Function at 0x488cb0
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x3090]
mov eax, 0x3090
call fcn.00530230
push 0xffffffffffffffff
push 0x550da5
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp + 0x308c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x5d3757], 0
mov eax, dword [ebp + 0x3098]
mov ebx, dword [ebp + 0x309c]
mov edi, dword [ebp + 0x30a0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], edi
jne 0x488d2c
push str.SeRestorePrivilege
call fcn.0048b630
push str.SeCreateSymbolicLinkPrivilege
call fcn.0048b630
mov byte [0x5d3757], 1
push 0x2418
mov dword [ebp - 0x3c], 0
push 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 0x2418
call fcn.0053869a
mov esi, eax
add esp, 8
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x488d71
mov ecx, 0x5d381c
call fcn.00487da0
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], 0x2418
mov dword [ebp - 4], 0
lea esi, [edi + 0x10fc]
push 0x800
push esi
lea eax, [ebp + 0x208c]
push eax
call fcn.004bdae0
lea ecx, [ebp + 0x208c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x488da3
push 4
sub ecx, edx
lea edi, [ebp + 0x208c]
mov eax, edi
sar ecx, 1
push 0x568508
push eax
mov dword [ebp - 0x20], ecx
call fcn.0053968d
add esp, 0xc
test eax, eax
sete dl
mov byte [ebp - 0xd], dl
test eax, eax
jne 0x488ddf
lea edi, [ebp + 0x2094]
test dl, dl
je 0x488e11
push 4
push str.UNC_
push edi
call fcn.0053968d
mov dl, byte [ebp - 0xd]
add esp, 0xc
test eax, eax
jne 0x488e11
mov eax, 0x5c
lea ecx, [ebp + 0x108e]
mov word [ebp + 0x108c], ax
add edi, 6
jmp 0x488e17
lea ecx, [ebp + 0x108c]
sub ecx, edi
lea esp, [esp]
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x488e20
lea edi, [ebp + 0x108c]
lea ecx, [edi + 2]
lea esp, [esp]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x488e40
mov eax, dword [ebp - 0x28]
sub edi, ecx
sar edi, 1
mov dword [ebp - 0x18], edi
cmp byte [eax + 0x708b], 0
jne 0x488fa4
test dl, dl
jne 0x4893cb
push esi
call fcn.004a2e20
test al, al
jne 0x4893cb
mov eax, dword [ebp - 0x24]
mov edi, ebx
add eax, 0x28
push eax
call fcn.004a2e70
test al, al
jne 0x4893cb
push esi
call fcn.004a2e70
test al, al
jne 0x4893cb
movzx eax, word [esi]
xor edx, edx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], edx
test ax, ax
je 0x488f22
mov ecx, eax
xor edi, edi
cmp cx, 0x2e
jne 0x488efa
lea eax, [esi + 2]
mov dword [ebp - 0x2c], eax
cmp word [eax], cx
jne 0x488efa
movzx eax, word [esi + 4]
push eax
call fcn.004a2f40
test al, al
jne 0x488eda
cmp word [esi + 4], 0
jne 0x488ef7
cmp dword [ebp - 0x14], 0
je 0x488eee
movzx eax, word [esi - 2]
push eax
call fcn.004a2f40
test al, al
je 0x488ef7
mov esi, dword [ebp - 0x2c]
inc edi
mov edx, dword [ebp - 0x14]
jmp 0x488efd
mov edx, dword [ebp - 0x14]
add esi, 2
movzx eax, word [esi]
inc edx
mov dword [ebp - 0x14], edx
mov ecx, eax
test ax, ax
jne 0x488eb4
mov dword [ebp - 0x2c], edi
test edi, edi
mov edi, ebx
jle 0x488f22
push ebx
call fcn.0048aea0
test al, al
jne 0x4893cb
mov eax, dword [ebp - 0x24]
add eax, 0x28
push eax
call fcn.00488be0
mov ecx, dword [ebp - 0x28]
add ecx, 0x2016
mov dword [ebp - 0x14], eax
mov esi, ecx
lea edx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x488f40
sub esi, edx
sar esi, 1
je 0x488f82
push esi
push ecx
push ebx
call fcn.0053968d
add esp, 0xc
test eax, eax
jne 0x488f82
movzx eax, word [ebx + esi*2]
lea edi, [ebx + esi*2]
push eax
call fcn.004a2f40
test al, al
je 0x488f82
movzx eax, word [edi + 2]
add edi, 2
push eax
call fcn.004a2f40
test al, al
jne 0x488f71
push edi
call fcn.00488be0
mov ecx, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], eax
jl 0x4893cb
cmp ecx, eax
jl 0x4893cb
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax + 0x704f]
push eax
push 1
push ebx
call fcn.00490c10
push ebx
call fcn.00491350
test al, al
je 0x488fdb
push ebx
call fcn.00491430
push eax
call fcn.00491560
push ebx
test al, al
je 0x488fd6
call fcn.00490d30
jmp 0x488fdb
call fcn.00490db0
mov esi, dword [ebp - 0x24]
cmp byte [esi + 0x10e9], 0
jne 0x4890d5
cmp byte [esi + 0x20fc], 0
jne 0x4890d5
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x489028
push ebx
mov ecx, 0x5d381c
call fcn.00487b90
xor bl, bl
jmp 0x489463
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10f8]
cmp eax, 3
jne 0x489196
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
movzx eax, di
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ecx], 0xa0000003
movzx ecx, dx
add eax, ecx
lea eax, [eax*2 + 0xc]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 0x208c]
mov word [edi + 0xa], ax
mov esi, ecx
mov eax, edi
sub eax, esi
lea esi, [eax + 0x10]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x489081
mov eax, dword [ebp - 0x18]
lea ecx, [ebp + 0x108c]
add eax, 2
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x20]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x12]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
jmp 0x4890c0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4890c0
jmp 0x48924a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x48902f
lea ecx, [ebp + 0x1040]
mov dword [ebp + 0x1048], 0x558718
mov dword [ebp + 0x104c], 0x558718
mov dword [ebp + 0x1050], 0x558718
mov dword [ebp + 0x1054], 0x558718
mov dword [ebp + 0x1058], 0x558718
mov dword [ebp + 0x105c], 0x558718
mov dword [ebp + 0x1060], eax
mov dword [ebp + 0x1064], eax
mov dword [ebp + 0x1068], eax
mov dword [ebp + 0x106c], eax
mov dword [ebp + 0x1070], eax
mov dword [ebp + 0x1074], eax
mov dword [ebp + 0x1078], eax
mov dword [ebp + 0x107c], eax
mov dword [ebp + 0x1084], eax
mov dword [ebp + 0x1088], 0x14
mov dword [ebp + 0x1040], eax
mov dword [ebp + 0x1044], ebx
mov dword [ebp + 0x1080], 2
call fcn.004bf7b0
push 9
mov ecx, 0x5d381c
call fcn.00488460
xor bl, bl
jmp 0x489463
cmp eax, 2
je 0x4891a4
cmp eax, 1
jne 0x4893cb
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
movzx eax, di
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ecx], 0xa000000c
movzx ecx, dx
add eax, ecx
lea eax, [eax*2 + 0x10]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 0x208c]
mov word [edi + 0xa], ax
mov esi, ecx
mov eax, edi
sub eax, esi
lea esi, [eax + 0x14]
jmp 0x4891f0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x4891f0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp + 0x108c]
add eax, 2
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x20]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x16]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
jmp 0x489230
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x489230
movzx eax, byte [ebp - 0xd]
xor eax, 1
mov dword [edi + 0x10], eax
push 0
push 0x2200000
push 3
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x489288
push ebx
mov ecx, 0x5d381c
call fcn.00487b90
push 9
mov ecx, 0x5d381c
call fcn.00488460
xor bl, bl
jmp 0x489463
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push 0
push eax
push 0
movzx eax, word [ecx + 4]
push 0
add eax, 8
push eax
push ecx
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4893d2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
push eax
push 0x15
call fcn.004876b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4892e5
cmp eax, 0x522
jne 0x489395
call fcn.004be480
test al, al
jne 0x489395
xor eax, eax
mov dword [ebp + 0x1040], 0x558718
lea ecx, [ebp + 0x1040]
mov dword [ebp + 0x1044], 0x558718
mov dword [ebp + 0x1048], 0x558718
mov dword [ebp + 0x104c], 0x558718
mov dword [ebp + 0x1050], 0x558718
mov dword [ebp + 0x1054], 0x558718
mov dword [ebp + 0x1058], 0x558718
mov dword [ebp + 0x105c], 0x558718
mov dword [ebp + 0x1060], eax
mov dword [ebp + 0x1064], eax
mov dword [ebp + 0x1068], eax
mov dword [ebp + 0x106c], eax
mov dword [ebp + 0x1070], eax
mov dword [ebp + 0x1074], eax
mov dword [ebp + 0x1078], eax
mov dword [ebp + 0x107c], eax
mov dword [ebp + 0x1080], eax
mov dword [ebp + 0x1084], eax
mov dword [ebp + 0x1088], 0x18
call fcn.004bf7b0
mov ecx, 0x5d381c
call fcn.004885d0
push 9
mov ecx, 0x5d381c
call fcn.00488460
mov eax, dword [ebp - 0x24]
push ebx
cmp byte [eax + 0x10e9], 0
je 0x4893c5
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor bl, bl
jmp 0x489463
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
jmp 0x489463
lea ecx, [ebp]
call fcn.0048f110
mov byte [ebp - 4], 1
mov eax, dword [ebp]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x55770c]
lea ecx, [ebp]
call esi
mov esi, dword [ebp - 0x24]
mov dword [ebp + 8], edi
mov edi, dword [ebp - 0x28]
lea eax, [esi + 0x1048]
mov ecx, dword [edi + 0x83e0]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1040]
push ecx
mov ecx, dword [edi + 0x83dc]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1038]
push ecx
mov ecx, dword [edi + 0x83d8]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp]
call fcn.0048ffb0
lea ecx, [ebp]
call fcn.0048f390
cmp byte [edi + 0x72b6], 0
jne 0x489455
push dword [esi + 0x24]
push ebx
call fcn.00492250
mov bl, 1
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.0048f160
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x48947a
push eax
call fcn.0053867f
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x308c]
xor ecx, ebp
call fcn.00530218
lea esp, [ebp + 0x3090]
pop ebp
ret 0xc