Function at 0x465aa1
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x28
mov eax, 0x4e0837
call fcn.004b51ee
mov edi, ecx
mov ebx, dword [ebp + 8]
cmp ebx, 1
je 0x465ac8
cmp ebx, 2
je 0x465ac8
cmp ebx, 3
je 0x465ac8
xor eax, eax
jmp 0x465d04
xor esi, esi
cmp dword [edi + 8], esi
jne 0x465adb
call fcn.00465a63
mov dword [edi + 8], 1
lea ecx, [ebp - 0x34]
mov dword [edi], esi
mov dword [edi + 4], esi
call fcn.00456104
mov dword [ebp - 4], esi
mov esi, 0x50ea0c
push esi
lea ecx, [ebp - 0x10]
call fcn.0044bc85
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp + 8]
call fcn.0044bc85
mov byte [ebp - 4], 2
cmp ebx, 1
jne 0x465bc1
lea eax, [ebp - 0x18]
push eax
call fcn.004659da
pop ecx
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x10]
call fcn.004453ce
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0040d610
lea eax, [ebp - 0x1c]
push eax
call fcn.004655ce
mov byte [ebp - 4], 4
mov dword [esp], str.savapi_
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp + 8]
call fcn.004453ce
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18]
call fcn.0040d610
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.0040d610
lea eax, [ebp - 0x1c]
push eax
call fcn.00465946
mov byte [ebp - 4], 6
mov dword [esp], str.AviraImp.dll
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.0040d610
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
call fcn.0045af0d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
jmp 0x465c54
cmp ebx, 3
jne 0x465bed
lea eax, [ebp - 0x1c]
push eax
call fcn.00465549
mov byte [ebp - 4], 9
mov dword [esp], str.AVEkpb.def
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 0xb
jmp 0x465ba1
cmp ebx, 2
jne 0x465c59
lea eax, [ebp - 0x1c]
push eax
call fcn.00465990
pop ecx
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x10]
call fcn.004453ce
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0040d610
lea eax, [ebp - 0x18]
push eax
call fcn.004655ce
mov byte [ebp - 4], 0xd
mov dword [esp], 0x4fc740
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp + 8]
call fcn.004453ce
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c]
call fcn.0040d610
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.0040d610
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x465c7f
push eax
call esi
test eax, eax
je 0x465c7f
push edi
push ebx
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp - 0x10]
call fcn.00465720
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x465c9e
push eax
call esi
test eax, eax
je 0x465c9e
push edi
push 1
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.00465720
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
sar eax, 2
cmp eax, ebx
jbe 0x465cde
xor esi, esi
cmp eax, ebx
jbe 0x465cde
push esi
lea ecx, [ebp - 0x34]
call fcn.0047e29b
push dword [eax]
cmp dword [ebp + 0xc], ebx
je 0x465cca
mov ecx, edi
call fcn.004654ad
jmp 0x465cd0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
inc esi
sar eax, 2
cmp esi, eax
jb 0x465cb1
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0040d610
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00452f5d
xor eax, eax
inc eax
call fcn.004b52c6
ret 8