Function at 0x402c30
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push reloc.mscms.dll_UninstallColorProfileA
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ecx, [esp + 0x14]
call fcn.00405b50
xor esi, esi
lea ecx, [esp + 0x36c]
mov dword [esp + 0x47c], esi
call fcn.004066c0
lea ebp, [ebx + 0x2000]
push ebp
lea eax, [esp + 0x168]
push str._s_uninst.exe
push eax
mov byte [esp + 0x488], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call fcn.00408f1d
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x168]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x402d50
nop
mov edi, 0x424ff8
lea esi, [esp + 0x50]
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x402d2d
mov edi, 0x424ff4
lea esi, [esp + 0x50]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x402d2d
test byte [esp + 0x24], 0x10
jne 0x402d2d
lea eax, [esp + 0x50]
push eax
push ebp
lea ecx, [esp + 0x270]
push str._s_s
push ecx
call fcn.00408f1d
lea edx, [esp + 0x60]
push edx
lea eax, [ebx + 0x2104]
push eax
call fcn.00412f3d
add esp, 0x18
test eax, eax
je 0x402d2d
lea ecx, [esp + 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402cc0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x484]
push ebx
lea edx, [esp + 0x168]
push str._s_uninst.exe
push edx
call fcn.00408f1d
add esp, 0xc
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x168]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x402e29
lea ecx, [ecx]
mov edi, 0x424ff8
lea esi, [esp + 0x50]
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x402e06
mov edi, 0x424ff4
lea esi, [esp + 0x50]
mov ecx, 3
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x402e06
test byte [esp + 0x24], 0x10
jne 0x402e06
lea ecx, [esp + 0x50]
push ecx
push ebx
lea edx, [esp + 0x270]
push str._s_s
push edx
call fcn.00408f1d
add esp, 0x10
push 0
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push ebp
lea eax, [esp + 0x288]
push eax
lea ecx, [esp + 0x390]
call fcn.00406ce0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402d90
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
lea ecx, [esp + 0x168]
push str._s_uninst.exe
push ecx
call fcn.00408f1d
add esp, 0xc
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402edf
lea ecx, [ecx]
mov edi, 0x424ff8
lea esi, [esp + 0x50]
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x402ec8
mov edi, 0x424ff4
lea esi, [esp + 0x50]
mov ecx, 3
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x402ec8
test byte [esp + 0x24], 0x10
jne 0x402ec8
lea ecx, [esp + 0x50]
push ecx
push ebp
lea edx, [esp + 0x270]
push str._s_s
push edx
call fcn.00408f1d
mov eax, dword [esp + 0x498]
add esp, 0x10
push 1
push 0
push eax
push ebp
lea ecx, [esp + 0x278]
push ecx
lea ecx, [esp + 0x28]
call fcn.00405d90
lea edx, [esp + 0x24]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402e60
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x36c]
mov byte [esp + 0x47c], 0
call fcn.00401390
lea ecx, [esp + 0x14]
mov dword [esp + 0x47c], 0xffffffff
call fcn.00401390
mov ecx, dword [esp + 0x474]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x470
ret 8