Function at 0x407fd3
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x3044]
mov eax, 0x3044
call fcn.00421590
push 0xffffffffffffffff
push 0x434f59
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x44277c]
xor eax, ebp
mov dword [ebp + 0x3040], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x445063], 0
mov edi, dword [ebp + 0x304c]
mov ebx, dword [ebp + 0x3050]
mov esi, dword [ebp + 0x3054]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], esi
jne 0x40804f
push str.SeRestorePrivilege
call fcn.00408c95
push str.SeCreateSymbolicLinkPrivilege
call fcn.00408c95
mov byte [0x445063], 1
push 0x2418
lea ecx, [ebp - 0x38]
call fcn.0040145d
and dword [ebp - 4], 0
lea eax, [esi + 0x10fc]
push 0x800
push eax
lea eax, [ebp + 0x2040]
push eax
call fcn.0041268b
lea eax, [ebp + 0x2040]
push eax
call fcn.00426433
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x2040]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1040]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x2040]
push str.___
push eax
call fcn.004288f8
add esp, 0x10
test eax, eax
sete cl
mov byte [ebp - 0xd], cl
test eax, eax
jne 0x4080c6
lea eax, [ebp + 0x2048]
mov dword [ebp - 0x1c], eax
jmp 0x4080cc
lea eax, [ebp + 0x2040]
test cl, cl
je 0x4080ff
push 4
push str.UNC_
push eax
call fcn.004288f8
add esp, 0xc
test eax, eax
jne 0x4080ff
push 0x5c
pop eax
mov word [ebp + 0x1040], ax
lea eax, [ebp + 0x1042]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
add eax, 6
jmp 0x408102
mov eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
call fcn.004288d6
lea eax, [ebp + 0x1040]
push eax
call fcn.00426433
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp byte [edi + 0x7083], 0
jne 0x40815e
cmp byte [ebp - 0xd], 0
jne 0x4083df
lea eax, [esi + 0x10fc]
push eax
call fcn.0040dc0a
test al, al
jne 0x4083df
lea eax, [esi + 0x10fc]
push eax
push ebx
lea eax, [esi + 0x28]
push eax
push edi
call fcn.00408a47
test al, al
je 0x4083df
movzx eax, byte [edi + 0x704b]
push eax
push 1
push ebx
call fcn.0040baf1
push ebx
call fcn.0040bccb
test al, al
je 0x408195
push ebx
call fcn.0040bcdd
push eax
call fcn.0040bd3e
push ebx
test al, al
je 0x408190
call fcn.0040bbff
jmp 0x408195
call fcn.0040bc65
cmp byte [esi + 0x10e9], 0
jne 0x408260
cmp byte [esi + 0x20fc], 0
jne 0x408260
xor eax, eax
push eax
push 0x80
push 1
push eax
push eax
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4081dc
push ebx
mov ecx, 0x4450c4
call fcn.00407b9a
jmp 0x4083df
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10f8]
cmp eax, 3
jne 0x408296
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x38]
movzx ecx, ax
mov eax, dword [ebp - 0x18]
movzx edi, ax
mov dword [edx], 0xa0000003
lea esi, [ecx + ecx]
mov word [edx + 0xa], si
lea eax, [edi + ecx]
lea eax, [eax*2 + 0xc]
mov word [edx + 4], ax
xor eax, eax
mov dword [edx + 6], eax
lea eax, [ebp + 0x2040]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004288d6
lea eax, [esi + 2]
mov esi, dword [ebp - 0x38]
mov word [esi + 0xc], ax
lea eax, [edi + edi]
mov word [esi + 0xe], ax
lea eax, [ebp + 0x1040]
push eax
mov eax, dword [ebp - 0x20]
add eax, 9
lea eax, [esi + eax*2]
push eax
call fcn.004288d6
add esp, 0x10
jmp 0x408317
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4081e3
lea eax, [ebp - 0x24]
xor ebx, ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push 0x14
call fcn.00407ab8
push 9
mov ecx, 0x4450c4
call fcn.00407d01
jmp 0x4083e1
cmp eax, 2
je 0x4082a4
cmp eax, 1
jne 0x4083df
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x38]
movzx ecx, ax
mov eax, dword [ebp - 0x18]
movzx edi, ax
mov dword [edx], 0xa000000c
lea esi, [ecx + ecx]
mov word [edx + 0xa], si
lea eax, [edi + ecx]
lea eax, [eax*2 + 0x10]
mov word [edx + 4], ax
xor eax, eax
mov dword [edx + 6], eax
lea eax, [ebp + 0x2040]
push eax
lea eax, [edx + 0x14]
push eax
call fcn.004288d6
lea eax, [esi + 2]
mov esi, dword [ebp - 0x38]
mov word [esi + 0xc], ax
lea eax, [edi + edi]
mov word [esi + 0xe], ax
lea eax, [ebp + 0x1040]
push eax
mov eax, dword [ebp - 0x20]
add eax, 0xb
lea eax, [esi + eax*2]
push eax
call fcn.004288d6
movzx eax, byte [ebp - 0xd]
add esp, 0x10
xor eax, 1
mov dword [esi + 0x10], eax
xor eax, eax
push eax
push 0x2200000
push 3
push eax
push eax
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x408351
mov esi, 0x4450c4
push ebx
mov ecx, esi
call fcn.00407b9a
push 9
mov ecx, esi
call fcn.00407d01
jmp 0x4083df
xor eax, eax
lea ecx, [ebp - 0x3c]
push eax
push ecx
push eax
push eax
movzx eax, word [esi + 4]
add eax, 8
push eax
push esi
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4083e9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x15
call fcn.00407ab8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x40839f
cmp eax, 0x522
jne 0x4083af
call fcn.00412838
test al, al
jne 0x4083af
push 0x18
call fcn.00402396
mov esi, 0x4450c4
mov ecx, esi
call fcn.00407d49
push 9
mov ecx, esi
call fcn.00407d01
mov edi, dword [ebp - 0x28]
push ebx
cmp byte [edi + 0x10e9], 0
je 0x4083d9
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4083df
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
mov esi, dword [ebp - 0x38]
jmp 0x40846c
lea ecx, [ebp]
call fcn.0040aeeb
push edi
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.00408c74
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, dword [edx + 0x81c0]
neg ecx
lea eax, [edi + 0x1048]
sbb ecx, ecx
and ecx, eax
lea eax, [edi + 0x1040]
push ecx
mov ecx, dword [edx + 0x81bc]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [edi + 0x1038]
push ecx
mov ecx, dword [edx + 0x81b8]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp]
call fcn.0040b7e2
lea ecx, [ebp]
call fcn.0040afd0
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x7094], 0
jne 0x408462
push dword [edi + 0x24]
push ebx
call fcn.0040c2e5
lea ecx, [ebp]
mov bl, 1
call fcn.0040af2f
test esi, esi
je 0x408477
push esi
call fcn.004266a9
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3040]
xor ecx, ebp
call fcn.004210f9
add ebp, 0x3044
leave
ret 0xc