Function at 0x44f280
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
sub esp, 0x3c
mov eax, dword [0x4086b4]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x1e0
push 8
push eax
call edi
mov ecx, dword [0x4086b4]
push 0x1e0
push 8
mov ebx, eax
push ecx
mov dword [esp + 0x24], ebx
call edi
mov edx, dword [0x4086b4]
push 0x1e0
push 8
push edx
mov esi, eax
call edi
push 0xef
push ebx
push 0
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push pe_nt_image_headers32
push 4
push 0
push 1
push 1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
call ebx
push 0
push pe_nt_image_headers32
push 4
push 0
push 1
mov edi, eax
mov eax, dword [esp + 0x64]
push 1
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push edi
mov ebx, eax
call ebp
push 0
push ebx
mov dword [esp + 0x30], eax
call ebp
cmp dword [esp + 0x28], eax
jne 0x44fc08
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0x7d0
push edi
call ebp
push 0
push 0
push 0x7d0
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
sub ecx, esi
mov dword [esp + 0x20], 0
mov eax, esi
mov dword [esp + 0x1c], ecx
mov edx, ecx
jmp 0x44f390
mov cx, word [eax]
cmp cx, word [edx + eax]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f390
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f3c0
push 0
push 0
push 0x1388
push edi
call ebp
push 0
push 0
push 0x1388
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44f430
mov cx, word [eax]
cmp cx, word [eax + edx]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f430
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f460
push 0
push 0
push 0x1770
push edi
call ebp
push 0
push 0
push 0x1770
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44f4d0
mov cx, word [eax]
cmp cx, word [eax + edx]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f4d0
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f500
push 0
push 0
push 0x2710
push edi
call ebp
push 0
push 0
push 0x2710
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44f570
mov cx, word [eax]
cmp cx, word [eax + edx]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f570
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f5a0
push 0
push 0
push 0x4e20
push edi
call ebp
push 0
push 0
push 0x4e20
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44f610
mov cx, word [eax]
cmp cx, word [eax + edx]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f610
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f640
push 0
push 0
push 0xc350
push edi
call ebp
push 0
push 0
push 0xc350
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44f6b0
mov cx, word [eax]
cmp cx, word [eax + edx]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f6b0
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f6e0
push 0
push 0
push 0x3a98
push edi
call ebp
push 0
push 0
push 0x3a98
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44f750
mov cx, word [eax]
cmp cx, word [eax + edx]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f750
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f780
push 0
push 0
push CreateMutexW
push edi
call ebp
push 0
push 0
push CreateMutexW
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44f7f0
mov cx, word [eax]
cmp cx, word [eax + edx]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f7f0
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f820
push 0
push 0
push 0x9470
push edi
call ebp
push 0
push 0
push 0x9470
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44f890
mov cx, word [eax]
cmp cx, word [eax + edx]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f890
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f8c0
push 0
push 0
push 0
push edi
call ebp
push 0
push 0
push 0
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
nop
mov cx, word [eax]
cmp cx, word [eax + edx]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f920
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f950
push 0
push 0
push 0xafc8
push edi
call ebp
push 0
push 0
push 0xafc8
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44f9c0
mov cx, word [eax]
cmp cx, word [edx + eax]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44f9c0
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [edx + eax], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44f9f0
push 0
push 0
push 0xc350
push edi
call ebp
push 0
push 0
push 0xc350
push ebx
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x1de
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push 0x1de
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
mov eax, esi
jmp 0x44fa60
mov cx, word [eax]
cmp cx, word [edx + eax]
jne 0x44fbcc
mov ecx, dword [esp + 0x20]
add ecx, 1
add eax, 2
cmp ecx, 0xef
mov dword [esp + 0x20], ecx
jle 0x44fa60
mov eax, esi
mov ecx, 0xf0
lea ebx, [ebx]
mov word [eax + edx], 0
mov word [eax], 0
add eax, 2
sub ecx, 1
jne 0x44fa90
push 0
push 0
push 0
push edi
call ebp
push 0
push 0
push 0
push ebx
call ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
push 0
push 0
push 2
push 0
push edi
call ebp
push 0
push 0
push 0
push 2
push 0
push ebx
mov dword [esp + 0x3c], eax
call ebp
mov ecx, dword [esp + 0x24]
push 0
push 0
push 0
push 4
push ecx
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [esp + 0x28]
push 0
push 0
push 0
push 4
push edx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x1c], eax
push 0x1c
lea eax, [esp + 0x34]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
add eax, 0xffffffff
shr eax, 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], 0
mov eax, ebp
sub ecx, ebp
jmp 0x44fb40
mov dx, word [eax]
cmp dx, word [ecx + eax]
jne 0x44fc08
mov edx, dword [esp + 0x20]
add edx, 1
add eax, 2
cmp edx, dword [esp + 0x2c]
mov dword [esp + 0x20], edx
jbe 0x44fb40
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebp
mov ecx, dword [esp + 0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call ebp
mov edx, dword [esp + 0x28]
push edx
call ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [0x4086b4]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x10]
mov eax, dword [0x4086b4]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x4086b4]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call ebp
push edi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
mov edx, dword [esp + 0x18]
mov eax, dword [0x4086b4]
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
push edx
push 0
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov edx, dword [0x4086b4]
push ecx
push 0
push edx
call ebp
mov eax, dword [0x4086b4]
push esi
push 0
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x3c
ret