Function at 0x4d46f0
Capabilities:
Create directory
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55959b
mov eax, dword fs:[0]
push eax
mov eax, 0x4080
call fcn.00520bc0
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x405c], edx
mov dword [ebp - 0x4068], ecx
cmp byte [0x5b2ab8], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4060], ebx
jne 0x4d475b
mov ecx, str.SeRestorePrivilege
call fcn.004d4650
mov ecx, str.SeCreateSymbolicLinkPrivilege
call fcn.004d4650
mov byte [0x5b2ab8], 1
push 0x1418
lea ecx, [ebp - 0x4088]
mov dword [ebp - 0x4088], 0
mov dword [ebp - 0x4084], 0
mov dword [ebp - 0x4080], 0
mov dword [ebp - 0x407c], 0
mov byte [ebp - 0x4078], 0
call fcn.004c8480
mov dword [ebp - 4], 0
lea edi, [ebx + 0x1104]
push 0x7ff
lea eax, [ebp - 0x1014]
push edi
push eax
call fcn.0053048c
add esp, 0xc
lea ecx, [ebp - 0x1014]
xor eax, eax
lea edx, [ecx + 2]
mov word [ebp - 0x16], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d47d0
push 4
sub ecx, edx
lea eax, [ebp - 0x1014]
sar ecx, 1
lea ebx, [ebp - 0x2014]
push 0x5786e8
push eax
mov dword [ebp - 0x4074], ecx
call fcn.00501628
add esp, 0xc
lea esi, [ebp - 0x100c]
test eax, eax
sete dl
test eax, eax
lea eax, [ebp - 0x1014]
mov byte [ebp - 0x4055], dl
cmovne esi, eax
test dl, dl
je 0x4d4850
push 4
push str.UNC_
push esi
call fcn.00501628
mov dl, byte [ebp - 0x4055]
add esp, 0xc
test eax, eax
jne 0x4d4850
mov eax, 0x5c
lea ebx, [ebp - 0x2012]
mov word [ebp - 0x2014], ax
add esi, 6
sub ebx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ebx + esi - 2], ax
test ax, ax
jne 0x4d4852
lea ebx, [ebp - 0x2014]
lea ecx, [ebx + 2]
nop dword [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4d4870
mov eax, dword [ebp - 0x4068]
sub ebx, ecx
sar ebx, 1
mov dword [ebp - 0x4064], ebx
cmp byte [eax + 0x6197], 0
mov eax, dword [ebp - 0x4088]
mov dword [ebp - 0x406c], eax
jne 0x4d4a7d
test dl, dl
jne 0x4d48b8
movzx eax, word [edi]
mov ecx, eax
cmp eax, 0x5c
jne 0x4d4912
cmp word [edi + 2], ax
jne 0x4d4917
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x406c]
test eax, eax
je 0x4d48f4
cmp byte [ebp - 0x4078], 0
je 0x4d48eb
mov edx, dword [ebp - 0x4080]
test edx, edx
je 0x4d48eb
mov ecx, eax
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x4d48e0
push eax
call fcn.004f5d5f
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
cmp eax, 0x69
je 0x4d492e
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, ax
cmp eax, 0x41
jb 0x4d494b
cmp eax, 0x5a
ja 0x4d494b
cmp word [edi + 2], 0x3a
jne 0x4d494b
movzx eax, word [edi + 4]
cmp eax, 0x5c
je 0x4d48b8
cmp eax, 0x2f
je 0x4d48b8
mov ecx, dword [ebp - 0x4060]
mov ebx, dword [ebp - 0x405c]
add ecx, 0x28
call fcn.004cbb90
test al, al
jne 0x4d48b8
mov ecx, edi
call fcn.004cbb90
test al, al
jne 0x4d48b8
movzx eax, word [edi]
xor esi, esi
xor edx, edx
mov dword [ebp - 0x4070], esi
test ax, ax
je 0x4d49f8
mov ecx, eax
nop word [eax + eax]
cmp cx, 0x2e
jne 0x4d49c5
cmp word [edi + 2], cx
jne 0x4d49c5
movzx eax, word [edi + 4]
cmp eax, 0x5c
je 0x4d49af
cmp eax, 0x2f
je 0x4d49af
test ax, ax
jne 0x4d49c5
test edx, edx
je 0x4d49c1
movzx eax, word [edi - 2]
cmp eax, 0x5c
je 0x4d49c1
cmp eax, 0x2f
jne 0x4d49c5
mov cl, 1
jmp 0x4d49c7
xor cl, cl
test cl, cl
lea eax, [esi + 1]
cmove eax, esi
add edi, 2
mov esi, eax
inc edx
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x4d4990
mov dword [ebp - 0x4070], esi
test esi, esi
jle 0x4d49f8
mov ecx, ebx
call fcn.004d5150
test al, al
jne 0x4d48b8
mov ecx, dword [ebp - 0x4060]
lea ecx, [ecx + 0x28]
call fcn.004d50c0
mov ecx, dword [ebp - 0x4068]
mov edi, eax
add ecx, 0x2016
mov esi, ecx
lea edx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4d4a20
sub esi, edx
sar esi, 1
je 0x4d4a5a
push esi
push ecx
push ebx
lfence
call fcn.00501628
add esp, 0xc
test eax, eax
jne 0x4d4a5a
mov eax, ebx
lea ebx, [eax + esi*2]
movzx eax, word [ebx]
cmp eax, 0x5c
je 0x4d4a55
cmp eax, 0x2f
jne 0x4d4a5a
add ebx, 2
jmp 0x4d4a48
mov ecx, ebx
call fcn.004d50c0
mov ecx, dword [ebp - 0x4070]
cmp edi, ecx
jl 0x4d48b8
cmp eax, ecx
jl 0x4d48b8
mov ebx, dword [ebp - 0x4064]
