Function at 0x428070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x487c08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
mov eax, dword [0x4b47a8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jle 0x428343
add eax, 0xfffffff0
push eax
call fcn.00406990
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x494704
push str.RECYCLER88MICROSOFT_7701091_6666888_16826688..___com8.21EC2020_3AEA_1069_A2DD_08002B30309Dlocal_
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x4c], 0
call fcn.00424cf0
push 0x494704
push str.RECYCLER88MICROSOFT_7701091_6666888_16826688.___com8.21EC2020_3AEA_1069_A2DD_08002B30309Dlocal_
lea ecx, [esp + 0x1c]
push ecx
call fcn.00424cf0
push 0x494704
push str.RECYCLER88MICROSOFT_7701091_6666888_16826688...___com8.21EC2020_3AEA_1069_A2DD_08002B30309Dlocal_
lea edx, [esp + 0x1c]
push edx
call fcn.00424cf0
push 0x494704
push str.RECYCLERMICROSOFT_7701091_6666888_16826688.___com8.21EC2020_3AEA_1069_A2DD_08002B30309Dlocal_
lea eax, [esp + 0x1c]
push eax
call fcn.00424cf0
push 0x494704
push str.RECYCLERMICROSOFT_7701091_6666888_16826688..___com8.21EC2020_3AEA_1069_A2DD_08002B30309Dlocal_
lea ecx, [esp + 0x1c]
push ecx
call fcn.00424cf0
push 0x494704
push str.Computer.F_77_01_091_606666888_1682526688_1708537768_1009Z_H_JYJ_760921_011113_3000.com8local_
lea edx, [esp + 0x1c]
push edx
call fcn.00424cf0
push 0x494704
push str.RECYCLER88MICROS1___com8.21EC2020_3AEA_1069_A2DD_08002B30309Dlocal_
lea eax, [esp + 0x1c]
push eax
call fcn.00424cf0
push 0x494704
push str.RECYCLER88MICROS2___com8.21EC2020_3AEA_1069_A2DD_08002B30309Dlocal_
lea ecx, [esp + 0x1c]
push ecx
call fcn.00424cf0
push 0x494704
push str.RECYCLER88MICROS3___com8.21EC2020_3AEA_1069_A2DD_08002B30309Dlocal_
lea edx, [esp + 0x1c]
push edx
call fcn.00424cf0
push 0x494704
push str.RECYCLERMICROS1___com8.21EC2020_3AEA_1069_A2DD_08002B30309Dlocal_
lea eax, [esp + 0x1c]
push eax
call fcn.00424cf0
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42831f
test al, 0x10
je 0x42831f
lea ecx, [esp + 0x20]
call fcn.004503c0
mov byte [esp + 0x40], 1
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.00406990
add eax, 0x10
add esp, 4
mov dword [esp + 0x18], eax
push 1
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 2
call fcn.0040a000
mov eax, dword [eax]
push 0x494a8c
push eax
call fcn.00469714
add esp, 8
test eax, eax
mov eax, dword [esp + 0x1c]
setne bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x428216
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x428228
push 0x494a8c
lea ecx, [esp + 0x1c]
call fcn.00409fc0
push 3
push 0x494a90
lea ecx, [esp + 0x20]
call fcn.0040a140
push str.Computer..F_77_01_091_606666888_1682526688_1708537768_1009Z_H_JYJ_760921_011113_3000..com8local_
push 0x499f48
lea ecx, [esp + 0x20]
push ecx
call fcn.00424cf0
push str.MICROSOFT_7701091_6666888_16826688.._
push str.MICROSOFT_7701091_6666888_16826688._
lea edx, [esp + 0x20]
push edx
call fcn.00424cf0
mov ebx, dword [esp + 0x18]
push 0
push ebx
lea ecx, [esp + 0x28]
call fcn.0045044c
test eax, eax
je 0x4282ab
lea ecx, [esp + 0x20]
call fcn.00450251
mov esi, eax
mov eax, dword [esp + 0x20]
mov edx, dword [eax + 0x38]
push 0x10
lea ecx, [esp + 0x24]
call edx
test eax, eax
jne 0x4282a7
lea ecx, [esp + 0x20]
call fcn.00450387
test eax, eax
jne 0x4282a7
add dword [edi], 1
cmp dword [edi], 4
jge 0x4282ab
test esi, esi
jne 0x428274
lea ecx, [esp + 0x20]
call fcn.00450181
lea eax, [ebx - 0x10]
mov byte [esp + 0x40], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4282d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 0
call fcn.004503e4
lea eax, [ebp - 0x10]
mov dword [esp + 0x40], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428307
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea eax, [ebp - 0x10]
mov dword [esp + 0x40], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428343
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x34
ret