Function at 0x428680
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x154], 1
cmp dword [ebp + 8], 0
jne 0x4286bf
push 0x48d748
push str._s_spool_temp.tif
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4286dd
mov ecx, dword [ebp + 8]
push ecx
push 0x48d748
push str._s_spool_temp_d.tif
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x370]
push eax
lea ecx, [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0xffffffff
je 0x4287db
cmp dword [ebp - 0x154], 0
je 0x4287db
movsx edx, byte [ebp - 0x344]
cmp edx, 0x2e
je 0x4287bc
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x164]
push edx
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp dword [ebp + 8], 0
jne 0x428772
push 5
lea edx, [ebp - 0x164]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.00428950
add esp, 0xc
test eax, eax
je 0x4287bc
lea ecx, [ebp - 0x344]
push ecx
push 0x48d748
push str._s_spool_temp_s
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4287bc
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x370]
push edx
mov eax, dword [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x154], eax
jmp 0x4286f7
mov ecx, dword [ebp - 0x374]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
jne 0x42880a
push 0x48d748
push str._s_spoollogs.tif
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x428828
mov eax, dword [ebp + 8]
push eax
push 0x48d748
push str._s_spoollogs_d.tif
lea ecx, [ebp - 0x148]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x370]
push edx
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0xffffffff
je 0x428926
cmp dword [ebp - 0x154], 0
je 0x428926
movsx ecx, byte [ebp - 0x344]
cmp ecx, 0x2e
je 0x428907
lea edx, [ebp - 0x150]
push edx
lea eax, [ebp - 0x36c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x164]
push ecx
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp dword [ebp + 8], 0
jne 0x4288bd
push 5
lea ecx, [ebp - 0x164]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.00428950
add esp, 0xc
test eax, eax
je 0x428907
lea eax, [ebp - 0x344]
push eax
push 0x48d748
push str._s_spoollogs_s
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x428907
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x370]
push ecx
mov edx, dword [ebp - 0x374]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x154], eax
jmp 0x428842
mov eax, dword [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret