Function at 0x419fdb
Capabilities:
Delete file
Read file via mapping

Disassembly:
mov eax, 0x4e5637
call fcn.004e1580
sub esp, 0x78
push ebx
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x10000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
or ebx, 0xffffffff
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x41a017
mov esi, ebx
jmp 0x41a052
push esi
push esi
push esi
push 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x38], edi
jne 0x41a038
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41a013
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp - 0x34], eax
jne 0x41a064
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString
mov eax, esi
jmp 0x41a492
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00419f7e
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00419f7e
add esp, 0x10
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_3
push 0xa
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CMapStringToString::CMapStringToString
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.0046600c
cmp dword [ebp - 0x30], esi
mov byte [ebp - 4], 4
je 0x41a0cf
cmp dword [ebp - 0x24], 1
jle 0x41a0cb
push 0xd
jmp 0x41a0d1
push 0xc
jmp 0x41a0d1
push 0xb
lea ecx, [ebp - 0x84]
call fcn.00466523
cmp dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
jle 0x41a41d
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x41a0f2
xor esi, esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00419f7e
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::RemoveAll
cmp dword [ebp - 0x1c], esi
jle 0x41a163
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00419f97
pop ecx
test eax, eax
pop ecx
je 0x41a452
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00419f97
pop ecx
test eax, eax
pop ecx
je 0x41a452
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::MakeUpper
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x10]
call sub.MFC42.DLL_CMapStringToString::operator__
mov ecx, eax
call sub.MFC42.DLL_CString::operator_1
inc esi
cmp esi, dword [ebp - 0x1c]
jl 0x41a111
lea ecx, [ebp - 0x84]
call fcn.004664c2
mov esi, eax
test esi, esi
je 0x41a452
push str.FILENAME
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
push ebx
push eax
call fcn.0040294f
pop ecx
mov dword [ebp - 0x28], eax
pop ecx
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 5
call dword [ecx + 0x30]
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call edi
push 0x52b350
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
push ebx
push eax
call fcn.0040294f
pop ecx
mov dword [ebp - 0x28], eax
pop ecx
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 6
call dword [ecx + 0x10]
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call edi
push str.COMMENTS
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
push ebx
push eax
call fcn.0040294f
pop ecx
mov dword [ebp - 0x28], eax
pop ecx
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 7
call dword [ecx + 0x20]
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call edi
push str.REFERURL
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
push ebx
push eax
call fcn.0040294f
pop ecx
mov dword [ebp - 0x28], eax
pop ecx
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 8
call dword [ecx + 0x18]
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call edi
push str.PATH
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
push ebx
push eax
call fcn.0040294f
pop ecx
mov dword [ebp - 0x28], eax
pop ecx
push dword [ebp - 0x28]
mov eax, dword [esi]
mov byte [ebp - 4], 9
push esi
call dword [eax + 0x28]
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call edi
push str.STARTMODE
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
mov ebx, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
push eax
push esi
call dword [ebx + 0x48]
push str.ONLYFROMORIGIN
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
mov ebx, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
neg eax
sbb eax, eax
pop ecx
neg eax
push eax
push esi
call dword [ebx + 0x40]
push str.ORIGINTHREADCOUNT
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
mov ebx, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
push eax
push esi
call dword [ebx + 0x58]
mov ebx, 0x52b2fc
lea ecx, [ebp - 0x58]
push ebx
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
xor ecx, ecx
cmp dword [eax - 8], ecx
sete cl
mov eax, ecx
test eax, eax
jne 0x41a31e
push ebx
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
or ebx, 0xffffffff
push ebx
push eax
call fcn.0040294f
pop ecx
mov dword [ebp - 0x28], eax
pop ecx
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 0xa
call dword [ecx + 0x7c]
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call edi
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x84]
jmp 0x41a321
or ebx, 0xffffffff
push str.STATURL
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
xor ecx, ecx
cmp dword [eax - 8], ecx
sete cl
mov eax, ecx
test eax, eax
jne 0x41a370
push str.STATURL
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
push ebx
push eax
call fcn.0040294f
pop ecx
mov dword [ebp - 0x28], eax
pop ecx
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 0xb
call dword [ecx + 0x8c]
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call edi
push str.COOKIE
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
xor ecx, ecx
cmp dword [eax - 8], ecx
sete cl
mov eax, ecx
test eax, eax
jne 0x41a3bf
push str.COOKIE
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
push ebx
push eax
call fcn.0040294f
pop ecx
mov dword [ebp - 0x28], eax
pop ecx
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 0xc
call dword [ecx + 0x90]
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call edi
mov eax, dword [esi]
push esi
mov dword [ebp - 0x3c], esi
call dword [eax + 4]
push str.REFERURL
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xd
call sub.MFC42.DLL_CMapStringToString::operator__
mov eax, dword [eax]
push ebx
push eax
call fcn.0040294f
pop ecx
mov dword [ebp - 0x28], eax
pop ecx
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 0xe
call dword [ecx + 0xa0]
push dword [ebp - 0x28]
mov byte [ebp - 4], 0xd
call edi
mov eax, dword [esi]
push esi
call dword [eax + 0x78]
mov eax, dword [esi]
push esi
mov byte [ebp - 4], 4
call dword [eax + 8]
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jl 0x41a0f0
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x84]
push eax
call fcn.00466c82
mov ecx, eax
call fcn.00466c24
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.004660e5
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004e0bac
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4