Function at 0x44eb60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [0x4f90f0]
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov dword [esp + 0x1c], ecx
mov ecx, ebx
push 0
mov dword [esp + 0x34], ebx
call fcn.00495fe0
mov edi, dword [ebp + 8]
or eax, 0xffffffff
mov dword [esp + 0x14], eax
or edx, 0xffffffff
mov eax, dword [0x4f48cc]
mov byte [esp + 0xe], 0
mov byte [esp + 0x18], 0
mov dword [esp + 0x20], edx
mov ebx, dword [eax + 0xfc]
and ebx, 0x7fffffff
mov dword [esp + 0x2c], ebx
nop dword [eax]
mov esi, edi
movzx eax, word [esi]
cmp eax, 0x20
je 0x44ebcf
cmp eax, 9
jne 0x44ebd4
add esi, 2
jmp 0x44ebc2
cmp eax, 0x2a
jne 0x44ecbe
movzx ebx, word [esi + 2]
lea edi, [esi + 2]
test ebx, 0xffffff80
je 0x44ebf0
xor ecx, ecx
jmp 0x44ebfd
push 2
push ebx
call fcn.004b15e4
add esp, 8
mov ecx, eax
mov eax, ebx
and eax, 0xffffffdf
test ecx, ecx
cmove eax, ebx
add eax, 0xffffffbd
cmp eax, 0x11
ja case.0x44ec16.68
movzx eax, byte [eax + 0x44f118]
jmp dword [eax*4 + 0x44f104]
mov byte [esp + 0x18], 1
jmp case.0x44ec16.68
add esi, 4
mov ecx, esi
call fcn.00410ac0
test al, al
mov edx, 0xa
mov eax, 0x10
cmovne edx, eax
push edx
push 0
push esi
call fcn.004b2a2e
add esp, 0xc
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov edx, 0x4e2ac4
mov ecx, edi
call fcn.0040bad0
mov edi, eax
test edi, edi
je 0x44ec9e
sub edi, 2
jmp case.0x44ec16.68
lea eax, [esi + 4]
push eax
call fcn.004b2533
add esp, 4
mov dword [esp + 0x2c], eax
jmp 0x44ec51
mov byte [esp + 0xe], 1
cmp word [edi], 0
je 0x44ebc0
add edi, 2
cmp word [edi], 0
je 0x44ebc0
add edi, 2
jmp 0x44ebc0
mov eax, dword [0x4f48cc]
mov ecx, dword [esp + 0x10]
push 1
mov dword [eax + 0x30], 0x57
call fcn.0043b920
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0x8000000
push 3
push 0
push 3
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0x28], ebx
cmp ebx, 0xffffffff
jne 0x44ed05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4f48cc]
push 1
mov dword [ecx + 0x30], eax
mov ecx, dword [esp + 0x14]
call fcn.0043b920
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x34]
xorps xmm0, xmm0
push eax
push ebx
movq qword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x30], esi
cmp esi, 0xffffffff
jne 0x44ed35
call edi
test eax, eax
jne 0x44ed42
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov eax, esi
and eax, ecx
cmp eax, 0xffffffff
jne 0x44ed9f
call edi
mov ecx, dword [0x4f48cc]
push ebx
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4f48cc]
test byte [eax + 0x100], 1
jne 0x44ed81
mov ecx, dword [0x4f78d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e25ec
call fcn.00495fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x10]
push 0x4cd2cc
push 0
push 0x4e25ec
call fcn.0043b880
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esp + 0x20]
cmp ecx, edx
jb 0x44edb5
mov eax, dword [esp + 0x14]
ja 0x44edb1
cmp esi, eax
jbe 0x44edb5
mov esi, eax
mov ecx, edx
test ecx, ecx
jne 0x44f0e5
cmp esi, 0xfffffffd
ja 0x44f0e5
mov eax, esi
or eax, ecx
jne 0x44edf3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4f48cc]
mov ecx, dword [esp + 0x10]
push 0
mov dword [eax + 0x30], 0
call fcn.0043b920
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esp + 0x18], 0
mov ebx, dword [esp + 0x24]
je 0x44eec3
mov al, byte [ebx + 0x17]
test al, al
jne 0x44ee0f
mov eax, dword [ebx + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
je 0x44eec3
push 0
mov ecx, esi
mov byte [esp + 0x13], 1
shr ecx, 1
mov eax, esi
and eax, 1
push 1
add ecx, eax
push ecx
push 0
mov ecx, ebx
call fcn.00495fe0
cmp eax, 1
jne 0x44eef2
push 0
push eax
mov ecx, ebx
call fcn.00401530
mov edi, eax
test edi, edi
je 0x44eef2
push 0
lea eax, [esp + 0x20]
push eax
push esi
mov esi, dword [esp + 0x34]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4f48cc]
push esi
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x44f092
cmp byte [esp + 0x18], 0
jne 0x44f01a
mov ecx, dword [esp + 0x1c]
cmp ecx, 3
jb 0x44ef08
cmp byte [edi], 0xef
jne 0x44ef08
cmp byte [edi + 1], 0xbb
jne 0x44ef08
cmp byte [edi + 2], 0xbf
jne 0x44ef08
lea eax, [ecx - 3]
push 0xfde9
push eax
lea eax, [edi + 3]
push eax
jmp 0x44ef7f
lea eax, [esi + 2]
mov byte [esp + 0xf], 0
push eax
call fcn.004af8fa
mov edi, eax
add esp, 4
test edi, edi
jne 0x44ee52
mov ecx, dword [esp + 0x10]
push 0x4cd2cc
push eax
push str.Out_of_memory.
