Function at 0x4b9b00
Capabilities:
Access peb ldr_data
Copy file
Delete file
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a65a0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 0x2fc]
lea edi, [ecx + 0x2fc]
cmp esi, edi
je 0x4b9e0d
test esi, esi
je 0x4b9e0d
test edx, edx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xb0]
mov dword [esp + 0x10], eax
je 0x4b9b64
push 0
push edx
jmp 0x4b9e06
lea edx, [eax - 0xc8]
cmp edx, 0xcc
ja case.0x4b9b7d.201
movzx edx, byte [edx + 0x4b9e34]
jmp dword [edx*4 + 0x4b9e24]
lea ecx, [esp + 0x10]
call fcn.00404530
push str.Last_Modified
add ebx, 0x88
mov dword [esp + 0x24], 0
call fcn.004090f0
test eax, eax
je 0x4b9bb5
mov ebx, dword [eax + 4]
lea eax, [esp + 0x10]
call fcn.0040a090
mov eax, dword [esi + 0x10]
cmp dword [eax - 0xc], 0
jle 0x4b9bd0
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
push ecx
push eax
add edx, 0x2f0
push edx
jmp 0x4b9c0c
mov eax, dword [esi + 0x24]
test eax, eax
jbe 0x4b9bf4
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x1c]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push edx
mov edx, dword [ebp + 8]
add edx, 0x2f0
call fcn.004b7990
jmp 0x4b9c14
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x144]
push eax
mov eax, dword [ebp + 8]
push edx
add eax, 0x2f0
push eax
mov ecx, dword [esi + 0xc]
call fcn.004b7580
mov ecx, dword [edi]
mov eax, dword [ecx]
mov dword [edi], eax
mov dword [eax + 4], edi
mov eax, esi
call fcn.004b6660
test eax, eax
mov ecx, dword [esi + 8]
push 0xc8
push 0
je 0x4b9c3f
mov edx, dword [ecx]
mov eax, dword [esi + 0xc]
mov edx, dword [edx + 0x34]
push eax
call edx
jmp 0x4b9c64
mov edi, dword [ebp + 0xc]
mov edx, dword [edi + 0x144]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
push edx
mov edx, dword [esi + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x144]
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.004ae440
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
call fcn.004b93c0
lea ecx, [esp + 0x10]
call fcn.00404510
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x10]
cmp dword [eax - 0xc], 0
jg 0x4b9e0d
cmp dword [esi + 0x24], 0
ja 0x4b9e0d
mov eax, dword [esi + 0xc]
push eax
add ecx, 0x2f0
push ecx
call fcn.004b7dc0
mov eax, dword [ebx + 0x144]
sub eax, 0x10
call fcn.00403ce0
lea ebx, [eax + 0x10]
mov dword [esp + 0x10], ebx
push ebx
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x14]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4b9cf1
xor eax, eax
jmp 0x4b9cfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4b9cfe
or eax, 0xffffffff
mov ecx, dword [edi]
mov ecx, dword [ecx]
mov dword [edi], ecx
mov dword [ecx + 4], edi
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
mov edx, eax
neg edx
sbb edx, edx
not edx
and edx, ebx
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffffff38
add ecx, 0xc8
push ecx
mov ecx, dword [esi + 8]
push eax
mov eax, dword [edi + 0x30]
push edx
mov edx, dword [esi + 0xc]
push edx
call eax
mov ecx, dword [ebp + 8]
push ebx
push ecx
call fcn.004ae440
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
call fcn.004b93c0
lea ecx, [esp + 0x10]
call fcn.00404510
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
mov eax, dword [ecx]
mov dword [edi], eax
mov dword [eax + 4], edi
mov eax, esi
call fcn.004b6660
test eax, eax
je 0x4b9dbb
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x34]
push eax
mov eax, dword [esi + 0xc]
push 0
push eax
call edx
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
call fcn.004b93c0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
push eax
mov eax, dword [esi + 0xc]
push 0
push 0
push eax
call edx
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
call fcn.004b93c0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
push 0xffffffffffffffff
mov edi, ecx
call fcn.004b9780
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8