Function at 0x180009a70
Capabilities:
Delete directory

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x18008f100]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea r9, str.InstallTpacketvModule_____
lea r8, str.InstTpacketV
or edx, 0xffffffff
lea rcx, [0x1800a45e8]
call fcn.180005b70
xor ebp, ebp
mov esi, ebp
mov ebx, ebp
mov word [rsp + 0x60], bx
mov byte [rsp + 0x62], bl
xor eax, eax
mov qword [rsp + 0x63], rax
mov qword [rsp + 0x6b], rax
mov edi, ebp
lea rcx, [rsp + 0x30]
call fcn.1800129e0
nop
mov r9d, 0x20019
lea r8, str.softwareTECOcular.3Agent
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.180012870
test rax, rax
je 0x180007acb
xor r8d, r8d
lea rdx, str.DisableInstallTpacketv
lea rcx, [rsp + 0x30]
call fcn.180012270
mov edi, eax
lea rcx, [rsp + 0x30]
call fcn.180012210
nop
lea rcx, [rsp + 0x30]
call fcn.180012830
test edi, edi
je 0x180007afb
lea r9, str.InstallTpacketvModule_100
lea r8, str.InstTpacketV
or edx, 0xffffffff
lea rcx, [0x1800a45e8]
call fcn.180005b70
jmp 0x180007bd0
call fcn.1800066f0
test eax, eax
jne 0x180007b0d
lea r9, str.InstallTpacketvModule_1
jmp 0x180007ae0
mov ecx, 0xa0
call fcn.180013c3c
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180007b7b
mov rcx, rax
call fcn.180012ac0
nop
lea rax, vtable.CThreadEx_class_CShutdownInstallDriverWindows_.0
mov qword [rbx], rax
lea rcx, [rbx + 0x40]
call fcn.180011b50
lea r11, [rsp + 0x48]
mov qword [rbx + 0x78], r11
lea rax, [0x180005f80]
mov qword [rbx + 0x88], rax
mov dword [rbx + 0x80], 0x3e8
mov dword [rbx + 0x84], 1
mov qword [rbx + 0x90], rbp
mov qword [rbx + 0x98], rbp
jmp 0x180007b7e
mov rbx, rbp
test rbx, rbx
jne 0x180007b8f
lea r9, str.InstallTpacketvModule_2
jmp 0x180007ae0
mov dword [rbx + 0x30], 0xa
mov rcx, rbx
call fcn.180012d40
call fcn.1800134d0
test eax, eax
jne 0x180007bb6
lea rcx, [rsp + 0x60]
call fcn.180002fa0
call fcn.180002d00
call fcn.180006d80
test eax, eax
jne 0x180007bcb
lea r9, str.InstallTpacketvModule_3
jmp 0x180007ae0
mov esi, 1
call fcn.1800134d0
test eax, eax
jne 0x180007be3
lea rcx, [rsp + 0x60]
call fcn.180003140
test rbx, rbx
je 0x180007bf5
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov word [rsp + 0x80], bp
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x82]
call fcn.180015150
lea r8, str.C:TpacketV
lea rdx, str._s
lea rcx, [rsp + 0x80]
call fcn.180013f6c
lea rcx, [rsp + 0x80]
call fcn.180008140
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [rsp + 0x20], esi
lea r9, str.InstallTpacketvModule___ret_:__d_
lea r8, str.InstTpacketV
or edx, 0xffffffff
lea rcx, [0x1800a45e8]
call fcn.180005b70
mov eax, esi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180013880
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x18008f100]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor esi, esi
mov edi, esi
lea r9, str.InstallTpacketvModule1_000000000000
lea r8, str.InstTpacketV
or edx, 0xffffffff
lea rcx, [0x1800a45e8]
call fcn.180005b70
mov ebx, esi
lea rcx, [rsp + 0x30]
call fcn.1800129e0
nop
mov r9d, 0x20019
lea r8, str.softwareTECOcular.3Agent
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.180012870
test rax, rax
je 0x180009b10
xor r8d, r8d
lea rdx, str.DisableInstallTpacketv
lea rcx, [rsp + 0x30]
call fcn.180012270
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.180012210
nop
lea rcx, [rsp + 0x30]
call fcn.180012830
test ebx, ebx
je 0x180009b40
lea r9, str.InstallTpacketvModule1_100
lea r8, str.InstTpacketV
or edx, 0xffffffff
lea rcx, [0x1800a45e8]
call fcn.180005b70
jmp 0x180009c2b
lea rcx, str.C:Tpacket7
call fcn.180008a50
test eax, eax
jne 0x180009b59
lea r9, str.InstallTpacketvModule1_1
jmp 0x180009b25
mov ecx, 0xa0
call fcn.180013c3c
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180009bc7
mov rcx, rax
call fcn.180012ac0
nop
lea rax, vtable.CThreadEx_class_CCloseInstallDriverWindows1_.0
mov qword [rbx], rax
lea rcx, [rbx + 0x40]
call fcn.180011b50
lea r11, [rsp + 0x48]
mov qword [rbx + 0x78], r11
lea rax, [0x180007f40]
mov qword [rbx + 0x88], rax
mov dword [rbx + 0x80], 0x3e8
mov dword [rbx + 0x84], 1
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x98], rsi
jmp 0x180009bca
mov rbx, rsi
test rbx, rbx
jne 0x180009bdb
lea r9, str.InstallTpacketvModule1_2
jmp 0x180009b25
mov dword [rbx + 0x30], 0xa
mov rcx, rbx
call fcn.180012d40
lea rcx, str.tpacket7
call fcn.180009080
test eax, eax
jne 0x180009c19
lea r9, str.InstallTpacketvModule1_3
lea r8, str.InstTpacketV
or edx, 0xffffffff
lea rcx, [0x1800a45e8]
call fcn.180005b70
jmp 0x180009c1e
mov edi, 1
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov word [rsp + 0x60], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x62]
call fcn.180015150
lea r8, str.C:Tpacket7
lea rdx, str._s
lea rcx, [rsp + 0x60]
call fcn.180013f6c
lea rcx, [rsp + 0x60]
call fcn.180008140
lea rcx, str.C:Tpacket7
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [rsp + 0x20], edi
lea r9, str.InstallTpacketvModule1___ret_:__d_
lea r8, str.InstTpacketV
or edx, 0xffffffff
lea rcx, [0x1800a45e8]
call fcn.180005b70
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180013880
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x18]
mov rbx, rcx
lea r9, str.CTPacketVMgr2:InstallTpacketvModule___lu_
lea r8, str.TPacketV
lea rcx, [0x1800a45e8]
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call fcn.180005b70
mov r11d, dword [rbx + 0x18]
cmp r11d, 1
jne 0x18000ad31
add rsp, 0x30
pop rbx
jmp 0x180009a70
cmp r11d, 2
jne 0x18000ad41
add rsp, 0x30
pop rbx
jmp 0x180007a10
lea r9, str.CTPacketVMgr2:InstallTpacketvModule
lea r8, str.TPacketV
lea rcx, [0x1800a45e8]
or edx, 0xffffffff
call fcn.180005b70
xor eax, eax
add rsp, 0x30
pop rbx
ret