call fcn.0043bc60
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 2
jb 0x44ef6f
cmp byte [edi], 0xff
jne 0x44ef6f
cmp byte [edi + 1], 0xfe
jne 0x44ef6f
mov dl, 1
test dl, dl
lea eax, [ecx - 2]
push 0
cmove eax, ecx
mov ecx, ebx
shr eax, 1
test dl, dl
push 1
push eax
lea eax, [edi + 2]
cmove eax, edi
push eax
call fcn.00495fe0
neg eax
sbb eax, eax
and eax, esi
mov dword [esp + 0x14], eax
push edi
call fcn.004b113e
add esp, 4
mov ecx, ebx
push 0
push 1
call fcn.00401530
cmp byte [esp + 0xe], 0
mov edi, eax
je 0x44f0b4
cmp byte [ebx + 0x17], 0
jne 0x44ef90
mov esi, dword [ebx + 0xc]
jmp 0x44ef92
mov eax, dword [esp + 0x2c]
xor dl, dl
cmp eax, 0x4b0
je 0x44ef1a
push eax
push ecx
push edi
mov ecx, ebx
call fcn.00496ad0
test eax, eax
jne 0x44ef43
mov dword [esp + 0x14], eax
jmp 0x44ef43
mov esi, ebx
cmp byte [esi + 0x17], 1
jne 0x44efaa
test byte [esi + 0x15], 8
je 0x44efa5
mov ecx, esi
call fcn.00401450
lea eax, [esi + 0xc]
jmp 0x44efaf
mov eax, 0x4fb9c0
mov eax, dword [eax]
mov edx, 0x4e983c
shr eax, 1
mov ecx, edi
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
push 0x4ea374
call fcn.00492590
add esp, 0x18
cmp byte [ebx + 0x17], 0
jne 0x44efe3
mov esi, dword [ebx + 0xc]
jmp 0x44efe5
mov esi, ebx
cmp byte [esi + 0x17], 1
jne 0x44f008
test byte [esi + 0x15], 8
je 0x44eff8
mov ecx, esi
call fcn.00401450
mov eax, dword [esp + 0x2c]
add esi, 0xc
add eax, eax
mov dword [esi], eax
jmp 0x44f0b4
mov eax, dword [esp + 0x2c]
mov esi, 0x4fb9c0
add eax, eax
mov dword [esi], eax
jmp 0x44f0b4
mov al, byte [ebx + 0x17]
test al, al
jne 0x44f027
mov eax, dword [ebx + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
jne 0x44f068
mov edx, dword [esp + 0x1c]
mov ecx, edi
call fcn.00495e10
push edi
mov esi, eax
call fcn.004b113e
add esp, 4
cmp esi, 1
jne 0x44eefd
mov ecx, dword [0x4f78d0]
push esi
push 0
push 0xffffffffffffffff
push 0x4cd350
call fcn.00495fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
test al, 1
je 0x44f07d
mov byte [eax + edi], 0
inc eax
mov dword [esp + 0x2c], eax
xor ecx, ecx
mov word [eax + edi], cx
mov ecx, ebx
call fcn.0041e0f0
mov ecx, dword [esp + 0x2c]
mov dword [eax], ecx
jmp 0x44f0b4
xor eax, eax
mov ecx, ebx
mov word [edi], ax
call fcn.0041e0f0
cmp byte [esp + 0xf], 0
mov dword [eax], 0
jne 0x44f0b4
push edi
call fcn.004b113e
add esp, 4
push dword [esp + 0x18]
mov ecx, ebx
call fcn.00421030
test eax, eax
je 0x44eefd
cmp dword [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
sete al
movzx eax, al
push eax
call fcn.0043b920
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x10]
push 0x4cd2cc
push 0
push str.Out_of_memory.
call fcn.0043bc60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4