Function at 0x406f95
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
mov eax, 0x431e0d
call fcn.0041e75c
mov eax, 0x30a8
call fcn.0041e830
cmp byte [0x440fe3], 0
jne 0x406fcd
push str.SeRestorePrivilege
call fcn.00407a8c
push str.SeCreateSymbolicLinkPrivilege
call fcn.00407a8c
mov byte [0x440fe3], 1
push ebx
push esi
push edi
push 0x1418
lea ecx, [ebp - 0x2c]
call fcn.004013aa
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
push 0x800
lea eax, [esi + 0x1104]
push eax
lea eax, [ebp - 0x107c]
push eax
call fcn.004101e2
lea eax, [ebp - 0x107c]
push eax
call fcn.00423483
push 4
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x107c]
mov eax, edi
lea ebx, [ebp - 0x207c]
push str.___
push eax
call fcn.004256f8
add esp, 0x10
test eax, eax
sete cl
mov byte [ebp - 0xd], cl
test eax, eax
jne 0x40703b
lea edi, [ebp - 0x1074]
test cl, cl
je 0x407066
push 4
push str.UNC_
push edi
call fcn.004256f8
add esp, 0xc
test eax, eax
jne 0x407066
push 0x5c
pop eax
mov word [ebp - 0x207c], ax
lea ebx, [ebp - 0x207a]
add edi, 6
push edi
push ebx
call fcn.004256d6
lea eax, [ebp - 0x207c]
push eax
call fcn.00423483
mov edi, dword [ebp + 8]
add esp, 0xc
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
cmp byte [edi + 0x7197], 0
jne 0x4070c6
cmp byte [ebp - 0xd], 0
jne 0x407340
lea eax, [esi + 0x1104]
push eax
call fcn.0040b8ac
test al, al
jne 0x407340
lea eax, [esi + 0x1104]
push eax
push ebx
lea eax, [esi + 0x28]
push eax
push edi
call fcn.00407851
test al, al
je 0x407340
movzx eax, byte [edi + 0x714b]
push eax
push 1
push ebx
call fcn.0040a081
push ebx
call fcn.0040a201
test al, al
je 0x4070fd
push ebx
call fcn.0040a213
push eax
call fcn.0040a25f
push ebx
test al, al
je 0x4070f8
call fcn.0040a15f
jmp 0x4070fd
call fcn.0040a1b0
cmp byte [esi + 0x10f1], 0
jne 0x4071c8
cmp byte [esi + 0x2104], 0
jne 0x4071c8
xor eax, eax
push eax
push 0x80
push 1
push eax
push eax
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x407144
push ebx
mov ecx, 0x441058
call fcn.00406c13
jmp 0x407340
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1100]
cmp eax, 3
jne 0x4071f5
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
movzx ecx, ax
mov eax, dword [ebp - 0x18]
movzx edi, ax
mov dword [edx], 0xa0000003
lea esi, [ecx + ecx]
mov word [edx + 0xa], si
lea eax, [edi + ecx]
lea eax, [eax*2 + 0xc]
mov word [edx + 4], ax
xor eax, eax
mov dword [edx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004256d6
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
lea eax, [edi + edi]
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 9
lea eax, [esi + eax*2]
push eax
call fcn.004256d6
add esp, 0x10
jmp 0x407276
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40714b
push ebx
xor ebx, ebx
push ebx
push 0x14
call fcn.00402013
push 9
mov ecx, 0x441058
call fcn.00406d73
jmp 0x4073d6
cmp eax, 2
je 0x407203
cmp eax, 1
jne 0x407340
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
movzx ecx, ax
mov eax, dword [ebp - 0x18]
movzx edi, ax
mov dword [edx], 0xa000000c
lea esi, [ecx + ecx]
mov word [edx + 0xa], si
lea eax, [edi + ecx]
lea eax, [eax*2 + 0x10]
mov word [edx + 4], ax
xor eax, eax
mov dword [edx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [edx + 0x14]
push eax
call fcn.004256d6
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
lea eax, [edi + edi]
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0xb
lea eax, [esi + eax*2]
push eax
call fcn.004256d6
movzx eax, byte [ebp - 0xd]
add esp, 0x10
xor eax, 1
mov dword [esi + 0x10], eax
xor eax, eax
push eax
push 0x2200000
push 3
push eax
push eax
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4072b0
mov esi, 0x441058
push ebx
mov ecx, esi
call fcn.00406c13
push 9
mov ecx, esi
call fcn.00406d73
jmp 0x407340
xor eax, eax
lea ecx, [ebp - 0x30]
push eax
push ecx
push eax
push eax
movzx eax, word [esi + 4]
add eax, 8
push eax
push esi
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x407347
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0
push 0x15
call fcn.00402013
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4072f5
cmp eax, 0x522
jne 0x407310
call fcn.0041039c
test al, al
jne 0x407310
push 0x18
lea ecx, [ebp - 0x7c]
call fcn.004015b6
lea ecx, [ebp - 0x7c]
call fcn.004111de
mov esi, 0x441058
mov ecx, esi
call fcn.00406dbb
push 9
mov ecx, esi
call fcn.00406d73
mov esi, dword [ebp + 0x10]
push ebx
cmp byte [esi + 0x10f1], 0
je 0x40733a
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x407340
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
jmp 0x4073d6
lea ecx, [ebp - 0x30b4]
call fcn.0040952e
push edi
lea ecx, [ebp - 0x30b4]
mov byte [ebp - 4], 1
call fcn.00407a6b
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, dword [edi + 0x82d8]
neg ecx
lea eax, [esi + 0x1050]
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1048]
push ecx
mov ecx, dword [edi + 0x82d4]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1040]
push ecx
mov ecx, dword [edi + 0x82d0]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp - 0x30b4]
call fcn.00409d72
lea ecx, [ebp - 0x30b4]
call fcn.004095f0
cmp byte [edi + 0x71a8], 0
jne 0x4073c9
push dword [esi + 0x24]
push ebx
call fcn.0040a4bd
lea ecx, [ebp - 0x30b4]
mov bl, 1
call fcn.00409571
lea ecx, [ebp - 0x2c]
call fcn.004015eb
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc