Function at 0x421364
Capabilities:
Delete file
Get file size
Read file via mapping

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffde4
mov esi, ecx
mov byte [esp], dl
mov ebx, eax
mov byte [esp + 1], 0
mov eax, dword [0x48d818]
cmp byte [eax], 0
jne 0x4218cc
mov eax, dword [0x48d8b4]
cmp byte [eax], 0
jne 0x4218cc
cmp byte [esp], 0
jne 0x4213b1
xor eax, eax
mov al, bl
mov edx, dword [0x48d408]
cmp dword [edx + eax*4 - 4], 0
jne 0x4218cc
cmp byte [esp], 0
je 0x4213be
mov eax, esi
call fcn.0041f780
lea ecx, [esp + 0x11c]
lea edx, [esp + 0x1c]
mov eax, ebx
call fcn.0041e3ac
cmp byte [esp], 0
jne 0x42153f
lea eax, [esp + 0x1c]
call fcn.00412584
test al, al
je 0x42153f
lea eax, [esp + 0x11c]
call fcn.00412584
test al, al
je 0x42153f
lea eax, [esp + 0x11c]
call fcn.00412ef8
cdq
push edx
push eax
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
add eax, 0x10
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x421422
cmp eax, dword [esp]
pop edx
pop eax
jne 0x42153f
mov edx, esi
mov eax, ebx
call fcn.0041f370
test al, al
je 0x4218cc
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
lea eax, [esp + 0x11c]
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.0040eba4
mov ebp, eax
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
add eax, 0x10
add eax, 0x10
push eax
mov edi, ebx
and edi, 0xff
mov eax, dword [0x48d2e0]
mov eax, dword [eax + edi*4 - 4]
push eax
push ebp
call sub.kernel32.dll__hread
mov dword [esp + 4], eax
push ebp
call sub.kernel32.dll_CloseHandle_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, dword [0x48d2e0]
mov eax, dword [eax + edi*4 - 4]
mov edx, dword [0x48d710]
mov ecx, 0x10
call fcn.0040cd80
test al, al
jne 0x4214f5
mov eax, dword [0x48d2e0]
mov eax, dword [eax + edi*4 - 4]
mov edx, dword [esi + 4]
lea edx, [edx + edx*2]
add edx, 0x10
call fcn.00405a9c
mov eax, dword [0x48d2e0]
mov eax, dword [eax + edi*4 - 4]
mov edx, dword [0x48d710]
mov ecx, 0x10
call fcn.00405a94
jmp 0x42155a
mov eax, dword [esp + 4]
cdq
push edx
push eax
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
add eax, 0x10
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x421516
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x421535
jmp 0x42151a
pop edx
pop eax
jle 0x421535
lea edx, [esp + 0x11c]
mov ax, 2
call fcn.0040de10
push ebp
call sub.kernel32.dll_CloseHandle_1
jmp 0x421871
mov byte [esp + 1], 2
jmp 0x4217a9
cmp byte [esp], 0
je 0x4218cc
mov edx, esi
mov eax, ebx
call fcn.0041f370
test al, al
je 0x4218cc
mov eax, ebx
call fcn.0041e474
lea eax, [esp + 0x1c]
push eax
call sub.kernel32.dll_DeleteFileA_1
push 0
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll__lcreat
mov ebp, eax
mov edi, ebx
and edi, 0xff
mov eax, dword [0x48d250]
mov dword [eax + edi*4 - 4], ebp
xor eax, eax
mov al, bl
mov edx, dword [0x48d250]
cmp ebp, 0xffffffff
jne 0x4215c4
call sub.kernel32.dll_GetLastError_1
call fcn.0040f5f0
mov eax, dword [0x48da44]
mov edx, 1
call fcn.00411d74
lea edx, [esp + 0x1c]
mov ax, 3
call fcn.0040de10
jmp 0x421871
push 0x10
mov eax, dword [0x48d6e0]
push eax
mov eax, dword [0x48d250]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll__hwrite
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemTimeAsFileTime
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
push 8
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x48d250]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll__hwrite
mov eax, dword [0x48d318]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
push 8
mov eax, dword [0x48d318]
push eax
mov eax, dword [0x48d250]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll__hwrite
mov eax, dword [0x48d8b4]
mov byte [eax], 1
mov eax, dword [0x48db2c]
cmp byte [eax], 0
je 0x421647
mov eax, dword [0x48d1d8]
mov byte [eax], 0
mov ax, 0x220
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
mov eax, dword [0x48d948]
xor edx, edx
call fcn.0040e810
mov eax, dword [0x48d2b0]
cmp byte [eax], 0
je 0x421679
mov byte [0x49a60e], 1
xor eax, eax
mov dword [esi + 0x1c], eax
mov edx, esi
mov eax, dword [esi + 0x50]
call fcn.0041ea80
mov ebp, eax
lea eax, [esp + 8]
push eax
push 0
mov ecx, ebp
mov edx, esi
mov eax, ebx
call fcn.00420eb4
test al, al
je 0x4216a5
mov byte [esp + 1], 1
cmp byte [0x49a60e], 0
je 0x4216c7
mov byte [0x49a60e], 0
mov eax, dword [0x49a608]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x49a608], eax
cmp byte [esp + 1], 0
jne 0x4216e0
lea eax, [esp + 0x11c]
push eax
call sub.kernel32.dll_DeleteFileA_1
jmp 0x421871
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, dword [0x48d318]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
push 6
mov eax, dword [0x48d318]
push eax
mov eax, dword [0x48d250]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll__hwrite
mov eax, dword [0x48d250]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
lea eax, [esp + 0x120]
push eax
call sub.kernel32.dll__lcreat
mov ebp, eax
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
add eax, 0x10
push eax
mov eax, dword [0x48d2e0]
mov eax, dword [eax + edi*4 - 4]
push eax
push ebp
call sub.kernel32.dll__hwrite
mov edx, dword [0x48d498]
mov dword [edx], eax
push ebp
call sub.kernel32.dll_CloseHandle_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, dword [0x48d498]
mov eax, dword [eax]
cdq
push edx
push eax
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x421790
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4217a9
jmp 0x421794
pop edx
pop eax
jle 0x4217a9
lea edx, [esp + 0x11c]
mov ax, 3
call fcn.0040de10
jmp 0x421871
lea eax, [esp + 0x1c]
mov ecx, 0x10000000
mov edx, 0x80000000
call fcn.0040eba4
mov ebp, eax
mov edi, ebx
and edi, 0xff
mov eax, dword [0x48d250]
mov dword [eax + edi*4 - 4], ebp
push 0
xor eax, eax
mov al, bl
mov edx, dword [0x48d250]
push ebp
call sub.kernel32.dll_GetFileSize_1
mov edx, dword [0x48d4c0]
mov dword [edx + edi*4 - 4], eax
push 0
push 0
push 0
push 0x8000002
push 0
mov eax, dword [0x48d250]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edx, dword [0x48d2a8]
mov dword [edx + edi*4 - 4], eax
xor eax, eax
mov al, bl
mov edx, dword [0x48d2a8]
cmp dword [edx + eax*4 - 4], 0
jne 0x42183c
lea edx, [esp + 0x1c]
mov ax, 9
call fcn.0040de10
mov eax, dword [0x48d408]
xor edx, edx
mov dword [eax + edi*4 - 4], edx
jmp 0x421871
push 0
push 0
push 0
push 4
xor eax, eax
mov al, bl
mov edx, dword [0x48d2a8]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [0x48d408]
mov dword [edx + edi*4 - 4], eax
call fcn.0040eb04
mov eax, dword [0x48d8b4]
mov byte [eax], 0
jmp 0x4218cc
mov edi, ebx
and edi, 0xff
mov eax, dword [0x48d2e0]
mov eax, dword [eax + edi*4 - 4]
test eax, eax
je 0x4218a8
push 0x4000
mov edx, dword [esi + 4]
add edx, 2
lea edx, [edx + edx*2]
add edx, 0x10
push edx
xor edx, edx
mov dl, bl
mov ecx, dword [0x48d2e0]
push eax
call sub.kernel32.dll_VirtualFree_1
mov eax, dword [0x48d2e0]
xor edx, edx
mov dword [eax + edi*4 - 4], edx
mov eax, esi
call fcn.0041f780
mov eax, dword [0x48d8b4]
mov byte [eax], 0
call fcn.0040eb04
mov byte [esp + 1], 0
mov al, byte [esp + 1]
add esp, 0x21c
pop ebp
pop edi
pop esi
pop ebx
ret