When a user deletes the mock directory C:\Windows \System32\, Windows will attempt to delete the real System32. Need to implement a cleanup function to do this as an argument. This can likely be done with kernel32!RemoveDirectory, but will require a few other steps as the directory must be emptied prior to deletion.
When a user deletes the mock directory
C:\Windows \System32\, Windows will attempt to delete the real System32. Need to implement a cleanup function to do this as an argument. This can likely be done withkernel32!RemoveDirectory, but will require a few other steps as the directory must be emptied prior to deletion.