Function at 0x46ac7d
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x50e594]
and dword [ebp - 0xc], 0
push esi
push edi
mov edi, 0x50e594
mov ecx, edi
call dword [eax + 0xc]
push dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.004152cd
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.0040103b
mov esi, dword [ebp - 4]
push esi
push ebx
call fcn.0046aef4
test eax, eax
jne 0x46adf1
push dword [ebx]
push str.CreateFileByMem_fail:_ws
call fcn.0042ac5c
push 0
push esi
call fcn.004876c4
add esp, 0x10
test eax, eax
jne 0x46aee0
mov eax, dword [0x50e594]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
push esi
push str._s_d__x
lea eax, [ebp + 8]
call fcn.0042318c
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push dword [ebp + 8]
push esi
call fcn.0048bb63
test eax, eax
pop ecx
pop ecx
je 0x46ad65
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.MoveFileEx_Rename_file_fail__error:_d
mov esi, 0x51049c
call fcn.004452e2
mov esi, 0x4edb6c
push esi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00415360
add esp, 0xc
jmp 0x46ada5
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
jmp 0x46aee0
push dword [ebp + 8]
mov esi, 0x51049c
push str.MoveFileEx_Rename_file_succeed__path:_ws
call fcn.004452e2
pop ecx
pop ecx
push 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
push dword [ebp - 4]
push ebx
call fcn.0046aef4
test eax, eax
jne 0x46ade6
mov esi, 0x4edb6c
push esi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00415360
pop ecx
push dword [eax]
push ebx
call fcn.0046aef4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
cmp dword [ebp - 8], 0
je 0x46ad55
push esi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00415360
pop ecx
push 5
push dword [ebp - 4]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
lea eax, [ebp - 4]
call fcn.0046b388
test eax, eax
je 0x46aed9
mov eax, dword [0x50e594]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x50e594]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
lea edi, [ebp - 0x10]
mov dword [ebp + 8], eax
call fcn.0046b40f
lea edi, [ebp + 8]
call fcn.00424a4a
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
push dword [ebp - 4]
lea eax, [ebp - 0x10]
call fcn.0046b4b5
pop ecx
lea edi, [ebp - 8]
call fcn.00424a4a
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
call fcn.0046b4e6
test eax, eax
mov esi, dword [ebp - 8]
push str.kisknl64.sys
push esi
je 0x46ae8b
call fcn.004879bc
test eax, eax
pop ecx
pop ecx
je 0x46aea3
push str.kisknl.sys
push esi
call fcn.004879bc
test eax, eax
pop ecx
pop ecx
jne 0x46aea3
jmp 0x46aec6
call fcn.004879bc
test eax, eax
pop ecx
pop ecx
je 0x46aec6
push str.kisknl.sys
push esi
call fcn.004879bc
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0041525c
pop ecx
push dword [eax]
push ebx
call fcn.0046aef4
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
lea eax, [esi - 0x10]
call fcn.00401023
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 4