Function at 0x422210
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x3088]
mov eax, 0x3088
call fcn.00466a00
push 0xffffffffffffffff
push 0x47aad5
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x48d1f4]
xor eax, ebp
mov dword [ebp + 0x3084], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x49d0ef], 0
mov eax, dword [ebp + 0x3090]
mov edi, dword [ebp + 0x3098]
mov ebx, dword [ebp + 0x3094]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], edi
jne 0x422289
push str.SeRestorePrivilege
call fcn.00424790
push str.SeCreateSymbolicLinkPrivilege
call fcn.00424790
mov byte [0x49d0ef], 1
push 0x1418
push 0
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x40], 0x1418
call fcn.0046a903
mov esi, eax
add esp, 8
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x4222bd
mov ecx, 0x49d17c
call fcn.004213d0
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], 0x1418
push 0x800
lea esi, [edi + 0x1104]
mov dword [ebp - 4], 0
push esi
lea eax, [ebp + 0x2084]
push eax
call fcn.00456ab0
lea ecx, [ebp + 0x2084]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4222f0
push 4
sub ecx, edx
lea edi, [ebp + 0x2084]
mov eax, edi
sar ecx, 1
push str.___
push eax
mov dword [ebp - 0x1c], ecx
call fcn.0046cf3d
add esp, 0xc
test eax, eax
sete dl
mov byte [ebp - 0xd], dl
test eax, eax
jne 0x42232c
lea edi, [ebp + 0x208c]
test dl, dl
je 0x42235e
push 4
push str.UNC_
push edi
call fcn.0046cf3d
mov dl, byte [ebp - 0xd]
add esp, 0xc
test eax, eax
jne 0x42235e
mov eax, 0x5c
lea ecx, [ebp + 0x1086]
mov word [ebp + 0x1084], ax
add edi, 6
jmp 0x422364
lea ecx, [ebp + 0x1084]
sub ecx, edi
jmp 0x422370
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x422370
lea edi, [ebp + 0x1084]
lea ecx, [edi + 2]
lea esp, [esp]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x422390
mov eax, dword [ebp - 0x28]
sub edi, ecx
sar edi, 1
mov dword [ebp - 0x24], edi
cmp byte [eax + 0x719f], 0
jne 0x4224f4
test dl, dl
jne 0x42290f
push esi
call fcn.0043c1e0
test al, al
jne 0x42290f
mov eax, dword [ebp - 0x20]
mov edi, ebx
add eax, 0x28
push eax
call fcn.0043c230
test al, al
jne 0x42290f
push esi
call fcn.0043c230
test al, al
jne 0x42290f
movzx eax, word [esi]
xor edx, edx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], edx
test ax, ax
je 0x422472
mov ecx, eax
xor edi, edi
cmp cx, 0x2e
jne 0x42244a
lea eax, [esi + 2]
mov dword [ebp - 0x2c], eax
cmp word [eax], cx
jne 0x42244a
movzx eax, word [esi + 4]
push eax
call fcn.0043c310
test al, al
jne 0x42242a
cmp word [esi + 4], 0
jne 0x422447
cmp dword [ebp - 0x14], 0
je 0x42243e
movzx eax, word [esi - 2]
push eax
call fcn.0043c310
test al, al
je 0x422447
mov esi, dword [ebp - 0x2c]
inc edi
mov edx, dword [ebp - 0x14]
jmp 0x42244d
mov edx, dword [ebp - 0x14]
add esi, 2
movzx eax, word [esi]
inc edx
mov dword [ebp - 0x14], edx
mov ecx, eax
test ax, ax
jne 0x422404
mov dword [ebp - 0x2c], edi
test edi, edi
mov edi, ebx
jle 0x422472
push ebx
call fcn.00423ff0
test al, al
jne 0x42290f
mov eax, dword [ebp - 0x20]
add eax, 0x28
push eax
call fcn.00422160
mov ecx, dword [ebp - 0x28]
add ecx, 0x2016
mov dword [ebp - 0x14], eax
mov esi, ecx
lea edx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x422490
sub esi, edx
sar esi, 1
je 0x4224d2
push esi
push ecx
push ebx
call fcn.0046cf3d
add esp, 0xc
test eax, eax
jne 0x4224d2
movzx eax, word [ebx + esi*2]
lea edi, [ebx + esi*2]
push eax
call fcn.0043c310
test al, al
je 0x4224d2
movzx eax, word [edi + 2]
add edi, 2
push eax
call fcn.0043c310
test al, al
jne 0x4224c1
push edi
call fcn.00422160
mov ecx, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], eax
jl 0x42290f
cmp ecx, eax
jl 0x42290f
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax + 0x714f]
push eax
push 1
push ebx
call fcn.004293e0
push ebx
call fcn.00429bd0
test al, al
je 0x42252b
push ebx
call fcn.00429cb0
push eax
call fcn.00429de0
push ebx
test al, al
je 0x422526
call fcn.00429550
jmp 0x42252b
call fcn.004295d0
mov esi, dword [ebp - 0x20]
cmp byte [esi + 0x10f1], 0
jne 0x422625
cmp byte [esi + 0x2104], 0
jne 0x422625
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x422578
push ebx
mov ecx, 0x49d17c
call fcn.004211c0
xor bl, bl
jmp 0x4229a3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1100]
cmp eax, 3
jne 0x4226e6
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
movzx eax, di
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ecx], 0xa0000003
movzx ecx, dx
add eax, ecx
lea eax, [eax*2 + 0xc]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x2084]
mov word [edi + 0xa], ax
mov esi, ecx
mov eax, edi
