Function at 0x4a5da8
Capabilities:
Delete file
Get file size
Read file via mapping

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffddc
mov esi, ecx
mov byte [esp], dl
mov ebx, eax
mov byte [esp + 1], 0
mov byte [esp + 0x11], 0
mov eax, dword [0x4beb20]
cmp byte [eax], 0
jne 0x4a63b0
mov eax, dword [0x4bebcc]
cmp byte [eax], 0
jne 0x4a63b0
cmp byte [esp], 0
jne 0x4a5dfa
xor eax, eax
mov al, bl
mov edx, dword [0x4be5f4]
cmp dword [edx + eax*4 - 4], 0
jne 0x4a63b0
cmp byte [esp], 0
je 0x4a5e07
mov eax, esi
call fcn.004a381c
lea ecx, [esp + 0x124]
lea edx, [esp + 0x24]
mov eax, ebx
call fcn.004a1ee4
mov ebp, dword [esi + 4]
shl ebp, 2
add ebp, 0x10
cmp byte [esp], 0
jne 0x4a5f86
lea eax, [esp + 0x24]
call fcn.004b1914
test al, al
je 0x4a5f86
lea eax, [esp + 0x124]
call fcn.004b1914
test al, al
je 0x4a5f86
lea eax, [esp + 0x124]
call fcn.004b22dc
cdq
push edx
push eax
mov eax, ebp
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4a5e6d
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4a5f86
mov edx, esi
mov eax, ebx
call fcn.004a33b0
test al, al
je 0x4a63b0
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
lea eax, [esp + 0x124]
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.004adc9c
mov dword [esp + 4], eax
push ebp
xor eax, eax
mov al, bl
mov edx, dword [0x4be48c]
mov eax, dword [edx + eax*4 - 4]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll__hread
mov edi, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
xor eax, eax
mov al, bl
mov edx, dword [0x4be48c]
mov eax, dword [edx + eax*4 - 4]
mov edx, dword [0x4be9b8]
mov ecx, 0x10
call fcn.004ab7fc
test al, al
jne 0x4a5f41
xor eax, eax
mov al, bl
mov edx, dword [0x4be48c]
mov eax, dword [edx + eax*4 - 4]
mov edx, ebp
call fcn.004066e4
xor eax, eax
mov al, bl
mov edx, dword [0x4be48c]
mov eax, dword [edx + eax*4 - 4]
mov edx, dword [0x4be9b8]
mov ecx, 0x10
call fcn.004066dc
jmp 0x4a5f97
mov eax, edi
cdq
push edx
push eax
mov eax, ebp
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4a5f59
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4a5f7c
jmp 0x4a5f5d
pop edx
pop eax
jle 0x4a5f7c
lea edx, [esp + 0x124]
mov ax, 2
call fcn.004acdac
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4a6311
mov byte [esp + 1], 2
jmp 0x4a61ea
mov edx, esi
mov eax, ebx
call fcn.004a33b0
test al, al
je 0x4a63b0
mov eax, ebx
call fcn.004a1fac
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_DeleteFileA_1
push 0
lea eax, [esp + 0x28]
push eax
call sub.kernel32.dll__lcreat
mov edi, ebx
and edi, 0xff
mov edx, dword [0x4be3d4]
mov dword [edx + edi*4 - 4], eax
xor eax, eax
mov al, bl
mov edx, dword [0x4be3d4]
cmp dword [edx + eax*4 - 4], 0xffffffff
jne 0x4a6002
call sub.kernel32.dll_GetLastError_1
call fcn.004ae200
mov eax, dword [0x4bedb0]
mov edx, 1
call fcn.004b12a8
lea edx, [esp + 0x24]
mov ax, 3
call fcn.004acdac
jmp 0x4a6311
push 0x10
mov eax, dword [0x4be978]
push eax
mov eax, dword [0x4be3d4]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll__hwrite
lea eax, [esp + 0x14]
push eax
call sub.kernel32.dll_GetSystemTimeAsFileTime
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
push 8
lea eax, [esp + 0x20]
push eax
mov eax, dword [0x4be3d4]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll__hwrite
mov eax, dword [0x4be4c4]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
push 8
mov eax, dword [0x4be4c4]
push eax
mov eax, dword [0x4be3d4]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll__hwrite
mov eax, dword [0x4bebcc]
mov byte [eax], 1
mov eax, dword [0x4beecc]
cmp byte [eax], 0
je 0x4a6085
mov eax, dword [0x4be344]
mov byte [eax], 0
mov ax, 0x220
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4bec98]
call fcn.004b81b0
mov eax, dword [0x4bec98]
xor edx, edx
call fcn.004ad8ec
mov byte [esp + 0x11], 1
mov eax, dword [0x4be450]
cmp byte [eax], 0
