Function at 0x1486a
Capabilities:
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
push 0x47554452
push 0x6000
xor esi, esi
stosd dword es:[edi], eax
push 1
mov ebx, ecx
mov dword [ebp - 4], esi
mov edi, 0xc0000001
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, esi
je 0x14a4c
xor eax, eax
mov word [ebp - 0x24], ax
mov eax, 0x1000
mov edx, eax
mov dword [ebp - 0x20], ecx
add ecx, eax
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebx + 0x24]
mov word [ebp - 0x22], dx
xor edx, edx
mov word [ebp - 0x1c], dx
mov dword [ebp - 0x18], ecx
call fcn.0001c6d0
mov edi, eax
cmp edi, esi
jl 0x14a4c
push 2
push 0x5c
lea eax, [ebp - 0x24]
push eax
push esi
push eax
call fcn.0001bed5
mov edi, eax
cmp edi, esi
jl 0x14a4c
mov eax, dword [ebp + 8]
push esi
push esi
push 0x20
push 3
push 3
push 0x80
mov dword [ebp - 0x44], eax
push esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0xc0000000
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], 0x240
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov edi, eax
cmp edi, esi
jl 0x14a4c
push 0x1fd7c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
jmp 0x14a21
mov eax, edi
cmp edi, esi
je 0x14a21
mov ecx, dword [eax]
cmp ecx, esi
je 0x14977
add ecx, eax
mov dword [ebp - 0xc], ecx
jmp 0x1497a
mov dword [ebp - 0xc], esi
lea ecx, [eax + 0x40]
mov dword [ebp - 0x10], ecx
mov cx, word [eax + 0x3c]
mov word [ebp - 0x14], cx
mov ax, word [eax + 0x3c]
mov word [ebp - 0x12], ax
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x14], ax
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
movzx edi, cx
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x14a16
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 0x14], di
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
je 0x14a16
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
push 0x1fd78
lea eax, [ebp - 0x1c]
push eax
call fcn.0001054c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.000105e0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], 0x240
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
call dword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov eax, dword [ebp - 0xc]
cmp eax, esi
jne 0x1496a
mov edi, dword [ebp - 8]
push esi
push esi
push 1
push 1
push 0x4000
add edi, 0x2000
push edi
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call ebx
test eax, eax
jge 0x14960
xor edi, edi
cmp dword [ebp - 4], esi
je 0x14a5a
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [ebp - 8], esi
je 0x14a6d
push 0x47554452
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4