sub eax, esi
lea esi, [eax + 0x10]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x4225d1
mov eax, dword [ebp - 0x24]
lea ecx, [ebp + 0x1084]
add eax, 2
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x1c]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x12]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
jmp 0x422610
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x422610
jmp 0x42279a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42257f
lea ecx, [ebp + 0x1038]
mov dword [ebp + 0x1040], 0x47d694
mov dword [ebp + 0x1044], 0x47d694
mov dword [ebp + 0x1048], 0x47d694
mov dword [ebp + 0x104c], 0x47d694
mov dword [ebp + 0x1050], 0x47d694
mov dword [ebp + 0x1054], 0x47d694
mov dword [ebp + 0x1058], eax
mov dword [ebp + 0x105c], eax
mov dword [ebp + 0x1060], eax
mov dword [ebp + 0x1064], eax
mov dword [ebp + 0x1068], eax
mov dword [ebp + 0x106c], eax
mov dword [ebp + 0x1070], eax
mov dword [ebp + 0x1074], eax
mov dword [ebp + 0x107c], eax
mov dword [ebp + 0x1080], 0x14
mov dword [ebp + 0x1038], eax
mov dword [ebp + 0x103c], ebx
mov dword [ebp + 0x1078], 2
call fcn.00458680
push 9
mov ecx, 0x49d17c
call fcn.00421ad0
xor bl, bl
jmp 0x4229a3
cmp eax, 2
je 0x4226f4
cmp eax, 1
jne 0x42290f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
movzx eax, di
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ecx], 0xa000000c
movzx ecx, dx
add eax, ecx
lea eax, [eax*2 + 0x10]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x2084]
mov word [edi + 0xa], ax
mov esi, ecx
mov eax, edi
sub eax, esi
lea esi, [eax + 0x14]
jmp 0x422740
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x422740
mov eax, dword [ebp - 0x24]
lea ecx, [ebp + 0x1084]
add eax, 2
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x1c]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x16]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
jmp 0x422780
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x422780
movzx eax, byte [ebp - 0xd]
xor eax, 1
mov dword [edi + 0x10], eax
push 0
push 0x2200000
push 3
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4227d8
push ebx
mov ecx, 0x49d17c
call fcn.004211c0
push 9
mov ecx, 0x49d17c
call fcn.00421ad0
xor bl, bl
jmp 0x4229a3
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x30]
push 0
push eax
push 0
movzx eax, word [ecx + 4]
push 0
add eax, 8
push eax
push ecx
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x422916
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0
push 0x15
call fcn.004012a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x422829
cmp eax, 0x522
jne 0x4228d9
call fcn.00457370
test al, al
jne 0x4228d9
xor eax, eax
mov dword [ebp + 0x1038], 0x47d694
lea ecx, [ebp + 0x1038]
mov dword [ebp + 0x103c], 0x47d694
mov dword [ebp + 0x1040], 0x47d694
mov dword [ebp + 0x1044], 0x47d694
mov dword [ebp + 0x1048], 0x47d694
mov dword [ebp + 0x104c], 0x47d694
mov dword [ebp + 0x1050], 0x47d694
mov dword [ebp + 0x1054], 0x47d694
mov dword [ebp + 0x1058], eax
mov dword [ebp + 0x105c], eax
mov dword [ebp + 0x1060], eax
mov dword [ebp + 0x1064], eax
mov dword [ebp + 0x1068], eax
mov dword [ebp + 0x106c], eax
mov dword [ebp + 0x1070], eax
mov dword [ebp + 0x1074], eax
mov dword [ebp + 0x1078], eax
mov dword [ebp + 0x107c], eax
mov dword [ebp + 0x1080], 0x18
call fcn.00458680
mov ecx, 0x49d17c
call fcn.00421c60
push 9
mov ecx, 0x49d17c
call fcn.00421ad0
mov eax, dword [ebp - 0x20]
push ebx
cmp byte [eax + 0x10f1], 0
je 0x422909
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor bl, bl
jmp 0x4229a3
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
jmp 0x4229a3
lea ecx, [ebp]
call fcn.00427a00
mov eax, dword [ebp]
mov byte [ebp - 4], 7
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d2b8]
lea ecx, [ebp]
call esi
mov esi, dword [ebp - 0x20]
mov dword [ebp + 8], edi
mov edi, dword [ebp - 0x28]
lea eax, [esi + 0x1050]
mov ecx, dword [edi + 0x84f0]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1048]
push ecx
mov ecx, dword [edi + 0x84ec]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1040]
push ecx
mov ecx, dword [edi + 0x84e8]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp]
call fcn.004287c0
lea ecx, [ebp]
call fcn.00427c40
cmp byte [edi + 0x73c6], 0
jne 0x422999
push dword [esi + 0x24]
push ebx
call fcn.0042a870
lea ecx, [ebp]
mov bl, 1
call fcn.00427a50
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4229b3
push eax
call fcn.0046a8f3
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3084]
xor ecx, ebp
call fcn.004669f1
lea esp, [ebp + 0x3088]
pop ebp
ret 0xc