Function at 0x140007d04
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2fa0]
mov eax, 0x30a0
call fcn.140024450
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x30e8], rbx
mov rsi, r8
mov rdi, rdx
mov r13, rcx
xor eax, eax
lea r14d, [rax + 1]
cmp byte [0x14004c283], al
jne 0x140007d6c
lea rcx, str.SeRestorePrivilege
call fcn.140008a08
lea rcx, str.SeCreateSymbolicLinkPrivilege
call fcn.140008a08
mov byte [0x14004c283], r14b
mov edx, 0x1418
lea rcx, [rsp + 0x48]
call fcn.1400014c8
nop
lea r15, [rsi + 0x111c]
mov r8d, 0x800
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.140012198
lea rcx, [rsp + 0x70]
call fcn.140028228
mov qword [rbp + 0x2ff8], rax
lea rbx, [rsp + 0x70]
lea r12, [rbp + 0xf70]
mov r8d, 4
lea rdx, [0x140038d88]
lea rcx, [rsp + 0x70]
call fcn.14002aa20
test eax, eax
sete al
mov byte [rbp + 0x2fe0], al
test al, al
je 0x140007e11
lea rbx, [rsp + 0x78]
mov r8d, 4
lea rdx, str.UNC_
lea rcx, [rsp + 0x78]
call fcn.14002aa20
test eax, eax
jne 0x140007e11
mov eax, 0x5c
mov word [rbp + 0xf70], ax
lea r12, [rbp + 0xf72]
lea rbx, [rsp + 0x7e]
mov rdx, rbx
mov rcx, r12
call fcn.14002aa04
lea rcx, [rbp + 0xf70]
call fcn.140028228
mov r12, rax
xor ebx, ebx
cmp byte [r13 + 0x61b3], bl
jne 0x140007e6c
cmp byte [rbp + 0x2fe0], bl
jne 0x1400081e8
mov rcx, r15
call fcn.14000d100
test al, al
jne 0x1400081e8
lea rdx, [rsi + 0x28]
mov r9, r15
mov r8, rdi
mov rcx, r13
call fcn.140008764
test al, al
je 0x1400081e8
mov r8b, byte [r13 + 0x614f]
mov dl, r14b
mov rcx, rdi
call fcn.14000b4d4
mov rcx, rdi
call fcn.14000b6a0
test al, al
je 0x140007eac
mov rcx, rdi
call fcn.14000b6b4
mov ecx, eax
call fcn.14000b710
mov rcx, rdi
test al, al
je 0x140007ea7
call fcn.14000b5e0
jmp 0x140007eac
call fcn.14000b640
cmp byte [rsi + 0x1101], bl
jne 0x140007f07
cmp byte [rsi + 0x211c], bl
jne 0x140007f07
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140007efc
mov rdx, rdi
lea rcx, [0x14004c3c0]
call fcn.140007848
jmp 0x1400081e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007f28
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140007f28
mov r8, rdi
xor edx, edx
lea ecx, [rax + 0x14]
call fcn.1400076ec
jmp 0x140008071
mov eax, dword [rsi + 0x1118]
mov edx, 8
cmp eax, 3
jne 0x140007fa9
mov r15, qword [rsp + 0x48]
mov dword [r15], 0xa0000003
mov rcx, qword [rbp + 0x2ff8]
lea eax, [rcx + 6]
add ax, r12w
add ax, ax
mov word [r15 + 4], ax
mov dword [r15 + 6], ebx
movzx ebx, cx
add bx, bx
mov word [r15 + 0xa], bx
lea rcx, [r15 + 0x10]
lea rdx, [rsp + 0x70]
call fcn.14002aa04
add bx, 2
mov word [r15 + 0xc], bx
add r12w, r12w
mov word [r15 + 0xe], r12w
mov rax, qword [rbp + 0x2ff8]
add rax, 9
lea rcx, [r15 + rax*2]
lea rdx, [rbp + 0xf70]
call fcn.14002aa04
jmp 0x14000802e
dec eax
cmp eax, r14d
ja 0x1400081e8
mov r15, qword [rsp + 0x48]
mov dword [r15], 0xa000000c
mov rcx, qword [rbp + 0x2ff8]
lea eax, [r12 + rcx]
add ax, dx
add ax, ax
mov word [r15 + 4], ax
mov dword [r15 + 6], ebx
movzx ebx, cx
add bx, bx
mov word [r15 + 0xa], bx
lea rcx, [r15 + 0x14]
lea rdx, [rsp + 0x70]
call fcn.14002aa04
add bx, 2
mov word [r15 + 0xc], bx
add r12w, r12w
mov word [r15 + 0xe], r12w
mov rax, qword [rbp + 0x2ff8]
add rax, 0xb
lea rcx, [r15 + rax*2]
lea rdx, [rbp + 0xf70]
call fcn.14002aa04
movzx eax, byte [rbp + 0x2fe0]
xor eax, r14d
mov dword [r15 + 0x10], eax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140008087
mov rdx, rdi
lea rcx, [0x14004c3c0]
call fcn.140007848
mov edx, 9
lea rcx, [0x14004c3c0]
call fcn.140007a90
jmp 0x1400081e8
movzx r9d, word [r15 + 4]
add r9d, 8
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0x2ff0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r8, r15
mov edx, 0x900a4
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140008138
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rdi
xor edx, edx
lea ecx, [rdx + 0x15]
call fcn.1400076ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1400080e7
cmp eax, 0x522
jne 0x1400080fa
call fcn.1400123a8
test al, al
jne 0x1400080fa
mov ecx, 0x18
call fcn.140004520
lea rcx, [0x14004c3c0]
call fcn.140007ad4
mov edx, 9
lea rcx, [0x14004c3c0]
call fcn.140007a90
mov rcx, rdi
cmp byte [rsi + 0x1101], bl
je 0x14000812d
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400081e8
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400081e8
lea rcx, [rbp + 0x1f70]
call fcn.14000a878
nop
mov rax, qword [rbp + 0x1f70]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140024400]
lea rcx, [rbp + 0x1f70]
call rbx
mov qword [rbp + 0x1f78], r12
mov eax, dword [r13 + 0x72f0]
lea rcx, [rsi + 0x1060]
neg eax
sbb r9, r9
and r9, rcx
mov eax, dword [r13 + 0x72ec]
lea rcx, [rsi + 0x1058]
neg eax
sbb r8, r8
and r8, rcx
mov eax, dword [r13 + 0x72e8]
lea rcx, [rsi + 0x1050]
neg eax
sbb rdx, rdx
and rdx, rcx
lea rcx, [rbp + 0x1f70]
call fcn.14000b150
lea rcx, [rbp + 0x1f70]
call fcn.14000a940
xor ecx, ecx
cmp byte [r13 + 0x61c4], cl
jne 0x1400081da
mov edx, dword [rsi + 0x24]
mov rcx, rdi
call fcn.14000b9c0
nop
lea rcx, [rbp + 0x1f70]
call fcn.14000a8b8
jmp 0x1400081eb
mov r14b, bl
lea rcx, [rsp + 0x48]
call fcn.140001714
mov al, r14b
mov rbx, qword [rsp + 0x30e8]
add rsp, 0x30a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [r8 + 0x6d58], 3
jne 0x1400086b9
add r8, 0x22f8
mov rdx, r9
jmp 0x140007d04
xor al, al
ret