Function at 0x46d1d3
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x512bd4]
and dword [ebp - 0xc], 0
push esi
push edi
mov edi, 0x512bd4
mov ecx, edi
call dword [eax + 0xc]
push dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00413ba8
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.0040103b
mov esi, dword [ebp - 4]
push esi
push ebx
call fcn.0046d44a
test eax, eax
jne 0x46d347
push dword [ebx]
push str.CreateFileByMem_fail:_ws
call fcn.004296d3
push 0
push esi
call fcn.00489e54
add esp, 0x10
test eax, eax
jne 0x46d436
mov eax, dword [0x512bd4]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
push esi
push str._s_d__x
lea eax, [ebp + 8]
call fcn.00421c33
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push dword [ebp + 8]
push esi
call fcn.0048e2f3
test eax, eax
pop ecx
pop ecx
je 0x46d2bb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.MoveFileEx_Rename_file_fail__error:_d
mov esi, 0x514ad4
call fcn.00443ae2
mov esi, 0x4f0b6c
push esi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00413c3b
add esp, 0xc
jmp 0x46d2fb
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
jmp 0x46d436
push dword [ebp + 8]
mov esi, 0x514ad4
push str.MoveFileEx_Rename_file_succeed__path:_ws
call fcn.00443ae2
pop ecx
pop ecx
push 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
push dword [ebp - 4]
push ebx
call fcn.0046d44a
test eax, eax
jne 0x46d33c
mov esi, 0x4f0b6c
push esi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00413c3b
pop ecx
push dword [eax]
push ebx
call fcn.0046d44a
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
cmp dword [ebp - 8], 0
je 0x46d2ab
push esi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00413c3b
pop ecx
push 5
push dword [ebp - 4]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
lea eax, [ebp - 4]
call fcn.0046d891
test eax, eax
je 0x46d42f
mov eax, dword [0x512bd4]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x512bd4]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
lea edi, [ebp - 0x10]
mov dword [ebp + 8], eax
call fcn.0046d918
lea edi, [ebp + 8]
call fcn.004234ea
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
push dword [ebp - 4]
lea eax, [ebp - 0x10]
call fcn.0046d9be
pop ecx
lea edi, [ebp - 8]
call fcn.004234ea
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
call fcn.0046d9ef
test eax, eax
mov esi, dword [ebp - 8]
push str.kisknl64.sys
push esi
je 0x46d3e1
call fcn.0048a14c
test eax, eax
pop ecx
pop ecx
je 0x46d3f9
push str.kisknl.sys
push esi
call fcn.0048a14c
test eax, eax
pop ecx
pop ecx
jne 0x46d3f9
jmp 0x46d41c
call fcn.0048a14c
test eax, eax
pop ecx
pop ecx
je 0x46d41c
push str.kisknl.sys
push esi
call fcn.0048a14c
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00413b36
pop ecx
push dword [eax]
push ebx
call fcn.0046d44a
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
lea eax, [esi - 0x10]
call fcn.00401023
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 4