Function at 0x408770
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40d560
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x1c]
call fcn.0040c9e8
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::CString_2
lea eax, [esi + 0x8c]
push 0x411200
lea ecx, [esp + 0x1c]
mov ebx, 3
push eax
push ecx
mov byte [esp + 0x44], bl
call sub.MFC42.DLL_operator_1
push str.AppList.Sec
lea edx, [esp + 0x18]
push eax
push edx
mov byte [esp + 0x44], 4
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 5
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0xc]
push str..tmp
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 6
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
push 0
push 0x5002
push edx
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CStdioFile::Open
test eax, eax
jne 0x4088ed
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
push eax
push 0x411f7c
push ecx
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esi + 0x60]
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x18], eax
cmp dword [ecx + 0x2c], ebx
jg 0x40889f
mov edx, dword [ecx]
lea esi, [esp + 0x1c]
push esi
push eax
push ebx
call dword [edx]
lea ecx, [esp + 8]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CStdioFile::CStdioFile
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
mov esi, dword [esi + 0xc8]
test esi, esi
je 0x40893a
mov eax, esi
mov esi, dword [esi]
add eax, 8
lea ecx, [esp + 0x14]
push eax
call fcn.0040c9c4
push 0x41110c
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 7
call fcn.0040c9dc
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CStdioFile::WriteString
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CString::CString
test esi, esi
jne 0x4088f7
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CStdioFile::Close
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push str.WhiteListPWD
push ecx
push edx
call fcn.0040a020
mov eax, dword [esp + 0x14]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 8]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CStdioFile::CStdioFile
mov ecx, dword [esp + 0x30]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret