Function at 0x4071e6
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
mov eax, 0x43209f
call fcn.0041e554
mov eax, 0x3098
call fcn.0041e630
cmp byte [0x440eb3], 0
jne 0x40721e
push str.SeRestorePrivilege
call fcn.00407cc4
push str.SeCreateSymbolicLinkPrivilege
call fcn.00407cc4
mov byte [0x440eb3], 1
push ebx
push esi
push edi
push 0x1418
lea ecx, [ebp - 0x2c]
call fcn.00401380
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push 0x800
mov dword [ebp - 4], ebx
lea eax, [esi + 0x1104]
push eax
lea eax, [ebp - 0x107c]
push eax
call fcn.00410131
lea eax, [ebp - 0x107c]
push eax
call fcn.00423883
push 4
mov dword [ebp - 0x18], eax
lea edi, [ebp - 0x107c]
mov eax, edi
push 0x4337f4
push eax
call fcn.00425af8
add esp, 0x10
neg eax
sbb al, al
inc al
mov dword [ebp - 0x10], eax
test al, al
je 0x4072b6
push 4
lea edi, [ebp - 0x1074]
mov eax, edi
push str.UNC_
push eax
call fcn.00425af8
add esp, 0xc
test eax, eax
jne 0x4072b6
push 0x5c
pop eax
mov word [ebp - reloc.wtsapi32.dll_WTSVirtualChannelOpen], ax
lea edi, [ebp - 0x106e]
lea eax, [ebp - 0x207a]
jmp 0x4072bc
lea eax, [ebp - 0x207c]
push edi
push eax
call fcn.00425ad6
lea eax, [ebp - 0x207c]
push eax
call fcn.00423883
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
cmp byte [eax + 0x6197], bl
jne 0x40731f
cmp byte [ebp - 0x10], bl
jne 0x40761b
lea eax, [esi + 0x1104]
push eax
call fcn.0040ba22
test al, al
jne 0x40761b
lea eax, [esi + 0x1104]
push eax
push edi
lea eax, [esi + 0x28]
push eax
push dword [ebp + 8]
call fcn.00407a81
test al, al
je 0x40761b
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x6147]
push eax
push 1
push edi
call fcn.0040a1ef
push edi
call fcn.0040a373
test al, al
je 0x407356
push edi
call fcn.0040a387
push eax
call fcn.0040a3d5
push edi
test al, al
je 0x407351
call fcn.0040a2cd
jmp 0x407356
call fcn.0040a320
cmp byte [esi + 0x10f1], bl
jne 0x407418
cmp byte [esi + 0x2104], bl
jne 0x407418
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x407399
push edi
mov ecx, 0x440f50
call fcn.00406e55
jmp 0x40761b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1100]
cmp eax, 3
jne 0x40743b
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ecx], 0xa0000003
lea esi, [edx + edx]
mov word [ecx + 0xa], si
lea eax, [eax*2 + 0xc]
mov word [ecx + 4], ax
xor eax, eax
mov dword [ecx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ecx + 0x10]
push eax
call fcn.00425ad6
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x14]
add eax, eax
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x18]
add eax, 9
lea eax, [esi + eax*2]
push eax
call fcn.00425ad6
add esp, 0x10
jmp 0x4074b9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4073a0
push edi
push ebx
push 0x14
call fcn.00406d72
mov ecx, 0x440f50
jmp 0x4074e8
cmp eax, 2
je 0x407449
cmp eax, 1
jne 0x40761b
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ecx], 0xa000000c
lea esi, [edx + edx]
mov word [ecx + 0xa], si
lea eax, [eax*2 + 0x10]
mov word [ecx + 4], ax
xor eax, eax
mov dword [ecx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ecx + 0x14]
push eax
call fcn.00425ad6
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x14]
add eax, eax
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0xb
lea eax, [esi + eax*2]
push eax
call fcn.00425ad6
mov eax, dword [ebp - 0x10]
add esp, 0x10
movzx eax, al
xor eax, 1
mov dword [esi + 0x10], eax
push ebx
push 0x2200000
push 3
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, 0xffffffff
jne 0x4074f4
mov esi, 0x440f50
push edi
mov ecx, esi
call fcn.00406e55
mov ecx, esi
push 9
call fcn.00406fba
jmp 0x40761b
push ebx
lea eax, [ebp - 0x30]
push eax
movzx eax, word [esi + 4]
push ebx
push ebx
add eax, 8
push eax
push esi
push 0x900a4
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x40758a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push 0x15
call fcn.00406d72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x407538
cmp eax, 0x522
jne 0x407553
call fcn.004102fb
test al, al
jne 0x407553
push 0x18
lea ecx, [ebp - 0x7c]
call fcn.0040158d
lea ecx, [ebp - 0x7c]
call fcn.00411107
mov esi, 0x440f50
mov ecx, esi
call fcn.00407002
push 9
mov ecx, esi
call fcn.00406fba
mov esi, dword [ebp + 0x10]
push edi
cmp byte [esi + 0x10f1], bl
je 0x40757f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40761b
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40761b
lea ecx, [ebp - 0x30a4]
call fcn.004097b6
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30a4]
mov byte [ebp - 4], 1
call fcn.00407ca3
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x72d8]
neg ecx
lea eax, [esi + 0x1050]
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1048]
push ecx
mov ecx, dword [ebx + 0x72d4]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1040]
push ecx
mov ecx, dword [ebx + 0x72d0]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp - 0x30a4]
call fcn.00409f02
lea ecx, [ebp - 0x30a4]
call fcn.00409870
cmp byte [ebx + 0x61a8], 0
jne 0x40760e
push dword [esi + 0x24]
push edi
call fcn.0040a637
lea ecx, [ebp - 0x30a4]
mov bl, 1
call fcn.004097f0
lea ecx, [ebp - 0x2c]
call fcn.004015c2
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc