Function at 0x464d60
Capabilities:
Delete file
Get thread local storage value

Disassembly:
mov eax, dword [0x5296dc]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x464d82
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
ret
mov ecx, dword [esi + 0x45e2]
cmp ecx, 0xffffffff
jne 0x464db0
cmp word [esi + 0x45ea], di
je 0x464db0
mov edx, dword [esi + 0x45ee]
mov eax, dword [esi + 0x45f2]
mov dword [esi + 0x4558], edx
mov dword [esi + 0x455c], eax
jmp 0x464dbc
mov dword [esi + 0x4558], ecx
mov dword [esi + 0x455c], edi
mov eax, dword [esi + 0x45de]
cmp eax, 0xffffffff
jne 0x464e08
cmp word [esi + 0x45ea], di
je 0x464e08
cmp ecx, eax
je 0x464dee
mov ecx, dword [esi + 0x45ee]
mov edx, dword [esi + 0x45f2]
mov dword [esi + 0x4550], ecx
mov dword [esi + 0x4554], edx
jmp 0x464e14
mov eax, dword [esi + 0x45f6]
mov ecx, dword [esi + 0x45fa]
mov dword [esi + 0x4550], eax
mov dword [esi + 0x4554], ecx
jmp 0x464e14
mov dword [esi + 0x4550], eax
mov dword [esi + 0x4554], edi
cmp dword [esi + 0x54], edi
jne 0x464f1f
mov al, byte [esi + 0x45d2]
mov bl, 8
test bl, al
je 0x464ed7
mov ecx, dword [esi + 0x4e98]
mov edx, dword [esi + 0x4e90]
cmp ecx, 0xffffffff
mov dword [esi + 0x45da], edx
jne 0x464e67
cmp word [esi + 0x45ea], di
je 0x464e67
mov eax, dword [esi + 0x4eb2]
mov edx, dword [esi + 0x4eb6]
mov dword [esi + 0x4558], eax
mov dword [esi + 0x455c], edx
jmp 0x464e79
mov dword [esi + 0x4558], ecx
mov dword [esi + 0x45e2], ecx
mov dword [esi + 0x455c], edi
mov eax, dword [esi + 0x4e94]
cmp eax, 0xffffffff
jne 0x464ec5
cmp word [esi + 0x45ea], di
je 0x464ec5
cmp ecx, eax
je 0x464eab
mov eax, dword [esi + 0x4eb2]
mov ecx, dword [esi + 0x4eb6]
mov dword [esi + 0x4550], eax
mov dword [esi + 0x4554], ecx
jmp 0x464ed7
mov edx, dword [esi + 0x4eba]
mov eax, dword [esi + 0x4ebe]
mov dword [esi + 0x4550], edx
mov dword [esi + 0x4554], eax
jmp 0x464ed7
mov dword [esi + 0x4550], eax
mov dword [esi + 0x45de], eax
mov dword [esi + 0x4554], edi
push esi
call fcn.0046bbf0
xor ecx, ecx
xor ebp, ebp
mov cx, word [esi + 0x45e8]
mov bp, word [esi + 0x45e6]
push edi
lea ecx, [ecx + ebp + 0x1e]
xor ebp, ebp
add ecx, eax
adc ebp, edx
mov edx, dword [esi + 0x14fa8]
push ebp
push ecx
push edx
call fcn.0046e720
mov al, byte [esi + 0x4ea6]
add esp, 0x14
test bl, al
je 0x464f1f
pop edi
pop esi
pop ebp
mov eax, 0x2e
pop ebx
ret
mov eax, dword [esi + 0x4eec]
mov dword [esi + 0x14f98], edi
cmp eax, edi
je 0x464f3c
call fcn.00464ce0
cmp eax, edi
jne 0x464fdf
mov eax, dword [esi + 0x3d30]
mov ebp, dword [esp + 0x14]
cmp eax, edi
jne 0x464fe4
cmp dword [esi + 0x4c], edi
jne 0x464fe4
cmp dword [esi + 0x54], edi
jne 0x464fe4
push ebp
call fcn.0046d550
mov ebx, eax
add esp, 4
cmp ebx, edi
jne 0x464f7e
call fcn.0046e7e0
mov ebx, eax
cmp ebx, edi
jne 0x464f7e
cmp dword [esi], edi
je 0x464fdd
mov eax, dword [esi + 0x14fa8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x464f9c
push eax
call edi
mov dword [esi + 0x14fa8], 0xffffffff
mov eax, dword [esi + 0x16808]
cmp eax, 0xffffffff
je 0x464fb4
push eax
call edi
mov dword [esi + 0x16808], 0xffffffff
mov eax, dword [esi + 0x3d30]
test eax, eax
jne 0x464fdd
mov eax, dword [esi + 0x4c]
test eax, eax
jne 0x464fdd
mov eax, dword [esi + 0x54]
test eax, eax
jne 0x464fdd
mov eax, dword [esi + 0x3d34]
test eax, eax
jne 0x464fdd
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x16808], 0xffffffff
jmp 0x464f6f