Function at 0x402870
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
sub esp, 0x18
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebp
call fcn.00402760
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x1c], ebx
jne 0x402899
pop ebp
pop ebx
add esp, 0x18
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
push ebx
call fcn.0040341e
push str.Sophos
mov esi, eax
call fcn.0040341e
add esp, 8
add esi, eax
je 0x402915
lea eax, [esi + esi + 2]
push eax
call fcn.0040340c
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [esp + 0x18], edi
je 0x402915
push 0x40a284
push edi
call fcn.00402e08
push ebx
push edi
call fcn.00402dde
push str.Sophos
push edi
call fcn.00402dde
add esp, 0x18
push edi
call fcn.0040341e
push str.Sophos_Anti_Rootkit
mov esi, eax
call fcn.0040341e
add esp, 8
add esi, eax
jne 0x402932
mov dword [esp + 0x20], ebp
mov dword [esp + 0x10], 8
jmp 0x402ad1
push ebx
mov dword [esp + 0x14], 8
call fcn.00402da6
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea ecx, [esi + esi + 2]
push ecx
call fcn.0040340c
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x402965
push 0x40a284
push ebx
call fcn.00402e08
push edi
push ebx
call fcn.00402dde
push str.Sophos_Anti_Rootkit
push ebx
call fcn.00402dde
add esp, 0x18
cmp ebx, ebp
mov dword [esp + 0x20], ebx
jne 0x40297a
mov dword [esp + 0x10], 8
jmp 0x402ad1
mov al, byte [esp + 0x2c]
test al, al
je 0x4029eb
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebp
push edi
call esi
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4029af
call ebp
cmp eax, 0xb7
mov dword [esp + 0x10], eax
jne 0x402ad1
mov dword [esp + 0x10], 0
push 0
push ebx
call esi
test eax, eax
jne 0x4029d1
call ebp
cmp eax, 0xb7
mov dword [esp + 0x10], eax
jne 0x402ad1
mov dword [esp + 0x10], 0
call fcn.00402120
test eax, eax
mov dword [esp + 0x14], eax
jne 0x4029eb
mov dword [esp + 0x10], 8
jmp 0x402ac0
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp dword [str.Sophos_Anti_Rootkit.lnk], esi
mov dword [esp + 0x1c], esi
je 0x402aa6
mov eax, 0x40a570
lea esp, [esp]
mov edx, dword [eax]
push edx
push 0x40a3f4
push ebx
call fcn.00402190
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x402a83
mov al, byte [esp + 0x2c]
test al, al
je 0x402b04
mov eax, dword [esi + 0x40a574]
mov ecx, dword [esp + 0x14]
push eax
push 0x40a3f4
push ecx
call fcn.00402190
mov edi, eax
add esp, 0xc
test edi, edi
je 0x402a76
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x40a578]
push 0
push 0
push 0
push edx
push eax
push 0
push ebp
push edi
call fcn.00402bd0
push edi
call fcn.00402da6
add esp, 0x24
mov edi, dword [esp + 0x18]
push ebp
call fcn.00402da6
add esp, 4
mov esi, dword [esp + 0x1c]
inc esi
mov dword [esp + 0x1c], esi
lea esi, [esi + esi*2]
shl esi, 2
mov ecx, dword [esi + 0x40a570]
test ecx, ecx
lea eax, [esi + 0x40a570]
jne 0x402a10
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, byte [esp + 0x2c]
test al, al
jne 0x402ac0
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
call esi
push edi
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x402ad1
push eax
call fcn.00402da6
add esp, 4
push edi
call fcn.00402da6
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x402aeb
push eax
call fcn.00402da6
add esp, 4
mov ebx, dword [esp + 0x24]
push ebx
call fcn.00402da6
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x402a7a