Function at 0x40f140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4207ac
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x42e024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x423638
lea edx, [ebx + 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.00404f90
push 0x42eb78
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x160]
call fcn.00406350
add esp, 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x164]
cmp eax, 0x10
jb 0x40f1bf
inc eax
push eax
push dword [ebp - 0x178]
call fcn.00404770
cmp dword [0x42eb8c], 0x10
mov esi, 0x42eb78
mov eax, esi
mov dword [ebp - 0x164], 0xf
cmovae eax, dword [0x42eb78]
push eax
push str.Deleting__s
push str.stealth_manager
mov dword [ebp - 0x168], 0
mov byte [ebp - 0x178], 0
call fcn.00402620
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x160]
add esp, 0xc
cmp dword [ebp - 0x14c], 0x10
cmovae eax, dword [ebp - 0x160]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f266
test al, 0x10
je 0x40f266
cmp dword [ebp - 0x14c], 0x10
lea ecx, [ebp - 0x160]
cmovae ecx, dword [ebp - 0x160]
call fcn.0040a790
test eax, eax
jne 0x40f266
cmp dword [0x42eb8c], 0x10
cmovae esi, dword [0x42eb78]
push esi
push str.Successfully_deleted__s
push str.stealth_manager
call fcn.00402620
add esp, 0xc
push 0x423638
lea edx, [ebx + 0x58]
lea ecx, [ebp - 0x28]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp + 0x1c], 0
jbe 0x40f295
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.004045b0
jmp 0x40f2da
push 0x423638
mov edx, 0x42ea70
lea ecx, [ebp - 0x178]
call fcn.00404f90
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.004045b0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x164]
cmp eax, 0x10
jb 0x40f2da
inc eax
push eax
push dword [ebp - 0x178]
call fcn.00404770
push str.temp
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x148]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 6
lea eax, [ebp - 0x148]
cmp dword [ebp - 0x134], 0x10
cmovae eax, dword [ebp - 0x148]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f358
test al, 0x10
je 0x40f358
cmp dword [ebp - 0x134], 0x10
lea ecx, [ebp - 0x148]
cmovae ecx, dword [ebp - 0x148]
call fcn.0040aa30
test eax, eax
jne 0x40f345
push str.Successfully_deleted_temp_folder
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f358
push eax
push str.Delete_temp_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push 0x42768c
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x130]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 7
lea eax, [ebp - 0x130]
cmp dword [ebp - 0x11c], 0x10
cmovae eax, dword [ebp - 0x130]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f3d6
test al, 0x10
je 0x40f3d6
cmp dword [ebp - 0x11c], 0x10
lea ecx, [ebp - 0x130]
cmovae ecx, dword [ebp - 0x130]
call fcn.0040aa30
test eax, eax
jne 0x40f3c3
push str.Successfully_deleted_extensions_folder
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f3d6
push eax
push str.Delete_extensions_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.libs
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x118]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 8
lea eax, [ebp - 0x118]
cmp dword [ebp - 0x104], 0x10
cmovae eax, dword [ebp - 0x118]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f454
test al, 0x10
je 0x40f454
cmp dword [ebp - 0x104], 0x10
lea ecx, [ebp - 0x118]
cmovae ecx, dword [ebp - 0x118]
call fcn.0040aa30
test eax, eax
jne 0x40f441
push str.Successfully_deleted_libs_folder
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f454
push eax
push str.Delete_libs_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.logs
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x100]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 9
lea eax, [ebp - 0x100]
cmp dword [ebp - 0xec], 0x10
cmovae eax, dword [ebp - 0x100]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f4d2
test al, 0x10
je 0x40f4d2
cmp dword [ebp - 0xec], 0x10
lea ecx, [ebp - 0x100]
cmovae ecx, dword [ebp - 0x100]
call fcn.0040a790
test eax, eax
jne 0x40f4bf
push str.Successfully_deleted_logs_folder
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f4d2
push eax
push str.Delete_logs_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.inst.dat
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xe8]
call fcn.00404f90
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x190]
cmp dword [ebp - 0xd4], 0x10
lea eax, [ebp - 0xe8]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
cmovae eax, dword [ebp - 0xe8]
push ecx
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40f558
cmp dword [ebp - 0xd4], 0x10
lea ecx, [ebp - 0xe8]
