Function at 0x428c71
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bdc9b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004607e6
test al, al
je 0x428ca9
push eax
bound ebp, qword [edx - 0x4102c3f1]
ja 0x428ceb
in al, 6
or ch, dl
jno 0x428c71
test eax, 0x20868
add byte [ebp - 0x2177b], cl
jmp [edx]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00486960
add esp, 0xc
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x230]
mov word [ebp - 0x230], ax
push eax
push 0x625f30
call fcn.00402510
xor esi, esi
mov dword [ebp - 4], 0
std
push dword [ebx]
test bh, 0x45
cld
add byte [eax], al
add byte [eax], al
push esi
push 0x10
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x428dd4
call fcn.004607e6
test al, al
je 0x428d28
xlatb
push esi
cmp dword [bp + si], ecx
dec edi
jne 0x428d56
inc edx
popfd
cmpsb byte [esi], byte es:[edi]
mov ecx, 0xe8bac641
mov bh, 0x73
add eax, dword [eax]
call fcn.004600e4
test al, al
je 0x428d42
bound edi, qword [edi - 0xc]
fstp qword [edi + 0x2d]
scasd eax, dword es:[edi]
mov al, byte [ebx]
cmc
adc ebx, esp
xor byte [ecx], 0x4e
hlt
call fcn.00460129
test al, al
je 0x428d60
enter 0xffffffffffff8353, 0xffffffffffffffe9
adc bh, bl
shl esp, cl
mov fs, word [eax]
lcall 0x94c4, 0xe9f79d84
dec esp
xchg edx, eax
cld
cmp word [ebp - 0x218], 0
jne 0x428d6e
xor ecx, ecx
jmp 0x428d86
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428d77
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402510
push 1
push 0x625fd4
lea ecx, [ebp - 0x230]
call fcn.00404190
push 8
push 0x5c7818
lea ecx, [ebp - 0x230]
call fcn.00404190
push 4
push 0x5c8470
lea ecx, [ebp - 0x230]
call fcn.00404190
mov esi, 1
push 0
push 0x19
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x428eaa
call fcn.00460579
test al, al
je 0x428e11
ljmp 0xdba5:0x2fc8f875
call fcn.0046082b
test al, al
je 0x428e34
imul esi, ebx, 0x436acfcf
retf 0x53e5
cmp word [ebp - 0x218], 0
jne 0x428e42
xor ecx, ecx
jmp 0x428e5f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428e50
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402510
push 1
push 0x625fd4
lea ecx, [ebp - 0x230]
call fcn.00404190
push 8
push 0x5c7818
lea ecx, [ebp - 0x230]
call fcn.00404190
push 4
push 0x5c8470
lea ecx, [ebp - 0x230]
call fcn.00404190
jmp 0x428eb2
test esi, esi
je 0x428f50
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x428f50
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00460534
test al, al
je 0x428f0b
dec edx
popal
sub eax, 0xb614b76
sahf
sbb byte [edi + ecx*8 + 0x17], 0x94
into
cdq
inc edi
wait
shr dword [edi + 0x63], 0x8e
invalid
call fcn.00460420
test al, al
je 0x428f29
jbe 0x428f40
mov dh, byte [ecx + 0x6409b6e3]
mov esi, esi
in eax, 0xe1
test eax, 0x2a5f41c7
invalid
sub al, ah
shl dword [ecx + 0x26], cl
call fcn.004607a1
test al, al
je 0x428f49
ja 0x428f24
mov es, word [ecx + 0x4816219a]
stc
add al, 0xd1
cdq
mov cl, 0xb8
jmp 0xadf69b99
mov esi, 1
jmp 0x428fb0
call fcn.004606d2
test al, al
je 0x428f6f
adc ebp, dword [ebx + 0x15]
in al, dx
iretd
call fcn.00460465
test al, al
je 0x428f91
and eax, 0x41eece38
jge 0x428f8d
jg 0x428fec
add al, 0x4a
mov edx, 0x4225ae55
pop es
add byte [eax + 0x61], bl
in al, 0x67
cdq
or al, ch
in al, dx
jb 0x428f98
call fcn.00460282
test al, al
add byte [eax + eax*8 + 0x25571474], al
ror cl, 0xe5
syscall
push esp
xlatb
loopne 0x428fbf
je 0x428fae
push edi
and eax, 0xfe5c9c0
add eax, 0x1ae0d754
xlatb
sub dword [esi + 0x74], edx
and byte [edi - 0x2c], dh
jmp 0x8dce85e5
xor esi, esi
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x428fce
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00402610
sar ch, 1
invalid
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret
int3