Function at 0x402ef0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407fd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6a0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 1
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24]
push eax
push str._s.
push ecx
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CFileFind::CFileFind
mov edx, dword [ebp - 0x24]
push 0
push edx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CFileFind::FindFile
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x58]
test eax, eax
je 0x403439
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CFileFind::GetFileName
mov eax, dword [eax]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push str..______
push eax
mov byte [ebp - 4], 3
call esi
add esp, 8
test eax, eax
je 0x402fcc
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CFileFind::GetFileName
mov eax, dword [eax]
push 0x40bc60
push eax
call esi
add esp, 8
lea ecx, [ebp - 0x3c]
test eax, eax
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x402fce
mov bl, 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
test bl, bl
jne 0x402f65
mov edx, dword [ebp - 0x58]
push 0x10
lea ecx, [ebp - 0x58]
call dword [edx + 0x40]
test eax, eax
je 0x40302c
mov eax, dword [ebp - 0x28]
push ecx
test eax, eax
jne 0x40300f
mov eax, esp
mov dword [ebp - 0x34], esp
push eax
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CFileFind::GetFilePath
mov ecx, edi
call fcn.00402ef0
jmp 0x402f65
mov ecx, esp
mov dword [ebp - 0x34], esp
push ecx
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CFileFind::GetFilePath
mov ecx, edi
call fcn.00402ef0
mov dword [ebp - 0x28], eax
jmp 0x402f65
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x58]
push edx
call sub.MFC42.DLL_CFileFind::GetFileName
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x58]
push eax
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CFileFind::GetFilePath
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x3a8]
push ecx
push edx
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CFile::GetStatus
mov al, byte [ebp - 0x398]
cmp al, 1
je 0x40306a
cmp al, 0x21
jne 0x403081
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x3a8]
push eax
push ecx
mov byte [ebp - 0x398], 0
call sub.MFC42.DLL_CFile::SetStatus
lea ecx, [ebp - 0x74]
call sub.MFC42.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
mov edi, dword [ebp - 0x20]
mov byte [ebp - 4], 7
mov esi, str.ntmACC.exe
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4030bf
test cl, cl
je 0x4030bb
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4030bf
add eax, 2
add esi, 2
test cl, cl
jne 0x403097
xor eax, eax
jmp 0x4030c4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403228
mov esi, str.ntmGuard.exe
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4030fb
test cl, cl
je 0x4030f7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4030fb
add eax, 2
add esi, 2
test cl, cl
jne 0x4030d3
xor eax, eax
jmp 0x403100
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403228
mov esi, str.ntmSCMon.exe
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x403137
test cl, cl
je 0x403133
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x403137
add eax, 2
add esi, 2
test cl, cl
jne 0x40310f
xor eax, eax
jmp 0x40313c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403228
mov esi, str.nnlogon.exe
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x403173
test cl, cl
je 0x40316f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x403173
add eax, 2
add esi, 2
test cl, cl
jne 0x40314b
xor eax, eax
jmp 0x403178
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403228
mov esi, str.iewindow.exe
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4031af
test cl, cl
je 0x4031ab
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4031af
add eax, 2
add esi, 2
test cl, cl
jne 0x403187
xor eax, eax
jmp 0x4031b4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403228
mov esi, str.GS_Client.exe
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4031e7
test cl, cl
je 0x4031e3
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4031e7
add eax, 2
add esi, 2
test cl, cl
jne 0x4031bf
xor eax, eax
jmp 0x4031ec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403228
mov esi, str.gwtray.exe
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40321f
test cl, cl
je 0x40321b
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40321f
add eax, 2
add esi, 2
test cl, cl
jne 0x4031f7
xor eax, eax
jmp 0x403224
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403249
xor esi, esi
cmp esi, 5
jge 0x40323e
mov ecx, dword [ebp - 0x2c]
push edi
call fcn.00402ab0
mov edi, dword [ebp - 0x20]
inc esi
jmp 0x40322a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x18]
push eax
call sub.MFC42.DLL_CFile::Remove
mov dword [ebp - 4], 5
call sub.MFC42.DLL_AfxTryCleanup
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
mov edi, dword [ebp - 0x2c]
jmp 0x402f65
call sub.MFC42.DLL_CFileFind::Close
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.004078a8
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4