Function at 0x488490
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x3090]
mov eax, 0x3090
call fcn.0052f720
push 0xffffffffffffffff
push 0x550015
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x58bb30]
xor eax, ebp
mov dword [ebp + 0x308c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x5d2757], 0
mov eax, dword [ebp + 0x3098]
mov ebx, dword [ebp + 0x309c]
mov edi, dword [ebp + 0x30a0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], edi
jne 0x48850c
push str.SeRestorePrivilege
call fcn.0048af60
push str.SeCreateSymbolicLinkPrivilege
call fcn.0048af60
mov byte [0x5d2757], 1
push 0x2418
mov dword [ebp - 0x3c], 0
push 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 0x2418
call fcn.00537b8a
mov esi, eax
add esp, 8
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x488551
mov ecx, 0x5d281c
call fcn.004875a0
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], 0x2418
mov dword [ebp - 4], 0
lea esi, [edi + 0x10fc]
push 0x800
push esi
lea eax, [ebp + 0x208c]
push eax
call fcn.004bd090
lea ecx, [ebp + 0x208c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x488583
push 4
sub ecx, edx
lea edi, [ebp + 0x208c]
mov eax, edi
sar ecx, 1
push 0x567308
push eax
mov dword [ebp - 0x20], ecx
call fcn.00538b7d
add esp, 0xc
test eax, eax
sete dl
mov byte [ebp - 0xd], dl
test eax, eax
jne 0x4885bf
lea edi, [ebp + 0x2094]
test dl, dl
je 0x4885f1
push 4
push str.UNC_
push edi
call fcn.00538b7d
mov dl, byte [ebp - 0xd]
add esp, 0xc
test eax, eax
jne 0x4885f1
mov eax, 0x5c
lea ecx, [ebp + 0x108e]
mov word [ebp + 0x108c], ax
add edi, 6
jmp 0x4885f7
lea ecx, [ebp + 0x108c]
sub ecx, edi
lea esp, [esp]
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x488600
lea edi, [ebp + 0x108c]
lea ecx, [edi + 2]
lea esp, [esp]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x488620
mov eax, dword [ebp - 0x28]
sub edi, ecx
sar edi, 1
mov dword [ebp - 0x18], edi
cmp byte [eax + 0x708b], 0
jne 0x488784
test dl, dl
jne 0x488bab
push esi
call fcn.004a2440
test al, al
jne 0x488bab
mov eax, dword [ebp - 0x24]
mov edi, ebx
add eax, 0x28
push eax
call fcn.004a2490
test al, al
jne 0x488bab
push esi
call fcn.004a2490
test al, al
jne 0x488bab
movzx eax, word [esi]
xor edx, edx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], edx
test ax, ax
je 0x488702
mov ecx, eax
xor edi, edi
cmp cx, 0x2e
jne 0x4886da
lea eax, [esi + 2]
mov dword [ebp - 0x2c], eax
cmp word [eax], cx
jne 0x4886da
movzx eax, word [esi + 4]
push eax
call fcn.004a2560
test al, al
jne 0x4886ba
cmp word [esi + 4], 0
jne 0x4886d7
cmp dword [ebp - 0x14], 0
je 0x4886ce
movzx eax, word [esi - 2]
push eax
call fcn.004a2560
test al, al
je 0x4886d7
mov esi, dword [ebp - 0x2c]
inc edi
mov edx, dword [ebp - 0x14]
jmp 0x4886dd
mov edx, dword [ebp - 0x14]
add esi, 2
movzx eax, word [esi]
inc edx
mov dword [ebp - 0x14], edx
mov ecx, eax
test ax, ax
jne 0x488694
mov dword [ebp - 0x2c], edi
test edi, edi
mov edi, ebx
jle 0x488702
push ebx
call fcn.0048a5a0
test al, al
jne 0x488bab
mov eax, dword [ebp - 0x24]
add eax, 0x28
push eax
call fcn.004883e0
mov ecx, dword [ebp - 0x28]
add ecx, 0x2016
mov dword [ebp - 0x14], eax
mov esi, ecx
lea edx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x488720
sub esi, edx
sar esi, 1
je 0x488762
push esi
push ecx
push ebx
call fcn.00538b7d
add esp, 0xc
test eax, eax
jne 0x488762
movzx eax, word [ebx + esi*2]
lea edi, [ebx + esi*2]
push eax
call fcn.004a2560
test al, al
je 0x488762
movzx eax, word [edi + 2]
add edi, 2
push eax
call fcn.004a2560
test al, al
jne 0x488751
push edi
call fcn.004883e0
mov ecx, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], eax
jl 0x488bab
cmp ecx, eax
jl 0x488bab
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax + 0x704f]
push eax
push 1
push ebx
call fcn.00490510
push ebx
call fcn.00490c30
test al, al
je 0x4887bb
push ebx
call fcn.00490d10
push eax
call fcn.00490e40
push ebx
test al, al
je 0x4887b6
call fcn.00490630
jmp 0x4887bb
call fcn.004906b0
mov esi, dword [ebp - 0x24]
cmp byte [esi + 0x10e9], 0
jne 0x4888b5
cmp byte [esi + 0x20fc], 0
jne 0x4888b5
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x488808
push ebx
mov ecx, 0x5d281c
call fcn.00487390
xor bl, bl
jmp 0x488c43
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10f8]
cmp eax, 3
jne 0x488976
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
movzx eax, di
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ecx], 0xa0000003
movzx ecx, dx
add eax, ecx
lea eax, [eax*2 + 0xc]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 0x208c]
mov word [edi + 0xa], ax
mov esi, ecx
mov eax, edi
sub eax, esi
lea esi, [eax + 0x10]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x488861
mov eax, dword [ebp - 0x18]
lea ecx, [ebp + 0x108c]
add eax, 2
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x20]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x12]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
jmp 0x4888a0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4888a0
jmp 0x488a2a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x48880f
lea ecx, [ebp + 0x1040]
mov dword [ebp + 0x1048], 0x557718
mov dword [ebp + 0x104c], 0x557718
mov dword [ebp + 0x1050], 0x557718
mov dword [ebp + 0x1054], 0x557718
mov dword [ebp + 0x1058], 0x557718
mov dword [ebp + 0x105c], 0x557718
mov dword [ebp + 0x1060], eax
mov dword [ebp + 0x1064], eax
mov dword [ebp + 0x1068], eax
mov dword [ebp + 0x106c], eax
mov dword [ebp + 0x1070], eax
mov dword [ebp + 0x1074], eax
mov dword [ebp + 0x1078], eax
mov dword [ebp + 0x107c], eax
mov dword [ebp + 0x1084], eax
mov dword [ebp + 0x1088], 0x14
mov dword [ebp + 0x1040], eax
mov dword [ebp + 0x1044], ebx
mov dword [ebp + 0x1080], 2
call fcn.004bed70
push 9
mov ecx, 0x5d281c
call fcn.00487c60
xor bl, bl
jmp 0x488c43
cmp eax, 2
je 0x488984
cmp eax, 1
jne 0x488bab
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
movzx eax, di
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ecx], 0xa000000c
movzx ecx, dx
add eax, ecx
lea eax, [eax*2 + 0x10]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 0x208c]
mov word [edi + 0xa], ax
mov esi, ecx
mov eax, edi
sub eax, esi
lea esi, [eax + 0x14]
jmp 0x4889d0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x4889d0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp + 0x108c]
add eax, 2
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x20]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x16]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
jmp 0x488a10
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x488a10
movzx eax, byte [ebp - 0xd]
xor eax, 1
mov dword [edi + 0x10], eax
push 0
push 0x2200000
push 3
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x488a68
push ebx
mov ecx, 0x5d281c
call fcn.00487390
push 9
mov ecx, 0x5d281c
call fcn.00487c60
xor bl, bl
jmp 0x488c43
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push 0
push eax
push 0
movzx eax, word [ecx + 4]
push 0
add eax, 8
push eax
push ecx
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x488bb2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
push eax
push 0x15
call fcn.00486eb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x488ac5
cmp eax, 0x522
jne 0x488b75
call fcn.004bda30
test al, al
jne 0x488b75
xor eax, eax
mov dword [ebp + 0x1040], 0x557718
lea ecx, [ebp + 0x1040]
mov dword [ebp + 0x1044], 0x557718
mov dword [ebp + 0x1048], 0x557718
mov dword [ebp + 0x104c], 0x557718
mov dword [ebp + 0x1050], 0x557718
mov dword [ebp + 0x1054], 0x557718
mov dword [ebp + 0x1058], 0x557718
mov dword [ebp + 0x105c], 0x557718
mov dword [ebp + 0x1060], eax
mov dword [ebp + 0x1064], eax
mov dword [ebp + 0x1068], eax
mov dword [ebp + 0x106c], eax
mov dword [ebp + 0x1070], eax
mov dword [ebp + 0x1074], eax
mov dword [ebp + 0x1078], eax
mov dword [ebp + 0x107c], eax
mov dword [ebp + 0x1080], eax
mov dword [ebp + 0x1084], eax
mov dword [ebp + 0x1088], 0x18
call fcn.004bed70
mov ecx, 0x5d281c
call fcn.00487dd0
push 9
mov ecx, 0x5d281c
call fcn.00487c60
mov eax, dword [ebp - 0x24]
push ebx
cmp byte [eax + 0x10e9], 0
je 0x488ba5
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor bl, bl
jmp 0x488c43
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
jmp 0x488c43
lea ecx, [ebp]
call fcn.0048ea10
mov byte [ebp - 4], 1
mov eax, dword [ebp]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x55670c]
lea ecx, [ebp]
call esi
mov esi, dword [ebp - 0x24]
mov dword [ebp + 8], edi
mov edi, dword [ebp - 0x28]
lea eax, [esi + 0x1048]
mov ecx, dword [edi + 0x83e0]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1040]
push ecx
mov ecx, dword [edi + 0x83dc]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1038]
push ecx
mov ecx, dword [edi + 0x83d8]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp]
call fcn.0048f8b0
lea ecx, [ebp]
call fcn.0048ec90
cmp byte [edi + 0x72b6], 0
jne 0x488c35
push dword [esi + 0x24]
push ebx
call fcn.004918b0
mov bl, 1
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.0048ea60
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x488c5a
push eax
call fcn.00537b6f
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x308c]
xor ecx, ebp
call fcn.0052f708
lea esp, [ebp + 0x3090]
pop ebp
ret 0xc