Function at 0x407a8f
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
mov eax, 0x433838
call fcn.0041fd4c
mov eax, 0x3060
call fcn.0041fe20
cmp byte [0x443063], 0
jne 0x407ac7
push str.SeRestorePrivilege
call fcn.004086e4
push str.SeCreateSymbolicLinkPrivilege
call fcn.004086e4
mov byte [0x443063], 1
push ebx
push esi
push edi
push 0x1418
lea ecx, [ebp - 0x28]
call fcn.004013d9
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
push 0x800
lea eax, [esi + 0x10fc]
push eax
lea eax, [ebp - 0x102c]
push eax
call fcn.00411908
lea eax, [ebp - 0x102c]
push eax
call fcn.00424df3
push 4
mov dword [ebp - 0x18], eax
lea edi, [ebp - 0x102c]
mov eax, edi
lea ebx, [ebp - 0x202c]
push str.___
push eax
call fcn.004272b8
add esp, 0x10
test eax, eax
sete cl
mov byte [ebp - 0xd], cl
test eax, eax
jne 0x407b35
lea edi, [ebp - 0x1024]
test cl, cl
je 0x407b60
push 4
push str.UNC_
push edi
call fcn.004272b8
add esp, 0xc
test eax, eax
jne 0x407b60
push 0x5c
pop eax
mov word [ebp - 0x202c], ax
lea ebx, [ebp - 0x202a]
add edi, 6
push edi
push ebx
call fcn.00427296
lea eax, [ebp - 0x202c]
push eax
call fcn.00424df3
mov edi, dword [ebp + 8]
add esp, 0xc
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
cmp byte [edi + 0x7083], 0
jne 0x407bc0
cmp byte [ebp - 0xd], 0
jne 0x407e41
lea eax, [esi + 0x10fc]
push eax
call fcn.0040d0d2
test al, al
jne 0x407e41
lea eax, [esi + 0x10fc]
push eax
push ebx
lea eax, [esi + 0x28]
push eax
push edi
call fcn.00408353
test al, al
je 0x407e41
movzx eax, byte [edi + 0x704b]
push eax
push 1
push ebx
call fcn.0040b321
push ebx
call fcn.0040b4a1
test al, al
je 0x407bf7
push ebx
call fcn.0040b4b3
push eax
call fcn.0040b4ff
push ebx
test al, al
je 0x407bf2
call fcn.0040b3ff
jmp 0x407bf7
call fcn.0040b450
cmp byte [esi + 0x10e9], 0
jne 0x407cc2
cmp byte [esi + 0x20fc], 0
jne 0x407cc2
xor eax, eax
push eax
push 0x80
push 1
push eax
push eax
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x407c3e
push ebx
mov ecx, 0x4430c4
call fcn.004076b6
jmp 0x407e41
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10f8]
cmp eax, 3
jne 0x407cf8
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
movzx ecx, ax
mov eax, dword [ebp - 0x14]
movzx edi, ax
mov dword [edx], 0xa0000003
lea esi, [ecx + ecx]
mov word [edx + 0xa], si
lea eax, [edi + ecx]
lea eax, [eax*2 + 0xc]
mov word [edx + 4], ax
xor eax, eax
mov dword [edx + 6], eax
lea eax, [ebp - 0x102c]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.00427296
lea eax, [esi + 2]
mov esi, dword [ebp - 0x28]
mov word [esi + 0xc], ax
lea eax, [edi + edi]
mov word [esi + 0xe], ax
lea eax, [ebp - 0x202c]
push eax
mov eax, dword [ebp - 0x18]
add eax, 9
lea eax, [esi + eax*2]
push eax
call fcn.00427296
add esp, 0x10
jmp 0x407d79
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407c45
lea eax, [ebp + 0xc]
xor ebx, ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push 0x14
call fcn.004075e8
push 9
mov ecx, 0x4430c4
call fcn.00407809
jmp 0x407e43
cmp eax, 2
je 0x407d06
cmp eax, 1
jne 0x407e41
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
movzx ecx, ax
mov eax, dword [ebp - 0x14]
movzx edi, ax
mov dword [edx], 0xa000000c
lea esi, [ecx + ecx]
mov word [edx + 0xa], si
lea eax, [edi + ecx]
lea eax, [eax*2 + 0x10]
mov word [edx + 4], ax
xor eax, eax
mov dword [edx + 6], eax
lea eax, [ebp - 0x102c]
push eax
lea eax, [edx + 0x14]
push eax
call fcn.00427296
lea eax, [esi + 2]
mov esi, dword [ebp - 0x28]
mov word [esi + 0xc], ax
lea eax, [edi + edi]
mov word [esi + 0xe], ax
lea eax, [ebp - 0x202c]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0xb
lea eax, [esi + eax*2]
push eax
call fcn.00427296
movzx eax, byte [ebp - 0xd]
add esp, 0x10
xor eax, 1
mov dword [esi + 0x10], eax
xor eax, eax
push eax
push 0x2200000
push 3
push eax
push eax
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x407db3
mov esi, 0x4430c4
push ebx
mov ecx, esi
call fcn.004076b6
push 9
mov ecx, esi
call fcn.00407809
jmp 0x407e41
xor eax, eax
lea ecx, [ebp - 0x2c]
push eax
push ecx
push eax
push eax
movzx eax, word [esi + 4]
add eax, 8
push eax
push esi
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x407e4b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x14], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x15
call fcn.004075e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x407e01
cmp eax, 0x522
jne 0x407e11
call fcn.00411ab5
test al, al
jne 0x407e11
push 0x18
call fcn.0040232e
mov esi, 0x4430c4
mov ecx, esi
call fcn.00407851
push 9
mov ecx, esi
call fcn.00407809
mov edi, dword [ebp + 0x10]
push ebx
cmp byte [edi + 0x10e9], 0
je 0x407e3b
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x407e41
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
mov esi, dword [ebp - 0x28]
jmp 0x407edd
lea ecx, [ebp - 0x306c]
call fcn.0040a79b
push edi
lea ecx, [ebp - 0x306c]
mov byte [ebp - 4], 1
call fcn.004086c3
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ecx, dword [edx + 0x81c0]
neg ecx
lea eax, [edi + 0x1048]
sbb ecx, ecx
and ecx, eax
lea eax, [edi + 0x1040]
push ecx
mov ecx, dword [edx + 0x81bc]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [edi + 0x1038]
push ecx
mov ecx, dword [edx + 0x81b8]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp - 0x306c]
call fcn.0040b012
lea ecx, [ebp - 0x306c]
call fcn.0040a860
mov eax, dword [ebp + 8]
cmp byte [eax + 0x7094], 0
jne 0x407ed0
push dword [edi + 0x24]
push ebx
call fcn.0040b8c6
lea ecx, [ebp - 0x306c]
mov bl, 1
call fcn.0040a7df
test esi, esi
je 0x407ee8
push esi
call fcn.00425069
pop ecx
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc