Function at 0x406e7c
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
mov eax, 0x431edd
call fcn.0041df68
mov eax, 0x30a8
call fcn.0041e040
cmp byte [0x440f73], 0
jne 0x406eb4
push str.SeRestorePrivilege
call fcn.00407971
push str.SeCreateSymbolicLinkPrivilege
call fcn.00407971
mov byte [0x440f73], 1
push ebx
push esi
push edi
push 0x1418
lea ecx, [ebp - 0x2c]
call fcn.0040125a
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
push 0x800
lea eax, [esi + 0x1104]
push eax
lea eax, [ebp - 0x107c]
push eax
call fcn.0040ff3c
lea eax, [ebp - 0x107c]
push eax
call fcn.00422655
push 4
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x107c]
mov eax, edi
lea ebx, [ebp - 0x207c]
push 0x433804
push eax
call fcn.00424e66
add esp, 0x10
test eax, eax
sete cl
mov byte [ebp - 0xd], cl
test eax, eax
jne 0x406f22
lea edi, [ebp - 0x1074]
test cl, cl
je 0x406f4d
push 4
push str.UNC_
push edi
call fcn.00424e66
add esp, 0xc
test eax, eax
jne 0x406f4d
push 0x5c
pop eax
mov word [ebp - 0x207c], ax
lea ebx, [ebp - 0x207a]
add edi, 6
push edi
push ebx
call fcn.00424e44
lea eax, [ebp - 0x207c]
push eax
call fcn.00422655
mov edi, dword [ebp + 8]
add esp, 0xc
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
cmp byte [edi + 0x7197], 0
jne 0x406fad
cmp byte [ebp - 0xd], 0
jne 0x407225
lea eax, [esi + 0x1104]
push eax
call fcn.0040b70a
test al, al
jne 0x407225
lea eax, [esi + 0x1104]
push eax
push ebx
lea eax, [esi + 0x28]
push eax
push edi
call fcn.00407736
test al, al
je 0x407225
movzx eax, byte [edi + 0x714b]
push eax
push 1
push ebx
call fcn.00409ec5
push ebx
call fcn.0040a045
test al, al
je 0x406fe4
push ebx
call fcn.0040a057
push eax
call fcn.0040a0a3
push ebx
test al, al
je 0x406fdf
call fcn.00409fa3
jmp 0x406fe4
call fcn.00409ff4
cmp byte [esi + 0x10f1], 0
jne 0x4070ae
cmp byte [esi + 0x2104], 0
jne 0x4070ae
xor eax, eax
push eax
push 0x80
push 1
push eax
push eax
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40702b
push ebx
mov ecx, 0x440fe8
call fcn.00406afa
jmp 0x407225
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1100]
cmp eax, 3
jne 0x4070db
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
movzx esi, ax
mov eax, dword [ebp - 0x18]
movzx edi, ax
mov dword [ecx], 0xa0000003
lea eax, [edi + esi]
add esi, esi
lea eax, [eax*2 + 0xc]
mov word [ecx + 0xa], si
mov word [ecx + 4], ax
xor eax, eax
mov dword [ecx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ecx + 0x10]
push eax
call fcn.00424e44
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
lea eax, [edi + edi]
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 9
lea eax, [esi + eax*2]
push eax
call fcn.00424e44
add esp, 0x10
jmp 0x40715b
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407032
push ebx
xor ebx, ebx
push ebx
push 0x14
call fcn.00401ea1
push 9
mov ecx, 0x440fe8
call fcn.00406c5a
jmp 0x4072bb
cmp eax, 2
je 0x4070e9
cmp eax, 1
jne 0x407225
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
movzx esi, ax
mov eax, dword [ebp - 0x18]
movzx edi, ax
mov dword [ecx], 0xa000000c
lea eax, [edi + esi]
add esi, esi
lea eax, [eax*2 + 0x10]
mov word [ecx + 0xa], si
mov word [ecx + 4], ax
xor eax, eax
mov dword [ecx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ecx + 0x14]
push eax
call fcn.00424e44
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
lea eax, [edi + edi]
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0xb
lea eax, [esi + eax*2]
push eax
call fcn.00424e44
movzx eax, byte [ebp - 0xd]
add esp, 0x10
xor eax, 1
mov dword [esi + 0x10], eax
xor eax, eax
push eax
push 0x2200000
push 3
push eax
push eax
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x407195
mov esi, 0x440fe8
push ebx
mov ecx, esi
call fcn.00406afa
push 9
mov ecx, esi
call fcn.00406c5a
jmp 0x407225
xor eax, eax
lea ecx, [ebp - 0x30]
push eax
push ecx
push eax
push eax
movzx eax, word [esi + 4]
add eax, 8
push eax
push esi
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x40722c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0
push 0x15
call fcn.00401ea1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4071da
cmp eax, 0x522
jne 0x4071f5
call fcn.004100fb
test al, al
jne 0x4071f5
push 0x18
lea ecx, [ebp - 0x7c]
call fcn.00401466
lea ecx, [ebp - 0x7c]
call fcn.00410f39
mov esi, 0x440fe8
mov ecx, esi
call fcn.00406ca2
push 9
mov ecx, esi
call fcn.00406c5a
mov esi, dword [ebp + 0x10]
push ebx
cmp byte [esi + 0x10f1], 0
je 0x40721f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x407225
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
jmp 0x4072bb
lea ecx, [ebp - 0x30b4]
call fcn.004093a2
push edi
lea ecx, [ebp - 0x30b4]
mov byte [ebp - 4], 1
call fcn.00407950
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, dword [edi + 0x82d8]
neg ecx
lea eax, [esi + 0x1050]
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1048]
push ecx
mov ecx, dword [edi + 0x82d4]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1040]
push ecx
mov ecx, dword [edi + 0x82d0]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp - 0x30b4]
call fcn.00409bd2
lea ecx, [ebp - 0x30b4]
call fcn.00409470
cmp byte [edi + 0x71a8], 0
jne 0x4072ae
push dword [esi + 0x24]
push ebx
call fcn.0040a301
lea ecx, [ebp - 0x30b4]
mov bl, 1
call fcn.004093e5
lea ecx, [ebp - 0x2c]
call fcn.0040149b
mov ecx, dword [ebp - 0xc]
invalid