Function at 0x427910
Capabilities:
Check if file exists
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c056b
mov eax, dword fs:[0]
push eax
sub esp, 0xb60
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0xb58], eax
push ebx
push esi
push edi
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0xb70]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
call fcn.0040fb70
cmp byte [eax + 5], bl
je 0x427966
push eax
call fcn.0040f8a0
push 0x103
lea eax, [esp + 0x441]
push ebx
push eax
mov byte [esp + 0x448], bl
call fcn.00499a30
add esp, 0xc
push 0x103
lea ecx, [esp + 0x231]
push ebx
push ecx
mov byte [esp + 0x238], bl
call fcn.00499a30
add esp, 0xc
push 0x103
lea edx, [esp + 0x339]
push ebx
push edx
mov byte [esp + 0x340], bl
call fcn.00499a30
mov eax, 0x4ed4b8
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4279c5
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push 0x104
sub eax, edx
lea ecx, [esp + 0x448]
push ecx
sar eax, 1
push eax
push 0x4ed4b8
push ebx
push ebx
call esi
mov eax, 0x4ed6c0
lea edx, [eax + 2]
jmp 0x427a00
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x427a00
push ebx
push ebx
push 0x104
sub eax, edx
lea edx, [esp + 0x238]
push edx
sar eax, 1
push eax
push 0x4ed6c0
push ebx
push ebx
call esi
mov eax, 0x4ed8c8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x427a30
push ebx
push ebx
push 0x104
sub eax, edx
lea ecx, [esp + 0x340]
push ecx
sar eax, 1
push eax
push 0x4ed8c8
push ebx
push ebx
call esi
push 0x30b
lea edx, [esp + 0x549]
push ebx
push edx
mov byte [esp + 0x550], bl
call fcn.00499a30
add esp, 0xc
lea edi, [esp + 0x1c]
lea esi, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00454010
call fcn.00427710
cmp eax, ebx
je 0x427aa4
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
jmp 0x427aa9
push str.121.14.102.16
push 0x4d0338
push 0x40
push 0x54e938
call fcn.0049761d
add esp, 0x10
push 0x1bb
push 0x54e938
mov eax, dword [0x4edb44]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, dword [0x4edb40]
push ecx
mov esi, dword [esp + 0x50]
push esi
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
push edi
mov edx, dword [esp + 0x4c]
mov eax, dword [0x4edb3c]
push ebx
push edx
push eax
push 0
mov ecx, dword [0x4edb38]
push 0
mov edx, dword [0x4edb34]
push 0
mov eax, dword [0x4edb30]
push 0
push 0
push ecx
mov ecx, dword [0x4edb2c]
push edx
mov edx, dword [0x4edb08]
push eax
mov eax, dword [0x4edb04]
push ecx
mov ecx, dword [0x4edb00]
push edx
mov edx, dword [0x4edafc]
push eax
mov eax, dword [0x4edaf8]
push ecx
mov ecx, dword [0x4edaf4]
push edx
mov edx, dword [0x4edaf0]
push eax
mov eax, dword [0x4edaec]
push ecx
mov ecx, dword [0x4edae8]
push edx
mov edx, dword [0x4edae4]
push eax
mov eax, dword [0x4edad4]
push ecx
mov ecx, dword [0x4edad0]
push edx
mov edx, dword [0x4edae0]
push eax
mov eax, dword [0x4edadc]
push ecx
mov ecx, dword [0x4edad8]
push edx
push eax
push ecx
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x2d4]
push eax
lea ecx, [esp + 0x4e8]
push ecx
push str.GET__Upload_Data_r_nVERSION:_1__r_nMODULE_ID:_600__r_nCOMM:_s__s__s__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__I64u__I64u__d__d__d__d__d__d__d__d__d__d_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.00__Windows_Xp__r_nHost:__s:_d_r_nCache_Control:_no_cache_r_n_r_n
push 0x30c
lea edx, [esp + 0x5fc]
push edx
call fcn.0049761d
add esp, 0xbc
push 0x30b
lea eax, [esp + 0x859]
push 0
mov dword [esp + 0xb80], 0xffffffff
push eax
mov byte [esp + 0x860], 0
call fcn.00499a30
add esp, 0xc
mov ecx, dword [0x4edb44]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [0x4edb40]
push edx
push esi
push edi
mov eax, dword [esp + 0x44]
mov ecx, dword [0x4edb3c]
push ebx
push eax
push ecx
push 0
mov edx, dword [0x4edb38]
push 0
mov eax, dword [0x4edb34]
push 0
mov ecx, dword [0x4edb30]
push 0
push 0
push edx
mov edx, dword [0x4edb2c]
push eax
mov eax, dword [0x4edb08]
push ecx
mov ecx, dword [0x4edb04]
push edx
mov edx, dword [0x4edb00]
push eax
mov eax, dword [0x4edafc]
push ecx
mov ecx, dword [0x4edaf8]
push edx
mov edx, dword [0x4edaf4]
push eax
mov eax, dword [0x4edaf0]
push ecx
mov ecx, dword [0x4edaec]
push edx
mov edx, dword [0x4edae8]
push eax
mov eax, dword [0x4edae4]
push ecx
mov ecx, dword [0x4edad4]
push edx
mov edx, dword [0x4edad0]
push eax
mov eax, dword [0x4edae0]
push ecx
mov ecx, dword [0x4edadc]
push edx
mov edx, dword [0x4edad8]
push eax
push ecx
push edx
lea eax, [esp + 0x3d0]
push eax
lea ecx, [esp + 0x2cc]
push ecx
lea edx, [esp + 0x4e0]
push edx
push str._s__s__s__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__I64u__I64u__d__d__d__d__d__d__d__d__d__d
push 0x30c
lea eax, [esp + 0x904]
push eax
call fcn.0049761d
add esp, 0xb4
push 1
push 0x1a
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x427e50
lea eax, [esp + 0x24]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427cf0
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x22], 0x5c
lea edx, [esp + 0x24]
jne 0x427d20
push edx
push 0x4d04f8
push 0x208
push 0x104
mov eax, edx
push eax
jmp 0x427d35
lea ecx, [esp + 0x24]
push ecx
push str._sTencentQQInstallPackageDR
push 0x208
push 0x104
push edx
call fcn.00496163
add esp, 0x14
lea ecx, [esp + 0x24]
call fcn.00405010
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [esp + 0x28]
push eax
push str._s_u.dr1
push 0x208
mov ecx, eax
push 0x104
push ecx
call fcn.00496163
add esp, 0x18
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x427d91
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0xb78], 0xffffffff
lea ecx, [esp + 0x24]
push 0x4d0588
push ecx
call fcn.0049736b
mov esi, eax
add esp, 8
test esi, esi
je 0x427e50
mov edx, dword [0x4eac50]
mov eax, dword [edx + 0xc]
mov ecx, 0x4eac50
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x854]
push ecx
push 0x4d0590
lea edi, [esp + 0x1c]
mov dword [esp + 0xb80], 4
call fcn.00428100
add esp, 8
mov edx, edi
push edx
call fcn.00427f40
lea eax, [esp + 0x854]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x427e00
sub eax, edx
push esi
push eax
lea eax, [esp + 0x85c]
push 1
push eax
call fcn.00497223
push esi
call fcn.00497048
mov dword [esp + 0xb8c], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427e50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x544]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x427e60
sub eax, edx
mov ecx, eax
lea edx, [esp + 0x544]
call fcn.004277a0
test eax, eax
jne 0x427ec9
lea eax, [esp + 0x544]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x427e87
sub eax, edx
mov ecx, eax
lea edx, [esp + 0x544]
call fcn.004277a0
test eax, eax
jne 0x427ec9
lea eax, [esp + 0x544]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x427eb0
sub eax, edx
mov ecx, eax
lea edx, [esp + 0x544]
call fcn.004277a0
mov ecx, dword [esp + 0xb70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb58]
xor ecx, esp
call fcn.00495cb8
mov esp, ebp
pop ebp
ret 4