Function at 0x40710e
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
mov eax, 0x431f0f
call fcn.0041e3cc
mov eax, 0x3098
call fcn.0041e4a0
cmp byte [0x440eb3], 0
jne 0x407146
push str.SeRestorePrivilege
call fcn.00407bec
push str.SeCreateSymbolicLinkPrivilege
call fcn.00407bec
mov byte [0x440eb3], 1
push ebx
push esi
push edi
push 0x1418
lea ecx, [ebp - 0x2c]
call fcn.00401380
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push 0x800
mov dword [ebp - 4], ebx
lea eax, [esi + 0x1104]
push eax
lea eax, [ebp - 0x107c]
push eax
call fcn.0040ff76
lea eax, [ebp - 0x107c]
push eax
call fcn.004236f3
push 4
mov dword [ebp - 0x18], eax
lea edi, [ebp - 0x107c]
mov eax, edi
push 0x4337f4
push eax
call fcn.00425968
add esp, 0x10
neg eax
sbb al, al
inc al
mov dword [ebp - 0x10], eax
test al, al
je 0x4071de
push 4
lea edi, [ebp - 0x1074]
mov eax, edi
push str.UNC_
push eax
call fcn.00425968
add esp, 0xc
test eax, eax
jne 0x4071de
push 0x5c
pop eax
mov word [ebp - 0x207c], ax
lea edi, [ebp - 0x106e]
lea eax, [ebp - 0x207a]
jmp 0x4071e4
lea eax, [ebp - 0x207c]
push edi
push eax
call fcn.00425946
lea eax, [ebp - 0x207c]
push eax
call fcn.004236f3
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
cmp byte [eax + 0x6197], bl
jne 0x407247
cmp byte [ebp - 0x10], bl
jne 0x407543
lea eax, [esi + 0x1104]
push eax
call fcn.0040b952
test al, al
jne 0x407543
lea eax, [esi + 0x1104]
push eax
push edi
lea eax, [esi + 0x28]
push eax
push dword [ebp + 8]
call fcn.004079a9
test al, al
je 0x407543
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x6147]
push eax
push 1
push edi
call fcn.0040a11f
push edi
call fcn.0040a2a3
test al, al
je 0x40727e
push edi
call fcn.0040a2b7
push eax
call fcn.0040a305
push edi
test al, al
je 0x407279
call fcn.0040a1fd
jmp 0x40727e
call fcn.0040a250
cmp byte [esi + 0x10f1], bl
jne 0x407340
cmp byte [esi + 0x2104], bl
jne 0x407340
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4072c1
push edi
mov ecx, 0x440f50
call fcn.00406dde
jmp 0x407543
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1100]
cmp eax, 3
jne 0x407363
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ecx], 0xa0000003
lea esi, [edx + edx]
mov word [ecx + 0xa], si
lea eax, [eax*2 + 0xc]
mov word [ecx + 4], ax
xor eax, eax
mov dword [ecx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ecx + 0x10]
push eax
call fcn.00425946
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x14]
add eax, eax
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x18]
add eax, 9
lea eax, [esi + eax*2]
push eax
call fcn.00425946
add esp, 0x10
jmp 0x4073e1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4072c8
push edi
push ebx
push 0x14
call fcn.00406ffd
mov ecx, 0x440f50
jmp 0x407410
cmp eax, 2
je 0x407371
cmp eax, 1
jne 0x407543
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ecx], 0xa000000c
lea esi, [edx + edx]
mov word [ecx + 0xa], si
lea eax, [eax*2 + 0x10]
mov word [ecx + 4], ax
xor eax, eax
mov dword [ecx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ecx + 0x14]
push eax
call fcn.00425946
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x14]
add eax, eax
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0xb
lea eax, [esi + eax*2]
push eax
call fcn.00425946
mov eax, dword [ebp - 0x10]
add esp, 0x10
movzx eax, al
xor eax, 1
mov dword [esi + 0x10], eax
push ebx
push 0x2200000
push 3
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, 0xffffffff
jne 0x40741c
mov esi, 0x440f50
push edi
mov ecx, esi
call fcn.00406dde
mov ecx, esi
push 9
call fcn.00406f26
jmp 0x407543
push ebx
lea eax, [ebp - 0x30]
push eax
movzx eax, word [esi + 4]
push ebx
push ebx
add eax, 8
push eax
push esi
push 0x900a4
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4074b2
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push 0x15
call fcn.00406ffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x407460
cmp eax, 0x522
jne 0x40747b
call fcn.0041015d
test al, al
jne 0x40747b
push 0x18
lea ecx, [ebp - 0x7c]
call fcn.0040158d
lea ecx, [ebp - 0x7c]
call fcn.00410f67
mov esi, 0x440f50
mov ecx, esi
call fcn.0041f2f0
push 9
mov ecx, esi
call fcn.00406f26
mov esi, dword [ebp + 0x10]
push edi
cmp byte [esi + 0x10f1], bl
je 0x4074a7
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x407543
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407543
lea ecx, [ebp - 0x30a4]
call fcn.004096de
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30a4]
mov byte [ebp - 4], 1
call fcn.00407bcb
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x72d8]
neg ecx
lea eax, [esi + 0x1050]
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1048]
push ecx
mov ecx, dword [ebx + 0x72d4]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1040]
push ecx
mov ecx, dword [ebx + 0x72d0]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp - 0x30a4]
call fcn.00409e32
lea ecx, [ebp - 0x30a4]
call fcn.004097a0
cmp byte [ebx + 0x61a8], 0
jne 0x407536
push dword [esi + 0x24]
push edi
call fcn.0040a567
lea ecx, [ebp - 0x30a4]
mov bl, 1
call fcn.00409718
lea ecx, [ebp - 0x2c]
call fcn.004015c2
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc