qword [rbp + 0x58]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x50]
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x70]
mov edx, 3
call fcn.00410160
lea rcx, [rbp + 0x88]
call fcn.004100d0
lea rcx, [rbp + 0x90]
mov rdx, qword [0x00444a98]
call fcn.00412d60
lea rcx, [rbp + 0xb8]
call fcn.00410080
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0xd8]
pop rbx
pop rsi
pop rdi
pop rbp
ret