Function at 0x140009d1c
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2ff0]
mov eax, 0x30f0
call fcn.140022830
sub rsp, rax
mov rax, qword [0x14004bc38]
xor rax, rsp
mov qword [rbp + 0x2fe0], rax
mov r14, r8
mov rdi, rdx
mov r13, rcx
mov qword [rsp + 0x58], rdx
xor ebx, ebx
lea r15d, [rbx + 1]
cmp byte [0x140056723], bl
jne 0x140009d8d
lea rcx, str.SeRestorePrivilege
call fcn.14000ac44
lea rcx, str.SeCreateSymbolicLinkPrivilege
call fcn.14000ac44
mov byte [0x140056723], r15b
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
mov edx, 0x2418
lea rcx, [rsp + 0x68]
call fcn.1400016b8
nop
lea r12, [r14 + 0x1114]
mov r8d, 0x800
mov rdx, r12
lea rcx, [rbp + 0xfe0]
call fcn.140016e14
lea rcx, [rbp + 0xfe0]
call fcn.140027a5c
mov qword [rsp + 0x50], rax
lea rsi, [rbp + 0x1fe0]
mov r8d, 4
lea rdx, str.___
lea rcx, [rbp + 0xfe0]
call fcn.14002abac
test eax, eax
sete cl
mov byte [rsp + 0x40], cl
lea rbx, [rbp + 0xfe8]
test eax, eax
lea rax, [rbp + 0xfe0]
cmovne rbx, rax
test cl, cl
je 0x140009e4e
mov r8d, 4
lea rdx, str.UNC_
mov rcx, rbx
call fcn.14002abac
test eax, eax
jne 0x140009e4e
mov eax, 0x5c
mov word [rbp + 0x1fe0], ax
lea rsi, [rbp + 0x1fe2]
add rbx, 6
mov rdx, rbx
mov rcx, rsi
call fcn.14002ab90
lea rcx, [rbp + 0x1fe0]
call fcn.140027a5c
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x68]
cmp byte [r13 + 0x708b], 0
jne 0x140009eb6
cmp byte [rsp + 0x40], 0
jne 0x14000a22f
mov rcx, r12
call fcn.140011a58
test al, al
jne 0x14000a22f
lea rdx, [r14 + 0x28]
mov r9, r12
mov r8, rdi
mov rcx, r13
call fcn.14000a968
xor r12d, r12d
test al, al
je 0x14000a232
jmp 0x140009eb9
xor r12d, r12d
mov r8b, byte [r13 + 0x7053]
mov dl, r15b
mov rcx, rdi
call fcn.14000e280
mov rcx, rdi
call fcn.14000e504
test al, al
je 0x140009ef9
mov rcx, rdi
call fcn.14000e518
mov ecx, eax
call fcn.14000e594
mov rcx, rdi
test al, al
je 0x140009ef4
call fcn.14000e3fc
jmp 0x140009ef9
call fcn.14000e480
cmp byte [r14 + 0x10f9], r12b
jne 0x140009fd8
cmp byte [r14 + 0x2114], r12b
jne 0x140009fd8
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140009f53
mov rdx, rdi
lea rcx, [0x1400567e8]
call fcn.140009660
jmp 0x14000a232
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [r14 + 0x1110]
mov ecx, 8
cmp eax, 3
jne 0x14000a007
mov dword [rsi], 0xa0000003
mov r12, qword [rsp + 0x50]
lea eax, [rbx + 6]
add ax, r12w
add ax, ax
mov word [rsi + 4], ax
xor eax, eax
mov dword [rsi + 6], eax
movzx ebx, r12w
add bx, bx
mov word [rsi + 0xa], bx
lea rcx, [rsi + 0x10]
lea rdx, [rbp + 0xfe0]
call fcn.14002ab90
add bx, 2
mov word [rsi + 0xc], bx
mov rax, qword [rsp + 0x48]
add ax, ax
mov word [rsi + 0xe], ax
lea rcx, [r12 + 9]
lea rcx, [rsi + rcx*2]
lea rdx, [rbp + 0x1fe0]
call fcn.14002ab90
jmp 0x14000a07f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140009f5c
mov qword [rsp + 0x48], r12
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x48]
lea ecx, [rax + 0x14]
call fcn.1400094bc
jmp 0x14000a0c3
dec eax
cmp eax, r15d
ja 0x14000a232
mov dword [rsi], 0xa000000c
mov r12, qword [rsp + 0x50]
lea eax, [r12 + rbx]
add ax, cx
add ax, ax
mov word [rsi + 4], ax
xor eax, eax
mov dword [rsi + 6], eax
movzx ebx, r12w
add bx, bx
mov word [rsi + 0xa], bx
lea rcx, [rsi + 0x14]
lea rdx, [rbp + 0xfe0]
call fcn.14002ab90
add bx, 2
mov word [rsi + 0xc], bx
mov rax, qword [rsp + 0x48]
add ax, ax
mov word [rsi + 0xe], ax
lea rcx, [r12 + 0xb]
lea rcx, [rsi + rcx*2]
lea rdx, [rbp + 0x1fe0]
call fcn.14002ab90
movzx eax, byte [rsp + 0x40]
xor eax, r15d
mov dword [rsi + 0x10], eax
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000a0d9
mov rdx, rdi
lea rcx, [0x1400567e8]
call fcn.140009660
mov edx, 9
lea rcx, [0x1400567e8]
call fcn.140009934
jmp 0x14000a232
movzx r9d, word [rsi + 4]
add r9d, 8
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r8, rsi
mov edx, 0x900a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000a19a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], r12
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov ecx, 0x15
call fcn.1400094bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14000a148
cmp eax, 0x522
jne 0x14000a15b
call fcn.140017014
test al, al
jne 0x14000a15b
mov ecx, 0x18
call fcn.140002468
lea rcx, [0x1400567e8]
call fcn.1400099a4
mov edx, 9
lea rcx, [0x1400567e8]
call fcn.140009934
mov rcx, rdi
cmp byte [r14 + 0x10f9], r12b
je 0x14000a18f
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14000a232
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14000a232
lea rcx, [rbp - 0x70]
call fcn.14000d590
nop
mov rax, qword [rbp - 0x70]
lea rcx, [rbp - 0x70]
mov rax, qword [rax + 0x10]
call qword [0x140038440]
mov qword [rbp - 0x68], rbx
mov eax, dword [r13 + 0x81c8]
lea rcx, [r14 + 0x1058]
neg eax
sbb r9, r9
and r9, rcx
mov eax, dword [r13 + 0x81c4]
lea rcx, [r14 + 0x1050]
neg eax
sbb r8, r8
and r8, rcx
mov eax, dword [r13 + 0x81c0]
lea rcx, [r14 + 0x1048]
neg eax
sbb rdx, rdx
and rdx, rcx
lea rcx, [rbp - 0x70]
call fcn.14000df10
lea rcx, [rbp - 0x70]
call fcn.14000d650
cmp byte [r13 + 0x709c], r12b
jne 0x14000a224
mov edx, dword [r14 + 0x24]
mov rcx, rdi
call fcn.14000ec4c
nop
lea rcx, [rbp - 0x70]
call fcn.14000d5d8
jmp 0x14000a235
xor r12d, r12d
mov r15b, r12b
test rsi, rsi
je 0x14000a242
mov rcx, rsi
call fcn.140027a4c
mov al, r15b
mov rcx, qword [rbp + 0x2fe0]
xor rcx, rsp
call fcn.1400224d0
mov rbx, qword [rsp + 0x3148]
add rsp, 0x30f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret