Function at 0x46ae0f
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x509500]
and dword [ebp - 0xc], 0
push esi
push edi
mov edi, 0x509500
mov ecx, edi
call dword [eax + 0xc]
push dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00414fa4
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.0040103b
mov esi, dword [ebp - 4]
push esi
push ebx
call fcn.0046b086
test eax, eax
jne 0x46af83
push dword [ebx]
push str.CreateFileByMem_fail:_ws
call fcn.0042a6ea
push 0
push esi
call fcn.00483a77
add esp, 0x10
test eax, eax
jne 0x46b072
mov eax, dword [0x509500]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
push esi
push str._s_d__x
lea eax, [ebp + 8]
call fcn.00422cb5
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push dword [ebp + 8]
push esi
call fcn.00486e2b
test eax, eax
pop ecx
pop ecx
je 0x46aef7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.MoveFileEx_Rename_file_fail__error:_d
mov esi, 0x50b3f4
call fcn.00445464
mov esi, 0x4e96b4
push esi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00415037
add esp, 0xc
jmp 0x46af37
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
jmp 0x46b072
push dword [ebp + 8]
mov esi, 0x50b3f4
push str.MoveFileEx_Rename_file_succeed__path:_ws
call fcn.00445464
pop ecx
pop ecx
push 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
push dword [ebp - 4]
push ebx
call fcn.0046b086
test eax, eax
jne 0x46af78
mov esi, 0x4e96b4
push esi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00415037
pop ecx
push dword [eax]
push ebx
call fcn.0046b086
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
cmp dword [ebp - 8], 0
je 0x46aee7
push esi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00415037
pop ecx
push 5
push dword [ebp - 4]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
lea eax, [ebp - 4]
call fcn.0046b557
test eax, eax
je 0x46b06b
mov eax, dword [0x509500]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x509500]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
lea edi, [ebp - 0x10]
mov dword [ebp + 8], eax
call fcn.0046b5de
lea edi, [ebp + 8]
call fcn.0042454d
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
push dword [ebp - 4]
lea eax, [ebp - 0x10]
call fcn.0046b684
pop ecx
lea edi, [ebp - 8]
call fcn.0042454d
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
call fcn.0046b6b5
test eax, eax
mov esi, dword [ebp - 8]
push str.kisknl64.sys
push esi
je 0x46b01d
call fcn.00483df2
test eax, eax
pop ecx
pop ecx
je 0x46b035
push str.kisknl.sys
push esi
call fcn.00483df2
test eax, eax
pop ecx
pop ecx
jne 0x46b035
jmp 0x46b058
call fcn.00483df2
test eax, eax
pop ecx
pop ecx
je 0x46b058
push str.kisknl.sys
push esi
call fcn.00483df2
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00414f25
pop ecx
push dword [eax]
push ebx
call fcn.0046b086
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
lea eax, [esi - 0x10]
call fcn.00401023
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 4