Function at 0xad7048
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
mov eax, 0xb01965
call fcn.00aede14
mov eax, 0x3098
call fcn.00aedef0
cmp byte [0xb0fd63], 0
jne 0xad7080
push str.SeRestorePrivilege
call fcn.00ad7b26
push str.SeCreateSymbolicLinkPrivilege
call fcn.00ad7b26
mov byte [0xb0fd63], 1
push ebx
push esi
push edi
push 0x1418
lea ecx, [ebp - 0x2c]
call fcn.00ad6f59
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push 0x800
mov dword [ebp - 4], ebx
lea eax, [esi + 0x1104]
push eax
lea eax, [ebp - 0x107c]
push eax
call fcn.00adfd80
lea eax, [ebp - 0x107c]
push eax
call fcn.00af3193
push 4
mov dword [ebp - 0x18], eax
lea edi, [ebp - 0x107c]
mov eax, edi
push 0xb027e4
push eax
call fcn.00af53e8
add esp, 0x10
neg eax
sbb al, al
inc al
mov dword [ebp - 0x10], eax
test al, al
je 0xad7118
push 4
lea edi, [ebp - 0x1074]
mov eax, edi
push str.UNC_
push eax
call fcn.00af53e8
add esp, 0xc
test eax, eax
jne 0xad7118
push 0x5c
pop eax
mov word [ebp - 0x207c], ax
lea edi, [ebp - 0x106e]
lea eax, [ebp - 0x207a]
jmp 0xad711e
lea eax, [ebp - 0x207c]
push edi
push eax
call fcn.00af53c6
lea eax, [ebp - 0x207c]
push eax
call fcn.00af3193
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
cmp byte [eax + 0x6197], bl
jne 0xad7181
cmp byte [ebp - 0x10], bl
jne 0xad747d
lea eax, [esi + 0x1104]
push eax
call fcn.00adb782
test al, al
jne 0xad747d
lea eax, [esi + 0x1104]
push eax
push edi
lea eax, [esi + 0x28]
push eax
push dword [ebp + 8]
call fcn.00ad78e3
test al, al
je 0xad747d
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x6147]
push eax
push 1
push edi
call fcn.00ad9f4f
push edi
call fcn.00ada0d3
test al, al
je 0xad71b8
push edi
call fcn.00ada0e7
push eax
call fcn.00ada135
push edi
test al, al
je 0xad71b3
call fcn.00ada02d
jmp 0xad71b8
call fcn.00ada080
cmp byte [esi + 0x10f1], bl
jne 0xad727a
cmp byte [esi + 0x2104], bl
jne 0xad727a
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0xad71fb
push edi
mov ecx, 0xb0fe00
call fcn.00ad6c51
jmp 0xad747d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1100]
cmp eax, 3
jne 0xad729d
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ecx], 0xa0000003
lea esi, [edx + edx]
mov word [ecx + 0xa], si
lea eax, [eax*2 + 0xc]
mov word [ecx + 4], ax
xor eax, eax
mov dword [ecx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ecx + 0x10]
push eax
call fcn.00af53c6
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x14]
add eax, eax
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x18]
add eax, 9
lea eax, [esi + eax*2]
push eax
call fcn.00af53c6
add esp, 0x10
jmp 0xad731b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0xad7202
push edi
push ebx
push 0x14
call fcn.00ad6f15
mov ecx, 0xb0fe00
jmp 0xad734a
cmp eax, 2
je 0xad72ab
cmp eax, 1
jne 0xad747d
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ecx], 0xa000000c
lea esi, [edx + edx]
mov word [ecx + 0xa], si
lea eax, [eax*2 + 0x10]
mov word [ecx + 4], ax
xor eax, eax
mov dword [ecx + 6], eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ecx + 0x14]
push eax
call fcn.00af53c6
lea eax, [esi + 2]
mov esi, dword [ebp - 0x2c]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x14]
add eax, eax
mov word [esi + 0xe], ax
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0xb
lea eax, [esi + eax*2]
push eax
call fcn.00af53c6
mov eax, dword [ebp - 0x10]
add esp, 0x10
movzx eax, al
xor eax, 1
mov dword [esi + 0x10], eax
push ebx
push 0x2200000
push 3
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, 0xffffffff
jne 0xad7356
mov esi, 0xb0fe00
push edi
mov ecx, esi
call fcn.00ad6c51
mov ecx, esi
push 9
call fcn.00ad6db6
jmp 0xad747d
push ebx
lea eax, [ebp - 0x30]
push eax
movzx eax, word [esi + 4]
push ebx
push ebx
add eax, 8
push eax
push esi
push 0x900a4
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0xad73ec
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push 0x15
call fcn.00ad6f15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0xad739a
cmp eax, 0x522
jne 0xad73b5
call fcn.00adff4a
test al, al
jne 0xad73b5
push 0x18
lea ecx, [ebp - 0x7c]
call fcn.00ad141a
lea ecx, [ebp - 0x7c]
call fcn.00ae0d57
mov esi, 0xb0fe00
mov ecx, esi
call fcn.00ad6dfe
push 9
mov ecx, esi
call fcn.00ad6db6
mov esi, dword [ebp + 0x10]
push edi
cmp byte [esi + 0x10f1], bl
je 0xad73e1
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0xad747d
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0xad747d
lea ecx, [ebp - 0x30a4]
call fcn.00ad9519
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30a4]
mov byte [ebp - 4], 1
call fcn.00ad7b05
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x72d8]
neg ecx
lea eax, [esi + 0x1050]
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1048]
push ecx
mov ecx, dword [ebx + 0x72d4]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esi + 0x1040]
push ecx
mov ecx, dword [ebx + 0x72d0]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp - 0x30a4]
call fcn.00ad9c62
lea ecx, [ebp - 0x30a4]
call fcn.00ad95d0
cmp byte [ebx + 0x61a8], 0
jne 0xad7470
push dword [esi + 0x24]
push edi
call fcn.00ada397
lea ecx, [ebp - 0x30a4]
mov bl, 1
call fcn.00ad9553
lea ecx, [ebp - 0x2c]
call fcn.00ad144f
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc