Function at 0x41d2b0
Capabilities:
Check if file exists
Delete file
Get common file path
Get startup folder

Disassembly:
mov esp, ebp
pop ebp
ret 0xc
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddf2b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0045243d
test al, al
je 0x41d304
pop ss
adc byte [ebx - 0x6bdb9850], ah
sbb eax, 0xdf6d3e4
mov ah, 0x4f
cmp ecx, dword [esi + 0x125d77dc]
mov eax, dword [0xb668816b]
adc al, 0xc2
push esi
mov esp, 0x34f0ce8
add byte [eax + eax*8 + 0x20ee2074], al
dec esp
sbb dword fs:[edx + 0x5f85090], eax
js 0x41d34c
call fcn.00452215
test al, al
je 0x41d32d
out dx, al
and byte [esp + 0x19], cl
adc byte [eax + 0x7805f850], 0x33
cmc
mov edx, 0x11194627
pop ecx
outsb dx, byte [esi]
jg 0x41d2a9
adc eax, 0x33d10af0
and al, 0xa1
add byte [esi + 0x2086832], dl
add byte [eax], al
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00480620
add esp, 0xc
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x230]
mov word [ebp - 0x230], ax
push eax
push 0x5e6948
call fcn.00402ac0
xor esi, esi
mov dword [ebp - 4], 0
push esi
push 0x10
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41d42d
add byte [ebx], dh
rol bh, 0x85
loopne 0x41d350
test eax, esp
std
invalid
call fcn.00452596
test al, al
je 0x41d3b2
inc eax
loop 0x41d41b
jl 0x41d39c
je 0x41d3f0
pop esp
hlt
cmp word [ebp - 0x218], 0
jne 0x41d3c0
xor ecx, ecx
jmp 0x41d3df
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d3d0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402ac0
push 1
push 0x5e6bac
lea ecx, [ebp - 0x230]
call fcn.00405c20
push 7
push 0x5e7d48
lea ecx, [ebp - 0x230]
call fcn.00405c20
push 4
push 0x5e89ec
lea ecx, [ebp - 0x230]
call fcn.00405c20
mov esi, 1
invalid
pop esi
add byte [ebp - 0x22f73], cl
invalid
push 0
push 0x19
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41d4da
call fcn.004523f8
test al, al
je 0x41d461
or eax, ecx
mov bl, 0xf9
lodsb al, byte [esi]
sbb ebp, dword [eax + 0x38]
push ss
cmp eax, 0x11
sbb byte [edi - 0x7c99b01b], bh
mov ebp, 0xfffffde8
add byte [ebp + 4], dh
cmp word [ebp - 0x218], 0
jne 0x41d46f
xor ecx, ecx
jmp 0x41d48f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d480
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402ac0
push 1
push 0x5e6bac
lea ecx, [ebp - 0x230]
call fcn.00405c20
push 7
push 0x5e7d48
lea ecx, [ebp - 0x230]
call fcn.00405c20
push 4
push 0x5e89ec
lea ecx, [ebp - 0x230]
call fcn.00405c20
jmp 0x41d4e2
test esi, esi
je 0x41d596
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d596
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0045250c
test al, al
je 0x41d548
cwde
sbb dword [edi - 0x4292ec8e], esp
in eax, 0x89
sub al, byte [ebp + 0x5b]
sub byte [0x5232dca7], 0x65
inc ebx
cmpsb byte [esi], byte es:[edi]
or ebp, dword [ecx - 0x5413c319]
retf 0x224f
call fcn.00451fa8
test al, al
je 0x41d56a
invalid
call fcn.0045225a
test al, al
je 0x41d58f
add byte [edi + ebx*4], dh
invalid
mov esi, 1
jmp 0x41d5e3
call fcn.00452215
test al, al
je 0x41d5ba
ror ecx, cl
jg 0x41d5b9
xchg esi, eax
out dx, eax
dec ecx
xor bh, 0xa7
ja 0x41d602
pop ecx
and byte [ebx - 0x59353853], dl
scasd eax, dword es:[edi]
sbb eax, 0x29d35604
xlatb
pop esp
call fcn.004520bc
test al, al
je 0x41d5e1
mov al, byte [0x302e2b99]
sbb al, byte [edx]
in eax, dx
mov ebp, 0xc9ac31b
aad 0x30
pop esp
stc
outsb dx, byte [esi]
and al, byte [esi + 0x52]
push edi
and eax, 0x5a8a2ae3
jae 0x8c38097b
xor esi, esi
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x41d601
invalid
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00402c10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret
invalid