Function at 0x49f5d8
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30d0
call fcn.004e3eb0
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 8], eax
cmp byte [0x520324], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, edx
mov dword [ebp - 0x30b8], ecx
mov dword [ebp - 0x30a8], ebx
jne 0x49f627
mov ecx, str.SeRestorePrivilege
call fcn.0049f550
mov ecx, str.SeCreateSymbolicLinkPrivilege
call fcn.0049f550
mov byte [0x520324], 1
push 0x1418
lea ecx, [ebp - 0x30cc]
call fcn.004987cd
lea eax, [ebx + 0x10fc]
push 0x800
mov edx, eax
mov dword [ebp - 0x30ac], eax
lea ecx, [ebp - 0x100c]
call fcn.00498a2a
pop ecx
lea ecx, [ebp - 0x100c]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x49f661
push 4
sub ecx, edx
lea eax, [ebp - 0x100c]
sar ecx, 1
push 0x506a8c
push eax
mov dword [ebp - 0x30b4], ecx
call fcn.004cb6c5
mov ecx, eax
lea edx, [ebp - 0x1004]
add esp, 0xc
mov dword [ebp - 0x30a4], ecx
test ecx, ecx
lea eax, [ebp - 0x100c]
cmove eax, edx
mov edi, eax
jne 0x49f6d2
push 4
push str.UNC_
push eax
call fcn.004cb6c5
add esp, 0xc
test eax, eax
jne 0x49f6d2
push 0x5c
pop eax
mov word [ebp - 0x200c], ax
lea ecx, [ebp - 0x200a]
add edi, 6
jmp 0x49f6d8
lea ecx, [ebp - 0x200c]
sub ecx, edi
movzx eax, word [edi]
mov word [edi + ecx], ax
lea edi, [edi + 2]
test ax, ax
jne 0x49f6da
lea ecx, [ebp - 0x200c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x49f6f2
mov eax, dword [ebp - 0x30b8]
sub ecx, edx
mov edi, dword [ebp - 0x30cc]
sar ecx, 1
mov dword [ebp - 0x30a0], ecx
cmp byte [eax + 0x708b], bl
jne 0x49f75f
cmp dword [ebp - 0x30a4], ebx
je 0x49faed
mov ecx, dword [ebp - 0x30ac]
call fcn.0049953d
test al, al
jne 0x49faed
mov edx, dword [ebp - 0x30a8]
push dword [ebp - 0x30ac]
mov ecx, dword [ebp - 0x30b8]
push esi
lea edx, [edx + 0x28]
call fcn.0049fe69
pop ecx
pop ecx
test al, al
je 0x49faed
push ecx
mov ecx, esi
call fcn.004a0a80
pop ecx
mov ecx, esi
call fcn.004a0d47
cmp eax, 0xffffffff
je 0x49f794
mov ecx, esi
call fcn.004a0d47
mov ecx, eax
call fcn.004a0d37
mov ecx, esi
test al, al
je 0x49f78f
call fcn.004a1008
jmp 0x49f794
call fcn.004a0fa8
mov eax, dword [ebp - 0x30a8]
cmp byte [eax + 0x10e9], bl
jne 0x49f897
cmp byte [eax + 0x20fc], bl
jne 0x49f897
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x49f7d9
push esi
push ebx
call fcn.0049e520
jmp 0x49faed
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x30a8]
mov eax, dword [eax + 0x10f8]
cmp eax, 3
jne 0x49f8b9
mov eax, dword [ebp - 0x30a0]
mov edx, dword [ebp - 0x30b4]
movzx eax, ax
movzx ecx, dx
mov dword [ebp - 0x30ac], eax
add eax, ecx
mov dword [edi], 0xa0000003
lea eax, [eax*2 + 0xc]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x30a0], eax
lea ecx, [ebp - 0x100c]
mov word [edi + 0xa], ax
mov edx, ecx
mov eax, edi
sub eax, edx
mov edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx + 0xe], ax
test ax, ax
jne 0x49f840
mov eax, dword [ebp - 0x30a0]
lea ecx, [ebp - 0x200c]
mov edx, dword [ebp - 0x30b4]
add eax, 2
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x30ac]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x12]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