je 0x4a60bc
mov byte [0x4c254e], 1
mov edx, esi
mov eax, dword [esi + 0x6c]
call fcn.004a25d8
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push 0
mov ecx, dword [esp + 0x14]
mov edx, esi
mov eax, ebx
call fcn.004a5800
test al, al
je 0x4a60e7
mov byte [esp + 1], 1
cmp byte [0x4c254e], 0
je 0x4a6109
mov byte [0x4c254e], 0
mov eax, dword [0x4c2548]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x4c2548], eax
cmp byte [esp + 1], 0
jne 0x4a6122
lea eax, [esp + 0x124]
push eax
call sub.kernel32.dll_DeleteFileA_1
jmp 0x4a6311
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, dword [0x4be344]
mov byte [eax], 0x64
call fcn.004b5c48
mov eax, dword [0x4be4c4]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
push 6
mov eax, dword [0x4be4c4]
push eax
mov eax, dword [0x4be3d4]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll__hwrite
mov eax, dword [0x4be3d4]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
lea eax, [esp + 0x128]
push eax
call sub.kernel32.dll__lcreat
mov dword [esp + 4], eax
push ebp
mov eax, dword [0x4be48c]
mov eax, dword [eax + edi*4 - 4]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll__hwrite
mov edi, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, edi
cdq
push edx
push eax
mov eax, ebp
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4a61d1
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4a61ea
jmp 0x4a61d5
pop edx
pop eax
jle 0x4a61ea
lea edx, [esp + 0x124]
mov ax, 3
call fcn.004acdac
jmp 0x4a6311
lea eax, [esp + 0x24]
mov ecx, 0x10000000
mov edx, 0x80000000
call fcn.004adc9c
mov edi, ebx
and edi, 0xff
mov edx, dword [0x4be3d4]
mov dword [edx + edi*4 - 4], eax
push 0
xor eax, eax
mov al, bl
mov edx, dword [0x4be3d4]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
mov edx, dword [0x4be6f0]
mov dword [edx + edi*4 - 4], eax
push 0
push 0
push 0
push 0x8000002
push 0
mov eax, dword [0x4be3d4]
mov eax, dword [eax + edi*4 - 4]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edx, dword [0x4be440]
mov dword [edx + edi*4 - 4], eax
xor eax, eax
mov al, bl
mov edx, dword [0x4be440]
cmp dword [edx + eax*4 - 4], 0
jne 0x4a6283
lea edx, [esp + 0x24]
mov ax, 9
call fcn.004acdac
mov eax, dword [0x4be5f4]
xor edx, edx
mov dword [eax + edi*4 - 4], edx
jmp 0x4a6311
push 0
push 0
push 0
push 4
xor eax, eax
mov al, bl
mov edx, dword [0x4be440]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [0x4be5f4]
mov dword [edx + edi*4 - 4], eax
cmp dword [esi + 0x60], 0
jne 0x4a62f8
mov eax, ebx
call fcn.004ab84c
push 0x4a63c0
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0
mov eax, dword [0x4bedb0]
mov ecx, esi
mov edx, ebx
call fcn.004a5098
mov edx, dword [0x4be7b0]
mov dword [edx], eax
mov eax, dword [0x4be7b0]
mov eax, dword [eax]
mov edx, esi
call fcn.004a25d8
mov dword [esi + 0x60], eax
cmp byte [esp + 0x11], 0
je 0x4a6304
call fcn.004adbe0
mov eax, dword [0x4bebcc]
mov byte [eax], 0
jmp 0x4a63b0
mov edi, ebx
and edi, 0xff
mov eax, dword [0x4be48c]
mov eax, dword [eax + edi*4 - 4]
test eax, eax
je 0x4a633c
push 0x4000
push ebp
xor edx, edx
mov dl, bl
mov ecx, dword [0x4be48c]
push eax
call sub.kernel32.dll_VirtualFree_1
mov eax, dword [0x4be48c]
xor edx, edx
mov dword [eax + edi*4 - 4], edx
mov edi, ebx
and edi, 0xff
mov eax, dword [0x4be3d4]
mov eax, dword [eax + edi*4 - 4]
cmp eax, 0xffffffff
je 0x4a6390
xor edx, edx
mov dl, bl
mov ecx, dword [0x4be3d4]
test eax, eax
je 0x4a6390
xor edx, edx
mov dl, bl
mov ecx, dword [0x4be3d4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4be3d4]
xor edx, edx
mov dword [eax + edi*4 - 4], edx
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, esi
call fcn.004a381c
mov eax, dword [0x4bebcc]
mov byte [eax], 0
cmp byte [esp + 0x11], 0
je 0x4a63ab
call fcn.004adbe0
mov byte [esp + 1], 0
mov al, byte [esp + 1]
add esp, 0x224
pop ebp
pop edi
pop esi
pop ebx
ret