mov esi, dword [ebp - 0x405c]
mov ecx, esi
call fcn.004d61c0
mov edi, dword [ebp - 0x4060]
cmp byte [edi + 0x10f1], 0
jne 0x4d4acd
cmp byte [edi + 0x2104], 0
jne 0x4d4acd
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4d48b8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4d4ade
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4d48b8
mov eax, dword [edi + 0x1100]
cmp eax, 3
jne 0x4d4b85
mov edx, dword [ebp - 0x4074]
mov edi, dword [ebp - 0x406c]
movzx ecx, dx
movzx ebx, bx
mov dword [edi], 0xa0000003
lea eax, [ebx + ecx]
lea eax, [eax*2 + 0xc]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x4064], eax
lea ecx, [ebp - 0x1014]
mov word [edi + 0xa], ax
mov esi, ecx
mov eax, edi
sub eax, esi
lea esi, [eax + 0x10]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x4d4b34
mov eax, dword [ebp - 0x4064]
lea ecx, [ebp - 0x2014]
add eax, 2
mov word [edi + 0xc], ax
lea eax, [ebx + ebx]
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x12]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4d4b70
jmp 0x4d4c3d
cmp eax, 2
je 0x4d4b93
cmp eax, 1
jne 0x4d48b8
mov edx, dword [ebp - 0x4074]
mov edi, dword [ebp - 0x406c]
movzx ecx, dx
movzx ebx, bx
mov dword [edi], 0xa000000c
lea eax, [ebx + ecx]
lea eax, [eax*2 + 0x10]
mov word [edi + 4], ax
xor eax, eax
mov dword [edi + 6], eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x4064], eax
lea ecx, [ebp - 0x1014]
mov word [edi + 0xa], ax
mov esi, ecx
mov eax, edi
sub eax, esi
lea esi, [eax + 0x14]
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x4d4be0
mov eax, dword [ebp - 0x4064]
lea ecx, [ebp - 0x2014]
add eax, 2
mov word [edi + 0xc], ax
lea eax, [ebx + ebx]
mov word [edi + 0xe], ax
lea eax, [edx*2 + 0x16]
mov edx, ecx
sub eax, edx
lea edx, [eax + edi]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4d4c20
movzx eax, byte [ebp - 0x4055]
xor eax, 1
mov dword [edi + 0x10], eax
mov ebx, dword [ebp - 0x405c]
push 0
push 0x2200000
push 3
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d48b8
movzx ecx, word [edi + 4]
lea eax, [ebp - 0x408c]
push 0
push eax
push 0
push 0
add ecx, 8
push ecx
push edi
push 0x900a4
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4d4ce2
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4d4ca7
cmp eax, 0x522
jne 0x4d4cac
call fcn.004d3a00
mov eax, dword [ebp - 0x4060]
inc dword [0x5aa7fc]
mov dword [0x5aa7f8], 9
push ebx
cmp byte [eax + 0x10f1], 0
je 0x4d4cd7
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4d48b8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4d48b8
lea ecx, [ebp - 0x4054]
call fcn.004d52d0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x4054]
call dword [eax + 8]
mov edi, dword [ebp - 0x4068]
xor ecx, ecx
mov dword [ebp - 0x404c], esi
mov esi, dword [ebp - 0x4060]
cmp dword [edi + 0x73a8], ecx
lea eax, [esi + 0x1050]
cmovne ecx, eax
lea eax, [esi + 0x1048]
push ecx
xor ecx, ecx
cmp dword [edi + 0x73a4], ecx
cmovne ecx, eax
lea eax, [esi + 0x1040]
push ecx
xor ecx, ecx
cmp dword [edi + 0x73a0], ecx
cmovne ecx, eax
push ecx
lea ecx, [ebp - 0x4054]
call fcn.004d5c90
mov eax, dword [ebp - 0x404c]
mov cl, 1
test eax, eax
je 0x4d4daa
cmp eax, 0xffffffff
je 0x4d4d88
cmp byte [ebp - 0x4040], 0
jne 0x4d4d7e
cmp dword [ebp - 0x4044], 0
jne 0x4d4d7e
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
cmp eax, 1
sete cl
mov dword [ebp - 0x404c], 0xffffffff
mov dword [ebp - 0x4044], 0
test cl, cl
jne 0x4d4daa
cmp byte [ebp - 0x403c], cl
je 0x4d4daa
push 2
mov ecx, 0x5aa7f8
call fcn.004d3050
cmp byte [edi + 0x62aa], 0
jne 0x4d4de3
mov esi, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push ebx
call edi
test eax, eax
jne 0x4d4de3
push ecx
lea edx, [ebp - 0x3014]
mov ecx, ebx
call fcn.004cbc50
add esp, 4
test al, al
je 0x4d4de3
push esi
lea eax, [ebp - 0x3014]
push eax
call edi
mov bl, 1
mov byte [ebp - 4], 0
cmp dword [ebp - 0x404c], 0xffffffff
mov dword [ebp - 0x4054], 0x57e048
je 0x4d48ba
cmp byte [ebp - 0x4040], 0
jne 0x4d48ba
cmp byte [ebp - 0x403e], 0
lea ecx, [ebp - 0x4054]
je 0x4d4e26
call fcn.004d5700
jmp 0x4d48ba
call fcn.004d56a0
jmp 0x4d48ba