movzx eax, word [ecx]
mov word [ecx + edx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x49f883
jmp 0x49f972
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x49f7e0
push 0x14
lea ecx, [ebp - 0x205c]
call fcn.004964f8
jmp 0x49f99c
cmp eax, 2
je 0x49f8c7
cmp eax, 1
jne 0x49faed
mov eax, dword [ebp - 0x30a0]
mov edx, dword [ebp - 0x30b4]
movzx eax, ax
movzx ecx, dx
mov dword [ebp - 0x30b0], eax
add eax, ecx
mov dword [edi], 0xa000000c
lea eax, [eax*2 + 0x10]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x30ac], eax
lea ecx, [ebp - 0x100c]
mov word [edi + 0xa], ax
mov edx, ecx
mov eax, edi
sub eax, edx
mov edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx + 0x12], ax
test ax, ax
jne 0x49f912
mov eax, dword [ebp - 0x30ac]
lea ecx, [ebp - 0x200c]
mov edx, dword [ebp - 0x30b4]
add eax, 2
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x30b0]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x16]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
movzx eax, word [ecx]
mov word [ecx + edx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x49f955
xor eax, eax
cmp dword [ebp - 0x30a4], eax
setne al
mov dword [edi + 0x10], eax
push ebx
push 0x2200000
push 3
push ebx
push ebx
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x30a4], ecx
cmp ecx, 0xffffffff
jne 0x49f9b1
push esi
push ebx
call fcn.0049e520
inc dword [0x515c48]
mov dword [0x515c44], 9
jmp 0x49faed
push ebx
lea eax, [ebp - 0x30bc]
push eax
movzx eax, word [edi + 4]
push ebx
push ebx
add eax, 8
push eax
push edi
push 0x900a4
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x49fa3a
mov eax, dword [ebp - 0x30a4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x15
lea ecx, [ebp - 0x205c]
call fcn.004964f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x49fa00
cmp eax, 0x522
jne 0x49fa05
call fcn.0049ebe9
mov eax, dword [ebp - 0x30a8]
inc dword [0x515c48]
mov dword [0x515c44], 9
push esi
cmp byte [eax + 0x10e9], bl
je 0x49fa2f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x49faed
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x49faed
lea ecx, [ebp - 0x309c]
call fcn.0049ffe4
mov eax, dword [ebp - 0x309c]
call dword [eax + 8]
mov edx, dword [ebp - 0x30b8]
mov ecx, dword [ebp - 0x30a8]
and dword [ebp - 0x30b0], ebx
mov eax, dword [ebp - 0x30a4]
cmp dword [edx + 0x83c8], ebx
mov dword [ebp - 0x3094], eax
lea eax, [ecx + 0x1048]
cmove eax, dword [ebp - 0x30b0]
and dword [ebp - 0x30b0], ebx
cmp dword [edx + 0x83c4], ebx
push eax
lea eax, [ecx + 0x1040]
cmove eax, dword [ebp - 0x30b0]
push eax
lea eax, [ecx + 0x1038]
xor ecx, ecx
cmp dword [edx + 0x83c0], ebx
cmove eax, ecx
lea ecx, [ebp - 0x309c]
push eax
call fcn.004a088d
lea ecx, [ebp - 0x309c]
call fcn.004a0322
mov eax, dword [ebp - 0x30b8]
cmp byte [eax + 0x729e], bl
jne 0x49fae0
mov eax, dword [ebp - 0x30a8]
mov ecx, esi
mov edx, dword [eax + 0x24]
call fcn.004a0da2
lea ecx, [ebp - 0x309c]
mov bl, 1
call fcn.004a004d
test edi, edi
je 0x49faf8
push edi
call fcn.004c5e5a
pop ecx
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret