Function at 0x40d240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b8dc
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x194], eax
push 0x42192c
lea edx, [eax + 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.00404af0
push 0x428988
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x160]
call fcn.00404c00
add esp, 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x164]
cmp eax, 0x10
jb 0x40d2c5
inc eax
push eax
push dword [ebp - 0x178]
call fcn.00402b40
cmp dword [0x42899c], 0x10
mov esi, 0x428988
mov eax, esi
mov dword [ebp - 0x164], 0xf
cmovae eax, dword [0x428988]
push eax
push str.Deleting__s
push str.stealth_manager
mov dword [ebp - 0x168], 0
mov byte [ebp - 0x178], 0
call fcn.00402320
mov bl, byte [ebp + 8]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test bl, bl
je 0x40d373
cmp dword [ebp - 0x14c], 0x10
lea eax, [ebp - 0x160]
cmovae eax, dword [ebp - 0x160]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d373
test al, 0x10
je 0x40d373
cmp dword [ebp - 0x14c], 0x10
lea ecx, [ebp - 0x160]
cmovae ecx, dword [ebp - 0x160]
call fcn.0040aae0
test eax, eax
jne 0x40d373
cmp dword [0x42899c], 0x10
cmovae esi, dword [0x428988]
push esi
push str.Successfully_deleted__s
push str.stealth_manager
call fcn.00402320
add esp, 0xc
mov edx, dword [ebp - 0x194]
lea ecx, [ebp - 0x28]
push 0x42192c
add edx, 0x58
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp + 0x1c], 0
jbe 0x40d3a8
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.004029f0
jmp 0x40d3ed
push 0x42192c
mov edx, 0x428880
lea ecx, [ebp - 0x178]
call fcn.00404af0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.004029f0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x164]
cmp eax, 0x10
jb 0x40d3ed
inc eax
push eax
push dword [ebp - 0x178]
call fcn.00402b40
push str.temp
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x148]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 6
test bl, bl
je 0x40d46f
cmp dword [ebp - 0x134], 0x10
lea eax, [ebp - 0x148]
cmovae eax, dword [ebp - 0x148]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d46f
test al, 0x10
je 0x40d46f
cmp dword [ebp - 0x134], 0x10
lea ecx, [ebp - 0x148]
cmovae ecx, dword [ebp - 0x148]
call fcn.0040ad80
test eax, eax
jne 0x40d45c
push str.Successfully_deleted_temp_folder
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d46f
push eax
push str.Delete_temp_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push 0x422280
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x130]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 7
test bl, bl
je 0x40d4f1
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
cmovae eax, dword [ebp - 0x130]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d4f1
test al, 0x10
je 0x40d4f1
cmp dword [ebp - 0x11c], 0x10
lea ecx, [ebp - 0x130]
cmovae ecx, dword [ebp - 0x130]
call fcn.0040ad80
test eax, eax
jne 0x40d4de
push str.Successfully_deleted_extensions_folder
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d4f1
push eax
push str.Delete_extensions_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.libs
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x118]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 8
test bl, bl
je 0x40d573
cmp dword [ebp - 0x104], 0x10
lea eax, [ebp - 0x118]
cmovae eax, dword [ebp - 0x118]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d573
test al, 0x10
je 0x40d573
cmp dword [ebp - 0x104], 0x10
lea ecx, [ebp - 0x118]
cmovae ecx, dword [ebp - 0x118]
call fcn.0040ad80
test eax, eax
jne 0x40d560
push str.Successfully_deleted_libs_folder
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d573
push eax
push str.Delete_libs_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.logs
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x100]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 9
test bl, bl
je 0x40d5f5
cmp dword [ebp - 0xec], 0x10
lea eax, [ebp - 0x100]
cmovae eax, dword [ebp - 0x100]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d5f5
test al, 0x10
je 0x40d5f5
cmp dword [ebp - 0xec], 0x10
lea ecx, [ebp - 0x100]
cmovae ecx, dword [ebp - 0x100]
call fcn.0040aae0
test eax, eax
jne 0x40d5e2
push str.Successfully_deleted_logs_folder
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d5f5
push eax
push str.Delete_logs_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.inst.dat
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xe8]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 0xa
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test bl, bl
je 0x40d682
cmp dword [ebp - 0xd4], 0x10
lea ecx, [ebp - 0x190]
lea eax, [ebp - 0xe8]
cmovae eax, dword [ebp - 0xe8]
push ecx
push eax
call esi
add esp, 8
test eax, eax
jne 0x40d682
cmp dword [ebp - 0xd4], 0x10
lea ecx, [ebp - 0xe8]
