Function at 0x41d340
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e790b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00453ae6
test al, al
je 0x41d394
rol byte [ebx - 0x3481eba3], 1
jns 0x41d3dd
sal byte [edx - 0x15], 0xca
mov al, 0x92
mov edx, 0x696cda36
stosd dword es:[edi], eax
pop eax
invalid
call fcn.004538be
test al, al
je 0x41d3bd
mov eax, 0x72c4fd39
jl 0x41d3d1
invalid
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x21c], 7
les ecx, [edi + eax*8]
test esp, esp
std
invalid
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x230]
mov word [ebp - 0x230], ax
push eax
push 0x5e9978
call fcn.00402b90
xor esi, esi
mov dword [ebp - 4], 0
push esi
push 0x10
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41d4bd
call fcn.00453c3f
test al, al
je 0x41d442
js 0x41d438
sti
stc
mov byte [0x9735ce59], al
rcr dword [esi + 0x780daa44], cl
sar dword [ebp + 0x17ef04c2], 1
stosb byte es:[edi], al
or eax, 0xc2bdd178
add al, 0xef
pop ss
push ss
cmp word [ebp - 0x218], 0
jne 0x41d450
xor ecx, ecx
jmp 0x41d46f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d460
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402b90
push 1
push 0x5e9bd4
lea ecx, [ebp - 0x230]
call fcn.00405d30
push 7
push 0x5ead78
lea ecx, [ebp - 0x230]
call fcn.00405d30
push 4
push 0x5eba1c
lea ecx, [ebp - 0x230]
call fcn.00405d30
mov esi, 1
push 0
push 0x19
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41d56a
call fcn.00453aa1
test al, al
je 0x41d4f1
push 0x343a96d7
jg 0x41d4bd
lds ebp, [eax - 0x31]
xor eax, 0xa9991626
imul esp, dword [esi - 0x7d], 0xfffde8bd
inc dword [eax]
cmp word [ebp - 0x218], 0
jne 0x41d4ff
xor ecx, ecx
jmp 0x41d51f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d510
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402b90
push 1
push 0x5e9bd4
lea ecx, [ebp - 0x230]
call fcn.00405d30
push 7
push 0x5ead78
lea ecx, [ebp - 0x230]
call fcn.00405d30
push 4
push 0x5eba1c
lea ecx, [ebp - 0x230]
call fcn.00405d30
jmp 0x41d572
test esi, esi
je 0x41d626
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d626
xchg ebx, eax
pop esi
add byte [ebp - 0x6e7bf040], al
add byte [eax], al
add byte [ebx - 0x21b43], al
dec dword [eax]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00453bb5
test al, al
je 0x41d5d8
lodsb al, byte [esi]
arpl bp, si
mov ah, 0xb3
ror cl, cl
aaa
and esp, ecx
sub ah, byte [edi + ebp*4 + 0x55]
xor al, 0x11
jo 0x41d58a
push ecx
insb byte es:[edi], dx
arpl word [edx + ebx + 0x8d725e9], ax
wait
shr dword [ebx - 0x18], cl
je 0x41d63b
call fcn.00453651
add eax, dword [eax]
test al, al
je 0x41d5fa
and edi, dword [edx - 0x1f]
mov esi, 0x51cdcd06
mov cl, 0xc5
bound edi, qword [ecx - 0x1a46b4c5]
and ah, byte [edx + 0x3a92f6f1]
and dword [ecx + edi + 0x36304e8], esi
add byte [eax + eax*8 + 0x32021c74], al
call fcn.00453903
test al, al
je 0x41d61f
add dh, byte [edx]
out 0x6b, eax
push eax
push ecx
sub dword [edx], 0x13
sal dword [ecx - 0x47b1349c], 1
adc byte [edi - 0x3d], al
sal dword [ecx + 0x2d302725], 0x5c
popal
dec esp
xchg edi, eax
mov cl, 0x64
retf
mov esi, 1
jmp 0x41d673
call fcn.004538be
test al, al
je 0x41d64a
je 0x41d60d
ror byte [ecx - 5], 1
stosd dword es:[edi], eax
ja 0x41d687
repz ret 0x4bdb
dec ebx
dec ecx
push esi
add eax, 0x50170b03
int3
call fcn.00453765
test al, al
je 0x41d671
and bl, 0x14
loop 0x41d6c2
aad 0xdd
and dword [eax + 0x50], ebp
aaa
mov dl, 0x96
retf 0x1946
xor esi, esi
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x41d691
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00402ce0
invalid
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret
in al, dx
xor byte [eax + eax], al
add byte [ecx + 0x678390], ah