cmovae ecx, dword [ebp - 0xe8]
call fcn.0040a430
test eax, eax
jne 0x40f545
push str.Successfully_delete_inst.dat
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f558
push eax
push str.Delete_inst.dat_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.shutdown.dat
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xd0]
call fcn.00404f90
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x190]
cmp dword [ebp - 0xbc], 0x10
lea eax, [ebp - 0xd0]
push ecx
cmovae eax, dword [ebp - 0xd0]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40f5d8
cmp dword [ebp - 0xbc], 0x10
lea ecx, [ebp - 0xd0]
cmovae ecx, dword [ebp - 0xd0]
call fcn.0040a430
test eax, eax
jne 0x40f5c5
push str.Successfully_delete_shutdown.dat
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f5d8
push eax
push str.Delete_shutdown.dat_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.get_drop_files.exe
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xb8]
call fcn.00404f90
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x190]
cmp dword [ebp - 0xa4], 0x10
lea eax, [ebp - 0xb8]
push ecx
cmovae eax, dword [ebp - 0xb8]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40f658
cmp dword [ebp - 0xa4], 0x10
lea ecx, [ebp - 0xb8]
cmovae ecx, dword [ebp - 0xb8]
call fcn.0040a430
test eax, eax
jne 0x40f645
push str.Successfully_delete_get_drop_files.exe
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f658
push eax
push str.Delete_get_drop_files.exe_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.pwmgr
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xa0]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0xa0]
cmp dword [ebp - 0x8c], 0x10
cmovae eax, dword [ebp - 0xa0]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f6d6
test al, 0x10
je 0x40f6d6
cmp dword [ebp - 0x8c], 0x10
lea ecx, [ebp - 0xa0]
cmovae ecx, dword [ebp - 0xa0]
call fcn.0040a790
test eax, eax
jne 0x40f6c3
push str.Successfully_deleted_genie_folder
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f6d6
push eax
push str.Delete_genie_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.driver
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x88]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x88]
cmp dword [ebp - 0x74], 0x10
cmovae eax, dword [ebp - 0x88]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f74e
test al, 0x10
je 0x40f74e
cmp dword [ebp - 0x74], 0x10
lea ecx, [ebp - 0x88]
cmovae ecx, dword [ebp - 0x88]
call fcn.0040a790
test eax, eax
jne 0x40f73b
push str.Successfully_deleted_driver_folder
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f74e
push eax
push str.Delete_driver_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.images
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x70]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 0x10
cmovae eax, dword [ebp - 0x70]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f7b7
test al, 0x10
je 0x40f7b7
cmp dword [ebp - 0x5c], 0x10
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
call fcn.0040a790
test eax, eax
jne 0x40f7a4
push str.Successfully_deleted_images_folder
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f7b7
push eax
push str.Delete_images_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.nfdrive
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 0x10
cmovae eax, dword [ebp - 0x58]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f820
test al, 0x10
je 0x40f820
cmp dword [ebp - 0x44], 0x10
lea ecx, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x58]
call fcn.0040a790
test eax, eax
jne 0x40f80d
push str.Successfully_deleted_nf_driver_folder
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f820
push eax
push str.Delete_nf_driver_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push 0x427960
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae eax, dword [ebp - 0x40]
push eax
call edi
cmp eax, 0xffffffff
je 0x40f889
test al, 0x10
je 0x40f889
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
call fcn.0040a790
test eax, eax
jne 0x40f876
push str.Successfully_deleted_nf_nss_folder
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f889
push eax
push str.Delete_nf_nss_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.ProtocolFilters.dll
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x178]
call fcn.00404f90
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x40f8a7
mov eax, dword [eax]
mov ecx, eax
call fcn.0040a430
mov ecx, dword [ebp - 0x164]
mov esi, eax
cmp ecx, 0x10
jb 0x40f8c8
inc ecx
push ecx
push dword [ebp - 0x178]
call fcn.00404770
test esi, esi
jne 0x40f8e0
push str.Successfully_deleted_nf_proto