cmovae ecx, dword [ebp - 0xe8]
call fcn.0040a780
test eax, eax
jne 0x40d66f
push str.Successfully_delete_inst.dat
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d682
push eax
push str.Delete_inst.dat_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.shutdown.dat
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xd0]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 0xb
test bl, bl
je 0x40d709
cmp dword [ebp - 0xbc], 0x10
lea ecx, [ebp - 0x190]
lea eax, [ebp - 0xd0]
cmovae eax, dword [ebp - 0xd0]
push ecx
push eax
call esi
add esp, 8
test eax, eax
jne 0x40d709
cmp dword [ebp - 0xbc], 0x10
lea ecx, [ebp - 0xd0]
cmovae ecx, dword [ebp - 0xd0]
call fcn.0040a780
test eax, eax
jne 0x40d6f6
push str.Successfully_delete_shutdown.dat
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d709
push eax
push str.Delete_shutdown.dat_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.get_drop_files.exe
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xb8]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 0xc
test bl, bl
je 0x40d790
cmp dword [ebp - 0xa4], 0x10
lea ecx, [ebp - 0x190]
lea eax, [ebp - 0xb8]
cmovae eax, dword [ebp - 0xb8]
push ecx
push eax
call esi
add esp, 8
test eax, eax
jne 0x40d790
cmp dword [ebp - 0xa4], 0x10
lea ecx, [ebp - 0xb8]
cmovae ecx, dword [ebp - 0xb8]
call fcn.0040a780
test eax, eax
jne 0x40d77d
push str.Successfully_delete_get_drop_files.exe
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d790
push eax
push str.Delete_get_drop_files.exe_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.pwmgr
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xa0]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 0xd
test bl, bl
je 0x40d812
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
cmovae eax, dword [ebp - 0xa0]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d812
test al, 0x10
je 0x40d812
cmp dword [ebp - 0x8c], 0x10
lea ecx, [ebp - 0xa0]
cmovae ecx, dword [ebp - 0xa0]
call fcn.0040aae0
test eax, eax
jne 0x40d7ff
push str.Successfully_deleted_genie_folder
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d812
push eax
push str.Delete_genie_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.driver
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x88]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 0xe
test bl, bl
je 0x40d88e
cmp dword [ebp - 0x74], 0x10
lea eax, [ebp - 0x88]
cmovae eax, dword [ebp - 0x88]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d88e
test al, 0x10
je 0x40d88e
cmp dword [ebp - 0x74], 0x10
lea ecx, [ebp - 0x88]
cmovae ecx, dword [ebp - 0x88]
call fcn.0040aae0
test eax, eax
jne 0x40d87b
push str.Successfully_deleted_driver_folder
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d88e
push eax
push str.Delete_driver_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.images
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x70]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 0xf
test bl, bl
je 0x40d8fb
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d8fb
test al, 0x10
je 0x40d8fb
cmp dword [ebp - 0x5c], 0x10
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
call fcn.0040aae0
test eax, eax
jne 0x40d8e8
push str.Successfully_deleted_images_folder
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d8fb
push eax
push str.Delete_images_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.nfdrive
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 0x10
test bl, bl
je 0x40d968
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d968
test al, 0x10
je 0x40d968
cmp dword [ebp - 0x44], 0x10
lea ecx, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x58]
call fcn.0040aae0
test eax, eax
jne 0x40d955
push str.Successfully_deleted_nf_driver_folder
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d968
push eax
push str.Delete_nf_driver_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push 0x422570
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00404af0
add esp, 4
mov byte [ebp - 4], 0x11
test bl, bl
je 0x40d9d5
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call edi
cmp eax, 0xffffffff
je 0x40d9d5
test al, 0x10
je 0x40d9d5
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
call fcn.0040aae0
test eax, eax
jne 0x40d9c2
push str.Successfully_deleted_nf_nss_folder
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40d9d5
push eax
push str.Delete_nf_nss_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.ProtocolFilters.dll
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x178]
call fcn.00404af0
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x40d9f3
mov eax, dword [eax]
mov ecx, eax
call fcn.0040a780
mov ecx, dword [ebp - 0x164]
mov esi, eax
cmp ecx, 0x10
jb 0x40da14
inc ecx
push ecx
push dword [ebp - 0x178]
call fcn.00402b40
test esi, esi
jne 0x40da2c
push str.Successfully_deleted_nf_proto
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40da3f
push esi
push str.Delete_nf_proto_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
push str.libprotobuf_lite.dll
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x178]
call fcn.00404af0
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x40da5d
mov eax, dword [eax]
mov ecx, eax
call fcn.0040a780
mov ecx, dword [ebp - 0x164]
mov esi, eax
cmp ecx, 0x10
jb 0x40da7e
inc ecx
push ecx
push dword [ebp - 0x178]
call fcn.00402b40
test esi, esi
jne 0x40da96
push str.Successfully_deleted_protobuf
push str.stealth_manager
call fcn.00402320
add esp, 8
jmp 0x40daa9
push esi
push str.Delete_protobuf_failed_:__d
push str.stealth_manager
call fcn.0040bc30
add esp, 0xc
mov ebx, dword [ebp - 0x194]
mov eax, dword [ebx]
mov edx, eax
mov ecx, dword [eax + 4]
cmp byte [ecx + 0xd], 0
jne 0x40dad5
nop dword [eax]
cmp dword [ecx + 0x10], 6
jge 0x40dacb
mov ecx, dword [ecx + 8]
jmp 0x40dacf
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x40dac0
cmp edx, eax
je 0x40dadf
cmp dword [edx + 0x10], 6
jle 0x40dae1
mov edx, eax
cmp edx, eax
je 0x40db9f
lea eax, [ebp - 0x194]
mov dword [ebp - 0x194], 6
push eax
lea eax, [ebp - 0x19c]
mov ecx, ebx
push eax
call fcn.00410a80
mov eax, dword [ebp - 0x19c]
add eax, 0x14
cmp dword [eax + 0x14], 0x10
jb 0x40db19
mov eax, dword [eax]
push eax
push str.stealth_manager
call fcn.00402320
add esp, 8
mov dword [ebp - 0x194], 6
lea eax, [ebp - 0x194]
mov ecx, ebx
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00410a80
mov ecx, dword [ebp - 0x19c]
add ecx, 0x14
cmp dword [ecx + 0x14], 0x10
jb 0x40db57
mov ecx, dword [ecx]
call fcn.0040aae0
lea eax, [ebp - 0x194]
mov dword [ebp - 0x194], 6
push eax
lea eax, [ebp - 0x19c]
mov ecx, ebx
push eax
call fcn.00410a80
mov eax, dword [ebp - 0x19c]
add eax, 0x14
cmp dword [eax + 0x14], 0x10
jb 0x40db8c
mov eax, dword [eax]
push eax
push str.Successfully_deleted__s
push str.stealth_manager
call fcn.00402320
add esp, 0xc
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x40dbb1
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00402b40
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
cmp eax, 0x10
jb 0x40dbd5
inc eax
push eax
push dword [ebp - 0x58]
call fcn.00402b40
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
cmp eax, 0x10
jb 0x40dbf9
inc eax
push eax
push dword [ebp - 0x70]
call fcn.00402b40
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
cmp eax, 0x10
jb 0x40dc20
inc eax
push eax
push dword [ebp - 0x88]
call fcn.00402b40
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x74], 0xf
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x88], 0
cmp eax, 0x10
jb 0x40dc4d
inc eax
push eax
push dword [ebp - 0xa0]
call fcn.00402b40
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], 0
mov byte [ebp - 0xa0], 0
cmp eax, 0x10
jb 0x40dc80
inc eax
push eax
push dword [ebp - 0xb8]
call fcn.00402b40
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0xb8], 0
cmp eax, 0x10
jb 0x40dcb3
inc eax
push eax
push dword [ebp - 0xd0]
call fcn.00402b40
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xbc], 0xf
mov dword [ebp - 0xc0], 0
mov byte [ebp - 0xd0], 0
cmp eax, 0x10
jb 0x40dce6
inc eax
push eax
push dword [ebp - 0xe8]
call fcn.00402b40
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xd4], 0xf
mov dword [ebp - 0xd8], 0
mov byte [ebp - 0xe8], 0
cmp eax, 0x10
jb 0x40dd19
inc eax
push eax
push dword [ebp - 0x100]
call fcn.00402b40
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xec], 0xf
mov dword [ebp - 0xf0], 0
mov byte [ebp - 0x100], 0
cmp eax, 0x10
jb 0x40dd4c
inc eax
push eax
push dword [ebp - 0x118]
call fcn.00402b40
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x104], 0xf
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x118], 0
cmp eax, 0x10
jb 0x40dd7f
inc eax
push eax
push dword [ebp - 0x130]
call fcn.00402b40
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
cmp eax, 0x10
jb 0x40ddb2
inc eax
push eax
push dword [ebp - 0x148]
call fcn.00402b40
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x134], 0xf
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x148], 0
cmp eax, 0x10
jb 0x40dddf
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00402b40
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, 0x10
jb 0x40de09
inc eax
push eax
push dword [ebp - 0x160]
call fcn.00402b40
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14c], 0xf
mov dword [ebp - 0x150], 0
mov byte [ebp - 0x160], 0
cmp eax, 0x10
jb 0x40de36
inc eax
push eax
push dword [ebp + 0xc]
call fcn.00402b40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419532
mov esp, ebp
pop ebp
ret 0x1c