Function at 0x44e650
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x5c
mov dword [ebp - 0x20], edx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov dword [esp], str.Disk_image_analysis:
call fcn.0043d9e0
mov eax, esi
call fcn.0044b6c5
xor ecx, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], ecx
mov ebx, eax
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x3c], eax
sub esp, 0x1c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
test ebx, ebx
je 0x44e6c8
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x44e6ef
mov dword [esp + 4], esi
mov bl, 0xff
mov dword [esp], str.__Could_not_open_image__s
call fcn.0043d9e0
jmp 0x44ea45
mov byte [0x51078c], 0
xor edx, edx
test esi, esi
je 0x44e71b
mov dword [esp], esi
call sub.msvcrt.dll_strlen
xor edx, edx
cmp eax, 4
jbe 0x44e71b
lea edx, [esi + eax - 1]
cmp byte [edx], 0x2e
je 0x44e71b
cmp esi, edx
je 0x44e71b
dec edx
jmp 0x44e70f
test edx, edx
mov eax, str._NULL_
cmovne eax, edx
xor edi, edi
mov ebx, eax
mov eax, dword [edi*8 + 0x4b1ee0]
test eax, eax
jne 0x44e739
mov eax, str._NULL_
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x44e947
mov al, byte [edi*8 + 0x4b1ee4]
mov byte [ebp - 0x40], al
mov byte [0x51078c], al
mov dword [esp], 0x200
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x44e928
xor eax, eax
cmp byte [ebp - 0x40], 8
mov dword [0x4dfd80], eax
ja 0x44e7d6
xor eax, eax
mov dword [esp + 0x18], 0x4dfd80
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], fcn.0043d9e0
mov dword [esp], eax
call fcn.0045253d
movzx eax, byte [ebp - 0x40]
mov dword [esp], esi
mov dword [esp + 8], 0x200
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
call fcn.00452167
mov esi, eax
mov edi, edx
call fcn.004525c3
jmp 0x44e8ca
cmp byte [ebp - 0x40], 9
jne 0x44e86d
cmp dword [0x5240c8], 0
je 0x44e90d
mov eax, esi
call fcn.0044c84e
test eax, eax
je 0x44e8ef
mov byte [0x51076e], 1
xor edi, edi
mov dword [esp + 0xc], eax
mov dword [ebp - 0x44], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fread
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov esi, eax
mov dword [esp], edx
call sub.msvcrt.dll_fclose
lea eax, [ebx + 4]
mov dword [esp + 8], 0xc
mov dword [esp + 4], str.SignedImage
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x44e8ca
mov word [ebx + 0x1fe], 0xaa55
mov ecx, dword [ebp - 0x40]
cmp ecx, 0x200
jne 0x44e920
jmp 0x44e8e8
xor eax, eax
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0044e201
test eax, eax
je 0x44e91b
mov byte [0x51076e], 1
call fcn.0044c84e
test eax, eax
je 0x44e91b
mov dword [esp + 0xc], eax
xor edi, edi
mov dword [ebp - 0x40], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fread
mov edx, dword [ebp - 0x40]
mov esi, eax
mov dword [esp], edx
call sub.msvcrt.dll_fclose
call fcn.0044e156
test edi, edi
jne 0x44e920
cmp esi, 0x200
jne 0x44e920
cmp byte [ebx + 0x1fe], 0x55
jne 0x44e92c
cmp byte [ebx + 0x1ff], 0xaa
jne 0x44e92c
mov esi, 1
jmp 0x44e93b
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], str.Could_not_open__s:__d
mov dword [esp + 8], eax
call fcn.0043d9e0
jmp 0x44e920
mov dword [esp], str.__An_FFU_image_was_selected__but_this_system_does_not_have_FFU_support_
call fcn.0043d9e0
jmp 0x44e920
call fcn.0044e156
mov dword [esp], ebx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x44e953
xor eax, eax
cmp dword [0x5240d4], 0
setne al
lea esi, [eax + eax]
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, esi
jmp 0x44e953
inc edi
cmp edi, 0xa
jne 0x44e729
jmp 0x44e928
cmp byte [0x51078c], 0
je 0x44e963
test al, al
setne bl
jmp 0x44e98e
xor edi, edi
mov dword [esp + 4], str.__Image
mov bl, 1
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.0040a7fa
test eax, eax
jne 0x44e98e
cmp dword [0x5240d4], 0
setne bl
add ebx, ebx
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
push esi
push esi
test eax, eax
jne 0x44e9c3
call fcn.0043df77
mov dword [esp], str.__Could_not_get_image_size:__s
mov bl, 0xfe
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x44ea45
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 8
mov dword [0x510754], edx
xor edx, edx
mov dword [0x510750], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
xor ecx, ecx
lea eax, [ebp - 0x2c]
sub esp, 0x14
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
sub esp, 0x14
test eax, eax
je 0x44ea40
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
xor eax, 0x4957534d
xor edx, 0x4d
or eax, edx
sete al
movzx eax, al
mov byte [0x51076f], al
mov eax, dword [ebp - 0x3c]
dec eax
cmp eax, 0xfffffffd
ja 0x44ea5b
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret