Function at 0x44a480
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x60], rdx
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xb8], 0
lea rcx, [rbp + 0x90]
mov rdx, qword [0x00444b98]
call fcn.00412df0
nop
xor rax, rax
mov byte [rbp + 0x4f], al
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x44a52e
mov rcx, qword [rbp + 0x60]
call fcn.00412090
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x50], rax
jmp 0x44a582
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x60]
xor r8, r8
call fcn.004118e0
mov rcx, qword [rbp + 0x88]
call fcn.004115a0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
cmp rax, 0xffffffffffffffff
je 0x44ab28
mov rcx, qword [rbp + 0x50]
xor rdx, rdx
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x44ab1f
mov rcx, qword [rbp + 0x58]
mov edx, 4
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
test rax, rax
je 0x44ab16
mov rcx, qword [rbp + 0x50]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize
cmp eax, 0x22
jbe 0x44a638
mov rcx, qword [rbp + 0x50]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize
mov ecx, 4
xor edx, edx
div ecx
test edx, edx
jne 0x44a638
mov rax, qword [rbp + 0x68]
cmp dword [rax], 0x4742444a
jne 0x44a638
mov rax, qword [rbp + 0x68]
cmp byte [rax + 4], 1
je 0x44a63d
xor rax, rax
jmp 0x44a63f
mov al, 1
mov byte [rbp + 0x4f], al
movzx rax, byte [rbp + 0x4f]
test al, al
je 0x44a6be
mov rax, qword [rbp + 0x68]
cmp byte [rax + 0x21], 0
je 0x44a6be
mov rax, qword [rbp + 0x68]
mov esi, dword [rax + 0x1d]
neg esi
mov rbx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x50]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize
mov ecx, 1
mov r8d, 4
xor edx, edx
div r8d
mov dword [rbp + 0xcc], ecx
cmp dword [rbp + 0xcc], eax
jg 0x44a6a6
add eax, 1
add esi, dword [rbx]
add rbx, 4
add dword [rbp + 0xcc], 1
cmp dword [rbp + 0xcc], eax
jne 0x44a691
nop
mov eax, esi
shr eax, 8
shl esi, 0x18
or eax, esi
mov rcx, qword [rbp + 0x68]
cmp eax, dword [rcx + 0x1d]
sete al
mov byte [rbp + 0x4f], al
movzx rax, byte [rbp + 0x4f]
test al, al
je 0x44ab0d
mov rcx, qword [rbp + 0x68]
movsxd rax, dword [rcx + 9]
lea rax, [rcx + rax]
mov qword [rbp + 0xc0], rax
xor rbx, rbx
xor rsi, rsi
jmp 0x44a7af
add ebx, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a440
add esi, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0x80]
mov r8, qword [rbp + 0x68]
mov r9d, esi
call fcn.0044a390
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x80]
call fcn.00410a30
lea rcx, [0x0044ac08]
mov rdx, qword [rbp + 0xb8]
mov r8d, 0x7fffffff
mov r9d, 1
mov rax, qword [0x00b6ef08]
call qword [rax]
lea rcx, [rbp + 0xb8]
mov edx, 1
mov r8d, eax
call fcn.00412760
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov dl, 1
mov r8b, 1
mov r9d, ebx
mov dword [rsp + 0x20], 1
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x38], 0
call fcn.00445f00
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a440
test al, al
jne 0x44a6e9
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
cmp dword [rax + 0x18], 0
jle 0x44a8d6
mov rcx, qword [rbp + 0x40]
xor rdx, rdx
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov r8, rbp
neg r8
mov rax, qword [rax + r8]
mov r8d, dword [rax + 0x18]
sub r8d, 1
call fcn.00448e90
mov rcx, qword [rbp + 0x40]
xor rdx, rdx
call fcn.004493f0
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
cmp qword [rax + 0x70], 0
jbe 0x44a8d6
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rax, qword [rax + 0x10]
mov rcx, qword [rbp + 0x40]
lea rcx, [rcx + rbp + 0x80]
mov rdx, rbp
neg rdx
mov rcx, qword [rcx + rdx]
movsxd rcx, dword [rcx + 0x18]
lea rcx, [rcx + rcx*4]
mov rdx, qword [rbp + 0x40]
lea rdx, [rdx + rbp + 0x80]
mov r8, rbp
neg r8
mov rdx, qword [rdx + r8]
mov r8, qword [rbp + 0x40]
lea r8, [r8 + rbp + 0x80]
mov r9, rbp
neg r9
mov r8, qword [r8 + r9]
mov r8, qword [r8 + 0x10]
mov r9, qword [rbp + 0x40]
lea r9, [r9 + rbp + 0x80]
mov r10, rbp
neg r10
mov r9, qword [r9 + r10]
movsxd r9, dword [r9 + 0x18]
lea r9, [r9 + r9*4]
mov edx, dword [rdx + 0x70]
sub edx, dword [r8 + r9*8 - 0x20]
mov dword [rax + rcx*8 - 0x18], edx
xor rbx, rbx
xor rsi, rsi
xor rdi, rdi
mov rcx, qword [rbp + 0x68]
movsxd rax, dword [rcx + 0xd]
lea rax, [rcx + rax]
mov qword [rbp + 0xc0], rax
jmp 0x44aa57
add ebx, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a440
add esi, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a440
add edi, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0x78]
mov r8, qword [rbp + 0x68]
mov r9d, esi
call fcn.0044a390
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x78]
call fcn.00410a30
test edi, edi
jle 0x44aa2b
mov rcx, rbp
lea rdx, [rbp + 0x70]
mov r8, qword [rbp + 0x68]
mov r9d, edi
call fcn.0044a390
lea rcx, [rbp + 0xb8]
mov edx, 3
mov r8, qword [rbp + 0xb8]
lea r9, [0x0044ac18]
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.00412610
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
lea rdx, [rbp + 0x90]
mov r8b, 1
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov r9, rbp
neg r9
mov rax, qword [rax + r9]
mov rax, qword [rax + 0x68]
movsxd r9, ebx
lea r9, [rax + r9]
call fcn.0044d880
cmp byte [rbp + 0x90], 0
je 0x44aa2b
mov rcx, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xb8]
mov rax, qword [0x00b703b0]
call qword [rax]
test al, al
je 0x44aa2b
mov rcx, qword [rbp + 0xa8]
call fcn.00410b80
lea rcx, [rbp + 0xb8]
mov edx, 1
mov r8d, eax
add r8d, 1
call fcn.00412760
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov dl, 1
mov r8, qword [rbp + 0xb8]
mov r9d, ebx
mov byte [rsp + 0x20], 0
call fcn.00446380
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a440
test al, al
jne 0x44a8f7
xor rbx, rbx
xor rsi, rsi
mov rcx, qword [rbp + 0x68]
movsxd rax, dword [rcx + 0x11]
lea rax, [rcx + rax]
mov qword [rbp + 0xc0], rax
jmp 0x44aaf3
add ebx, dword [rbp + 0xcc]
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a440
add esi, dword [rbp + 0xcc]
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x80]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov edx, esi
movsxd rax, ebx
mov r8, qword [rbp + 0x40]
lea r8, [r8 + rbp + 0x80]
mov r9, rbp
neg r9
mov r8, qword [r8 + r9]
mov r8, qword [r8 + 0x68]
lea r8, [rax + r8]
xor r9, r9
call fcn.00446a30
mov rcx, rbp
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xcc]
call fcn.0044a440
test al, al
jne 0x44aa90
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_UnmapViewOfFile
mov rcx, qword [rbp + 0x58]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x50]
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x70]
mov edx, 3
call fcn.00410440
lea rcx, [rbp + 0x88]
call fcn.004103b0
lea rcx, [rbp + 0x90]
mov rdx, qword [0x00444b98]
call fcn.00412f90
lea rcx, [rbp + 0xb8]
call fcn.00410360
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0xd8]
pop rbx
pop rsi
pop rdi
pop rbp
ret