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f8f3
push esi
push str.Delete_nf_proto_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
push str.libprotobuf_lite.dll
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x178]
call fcn.00404f90
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x40f911
mov eax, dword [eax]
mov ecx, eax
call fcn.0040a430
mov ecx, dword [ebp - 0x164]
mov esi, eax
cmp ecx, 0x10
jb 0x40f932
inc ecx
push ecx
push dword [ebp - 0x178]
call fcn.00404770
test esi, esi
jne 0x40f94a
push str.Successfully_deleted_protobuf
push str.stealth_manager
call fcn.00402620
add esp, 8
jmp 0x40f95d
push esi
push str.Delete_protobuf_failed_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
mov eax, dword [ebx]
mov edx, eax
mov ecx, dword [eax + 4]
cmp byte [ecx + 0xd], 0
jne 0x40f985
nop word [eax + eax]
cmp dword [ecx + 0x10], 6
jge 0x40f97b
mov ecx, dword [ecx + 8]
jmp 0x40f97f
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x40f970
cmp edx, eax
je 0x40f98f
cmp dword [edx + 0x10], 6
jle 0x40f991
mov edx, eax
cmp edx, eax
je 0x40fa4f
lea eax, [ebp - 0x194]
mov dword [ebp - 0x194], 6
push eax
lea eax, [ebp - 0x19c]
mov ecx, ebx
push eax
call fcn.004162e0
mov eax, dword [ebp - 0x19c]
add eax, 0x14
cmp dword [eax + 0x14], 0x10
jb 0x40f9c9
mov eax, dword [eax]
push eax
push str.stealth_manager
call fcn.00402620
add esp, 8
mov dword [ebp - 0x194], 6
lea eax, [ebp - 0x194]
mov ecx, ebx
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.004162e0
mov ecx, dword [ebp - 0x19c]
add ecx, 0x14
cmp dword [ecx + 0x14], 0x10
jb 0x40fa07
mov ecx, dword [ecx]
call fcn.0040a790
lea eax, [ebp - 0x194]
mov dword [ebp - 0x194], 6
push eax
lea eax, [ebp - 0x19c]
mov ecx, ebx
push eax
call fcn.004162e0
mov eax, dword [ebp - 0x19c]
add eax, 0x14
cmp dword [eax + 0x14], 0x10
jb 0x40fa3c
mov eax, dword [eax]
push eax
push str.Successfully_deleted__s
push str.stealth_manager
call fcn.00402620
add esp, 0xc
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x40fa61
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00404770
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
cmp eax, 0x10
jb 0x40fa85
inc eax
push eax
push dword [ebp - 0x58]
call fcn.00404770
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
cmp eax, 0x10
jb 0x40faa9
inc eax
push eax
push dword [ebp - 0x70]
call fcn.00404770
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
cmp eax, 0x10
jb 0x40fad0
inc eax
push eax
push dword [ebp - 0x88]
call fcn.00404770
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x74], 0xf
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x88], 0
cmp eax, 0x10
jb 0x40fafd
inc eax
push eax
push dword [ebp - 0xa0]
call fcn.00404770
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], 0
mov byte [ebp - 0xa0], 0
cmp eax, 0x10
jb 0x40fb30
inc eax
push eax
push dword [ebp - 0xb8]
call fcn.00404770
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0xb8], 0
cmp eax, 0x10
jb 0x40fb63
inc eax
push eax
push dword [ebp - 0xd0]
call fcn.00404770
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xbc], 0xf
mov dword [ebp - 0xc0], 0
mov byte [ebp - 0xd0], 0
cmp eax, 0x10
jb 0x40fb96
inc eax
push eax
push dword [ebp - 0xe8]
call fcn.00404770
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xd4], 0xf
mov dword [ebp - 0xd8], 0
mov byte [ebp - 0xe8], 0
cmp eax, 0x10
jb 0x40fbc9
inc eax
push eax
push dword [ebp - 0x100]
call fcn.00404770
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xec], 0xf
mov dword [ebp - 0xf0], 0
mov byte [ebp - 0x100], 0
cmp eax, 0x10
jb 0x40fbfc
inc eax
push eax
push dword [ebp - 0x118]
call fcn.00404770
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x104], 0xf
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x118], 0
cmp eax, 0x10
jb 0x40fc2f
inc eax
push eax
push dword [ebp - 0x130]
call fcn.00404770
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
cmp eax, 0x10
jb 0x40fc62
inc eax
push eax
push dword [ebp - 0x148]
call fcn.00404770
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x134], 0xf
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x148], 0
cmp eax, 0x10
jb 0x40fc8f
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00404770
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, 0x10
jb 0x40fcb9
inc eax
push eax
push dword [ebp - 0x160]
call fcn.00404770
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14c], 0xf
mov dword [ebp - 0x150], 0
mov byte [ebp - 0x160], 0
cmp eax, 0x10
jb 0x40fce6
inc eax
push eax
push dword [ebp + 0xc]
call fcn.00404770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e02b
mov esp, ebp
pop ebp
ret 0x1c