Function at 0x406f40
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bd95
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x438040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, edx
mov dword [ebp - 0x38], eax
mov esi, ecx
test esi, esi
je 0x406fbf
test eax, eax
je 0x406fbf
cmp word [esi], 0
je 0x406fbf
cmp word [eax], 0
je 0x406fbf
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x34], eax
test eax, eax
js 0x406fbf
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00401320
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004072a0
test al, al
jne 0x406fd3
lea ecx, [ebp - 0x24]
call fcn.00401300
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [ebp - 0x20]
call fcn.004031f0
lea ecx, [ebp - 0x30]
call fcn.00401320
push 0x5c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.004077f0
lea ecx, [ebp - 0x20]
test eax, eax
je 0x407009
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004075e0
mov byte [ebp - 4], 4
jmp 0x407025
push 0x2f
call fcn.004077f0
test eax, eax
je 0x407036
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x20]
call fcn.004075e0
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x30]
call fcn.00403180
lea ecx, [ebp - 0x3c]
call fcn.00401300
mov dword [ebp - 0x1c], 0
sub esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
call fcn.00407470
mov dword [ebp - 0x34], eax
test eax, eax
js 0x40725b
mov eax, dword [ebp - 0x1c]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
mov dword [ebp - 0x34], ebx
test ebx, ebx
js 0x40726c
mov ecx, dword [ebp - 0x30]
cmp dword [ecx - 0xc], 0
je 0x407086
mov eax, dword [ebp - 0x1c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x24]
mov ebx, eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x2c], eax
test ecx, ecx
je 0x4070ae
mov eax, dword [ecx]
lea edx, [ebp - 0x2c]
push edx
push 0x434138
push ecx
call dword [eax]
test eax, eax
jns 0x4070ab
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x4070ae
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 7
test eax, eax
je 0x40727d
lea ecx, [ebp - 0x28]
call fcn.00401320
lea ecx, [ebp - 0x18]
call fcn.00401320
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 9
test edi, edi
je 0x407112
cmp word [edi], 0
je 0x407112
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x28]
push edi
push esi
push str._s_s
push eax
call fcn.00407c20
add esp, 0x10
lea eax, [ebp - 0x18]
push dword [ebp - 0x38]
push edi
push esi
push str._s_s_s.lnk
push eax
call fcn.00407c20
add esp, 0x14
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40714d
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x28]
push esi
push 0x434030
push eax
call fcn.00407c20
add esp, 0xc
lea eax, [ebp - 0x18]
push dword [ebp - 0x38]
push esi
push str._s_s.lnk
push eax
call fcn.00407c20
add esp, 0x10
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x4071ce
cmp word [edi], 0
je 0x4071ce
mov esi, dword [ebp - 0x28]
lea ecx, [esi - 0x10]
call fcn.00401350
add eax, 0x10
mov dword [ebp - 0x38], eax
push str.Desktop.ini
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xa
call fcn.00407820
mov ecx, dword [ebp - 0x38]
call fcn.00405850
test al, al
je 0x4071b4
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push esi
lea ecx, [ebp - 0x11]
call fcn.00405dc0
cmp dword [ebp - 0x3c], 1
jne 0x4071b4
cmp dword [esi - 0xc], 3
jle 0x4071b4
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, esi
call fcn.00405d20
mov ecx, esi
call fcn.00401a60
test al, al
je 0x4071c6
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x38]
call fcn.00401300
lea ecx, [ebp - 0x18]
call fcn.00401300
lea ecx, [ebp - 0x28]
call fcn.00401300
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4071ef
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x407200
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x30]
call fcn.00401300
lea ecx, [ebp - 0x20]
call fcn.00401300
lea ecx, [ebp - 0x24]
call fcn.00401300
call dword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push 0x436a70
push eax
call fcn.004118ea
push 0x436a70
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
call fcn.004118ea
push 0x436a70
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x80004005
push eax
call fcn.004118ea
int3