Function at 0x4a8a81
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1497
mov eax, dword fs:[0]
push eax
mov eax, 0x3060
call fcn.00401910
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x3044], edi
mov dword [ebp - 0x304c], ecx
cmp byte [0x524cf8], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3048], esi
jne 0x4a8aee
mov ecx, str.SeRestorePrivilege
call fcn.004a89f7
mov ecx, str.SeCreateSymbolicLinkPrivilege
call fcn.004a89f7
mov byte [0x524cf8], 1
mov ecx, edi
call fcn.004aadf3
cmp byte [esi + 0x10e1], 0
jne 0x4a8bd1
cmp byte [esi + 0x20f4], 0
jne 0x4a8bd1
xor ebx, ebx
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
je 0x4a8be3
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x1418
lea ecx, [ebp - 0x3068]
call fcn.004a8ebb
push 0x800
lea edx, [esi + 0x10f4]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1014]
call fcn.004ae191
pop ecx
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push 4
mov dword [ebp - 0x3040], eax
lea edi, [ebp - 0x1014]
mov eax, edi
push 0x4e014c
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
neg eax
sbb al, al
inc al
mov dword [ebp - 0x3054], eax
je 0x4a8bea
push 4
lea edi, [ebp - 0x100c]
mov eax, edi
push str.UNC_
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x4a8bea
push 0x5c
pop eax
mov word [ebp - 0x2014], ax
lea edi, [ebp - 0x1006]
lea eax, [ebp - 0x2012]
jmp 0x4a8bf0
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x4a8b37
xor al, al
jmp 0x4a8e47
lea eax, [ebp - 0x2014]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x2014]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, dword [esi + 0x10f0]
add esp, 0xc
mov edi, dword [ebp - 0x3068]
mov dword [ebp - 0x3050], eax
cmp ecx, 3
jne 0x4a8c8a
mov ecx, dword [ebp - 0x3040]
add eax, ecx
mov dword [edi], 0xa0000003
lea eax, [eax*2 + 0xc]
mov word [edi + 4], ax
lea esi, [ecx + ecx]
xor eax, eax
mov word [edi + 0xa], si
mov dword [edi + 6], eax
lea eax, [ebp - 0x1014]
push eax
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [esi + 2]
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x3050]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [ebp - 0x2014]
push eax
mov eax, dword [ebp - 0x3040]
add eax, 9
lea eax, [edi + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 0x10
jmp 0x4a8d0c
cmp ecx, 2
je 0x4a8c98
cmp ecx, 1
jne 0x4a8e39
mov ecx, dword [ebp - 0x3040]
add eax, ecx
mov dword [edi], 0xa000000c
lea eax, [eax*2 + 0x10]
mov word [edi + 4], ax
lea esi, [ecx + ecx]
xor eax, eax
mov word [edi + 0xa], si
mov dword [edi + 6], eax
lea eax, [ebp - 0x1014]
push eax
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [esi + 2]
mov word [edi + 0xc], ax
mov eax, dword [ebp - 0x3050]
add eax, eax
mov word [edi + 0xe], ax
lea eax, [ebp - 0x2014]
push eax
mov eax, dword [ebp - 0x3040]
add eax, 0xb
lea eax, [edi + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
xor eax, eax
add esp, 0x10
cmp byte [ebp - 0x3054], al
sete al
mov dword [edi + 0x10], eax
push ebx
push 0x2200000
push 3
push ebx
push ebx
push 0xc0000000
push dword [ebp - 0x3044]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a8e39
push ebx
lea eax, [ebp - 0x3058]
push eax
movzx eax, word [edi + 4]
push ebx
push ebx
add eax, 8
push eax
push edi
push 0x900a4
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x4a8d9d
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [ebp - 0x3048]
inc dword [0x511834]
push dword [ebp - 0x3044]
mov dword [0x511830], 9
cmp byte [esi + 0x10e1], 0
je 0x4a8d92
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
jmp 0x4a8e39
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x4a8e39
lea ecx, [ebp - 0x303c]
call fcn.004aa53e
mov byte [ebp - 4], 1
call fcn.004aa81a
mov ecx, dword [ebp - 0x304c]
xor edx, edx
mov dword [ebp - 0x3038], esi
mov esi, dword [ebp - 0x3048]
cmp dword [ecx + 0x6294], ebx
lea eax, [esi + 0x1040]
cmove eax, edx
cmp dword [ecx + 0x6290], ebx
push eax
lea eax, [esi + 0x1038]
cmove eax, edx
cmp dword [ecx + 0x628c], ebx
push eax
lea eax, [esi + 0x1030]
cmove eax, edx
lea ecx, [ebp - 0x303c]
push eax
call fcn.004aac09
lea ecx, [ebp - 0x303c]
call fcn.004aa81a
mov ecx, dword [ebp - 0x304c]
cmp byte [ecx + 0x519b], 0
jne 0x4a8e28
mov edx, dword [esi + 0x1c]
mov ecx, dword [ebp - 0x3044]
call fcn.004ab0e4
lea ecx, [ebp - 0x303c]
mov byte [ebp - 4], bl
call fcn.004aa594
xor ebx, ebx
inc ebx
test edi, edi
je 0x4a8e45
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret