Function at 0x44e47f
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
test byte [esi + 0x18], 2
jne 0x44e550
test byte [esi + 0x18], 2
push ebx
push dword [esi + 0x24]
push ebx
push 0
pop eax
setne al
lea eax, [eax*2 + 2]
push eax
push ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x44e58c
test byte [esi + 0x18], 0x10
jne 0x44e5b3
mov edi, dword [esi + 0x2c]
test edi, edi
jne 0x44e503
mov ebx, dword [esi + 0x24]
push 4
push 0x102000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x4aa579
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov al, byte [esi + 0x18]
and al, 2
movzx eax, al
push edi
push dword [esi + 0x24]
neg eax
push 0
sbb eax, eax
and eax, 0xf001b
push 0
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi + 0x20], eax
test eax, eax
je 0x4aa593
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [esi + 0x18], 2
jne 0x44e59c
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
test dl, dl
je 0x44e496
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [esi + 0x24]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x44e58c
cmp dword [ebp - 8], ebx
jne 0x44e58c
mov eax, dword [esi + 0x24]
cmp eax, dword [ebp - 0xc]
jne 0x44e58c
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x44e496
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x4aa572
cmp byte [0x5a4ecd], 0
mov edi, dword [esi + 0x24]
mov dword [ebp + 8], edi
mov edi, dword [esi + 0x20]
je 0x44e547
jmp 0x4aa5b6
mov dword [esi + 0x2c], ebx
jmp 0x44e4d5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x44e549
call fcn.004575aa
test al, al
jne 0x44e4d8
test edi, edi
je 0x44e500
jmp 0x44e4f2
call ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
call fcn.004575aa
mov ecx, dword [ebp - 8]
test al, al
jne 0x44e509
cmp dword [esi + 0x20], 0
jne 0x44e538
jmp 0x4aa569
mov esi, dword [0x5a4fd0]
test esi, esi
jne 0x4aa626
push 0x40132c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x4aa5e1
cmp byte [0x5a4ecc], al
je 0x4aa610
call ebx
push eax
push 0x41a6d8
jmp 0x4aa609
push 0x41a764
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x5a4fd0], esi
test esi, esi
jne 0x4aa626
cmp byte [0x5a4ecc], al
je 0x4aa61a
call ebx
push eax
push 0x41a780
call fcn.004320dd
pop ecx
pop ecx
mov esi, dword [0x5a4fd0]
test esi, esi
jne 0x4aa626
mov byte [0x5a4ecd], 0
jmp 0x44e547
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0
push eax
push 1
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x44e547
cmp byte [0x5a4ecc], al
je 0x44e547
call ebx
mov ecx, dword [ebp + 8]
push eax
add ecx, edi
push ecx
push edi
push 0x41a808
call fcn.004320dd
add esp, 0x10
jmp 0x44e547