Function at 0x180006300
Capabilities:
Delete directory
Delete file
Query environment variable

Disassembly:
sub rsp, 0xcd8
mov rax, qword [0x180026250]
xor rax, rsp
mov qword [rsp + 0xcc0], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
call fcn.180006210
lea rcx, [0x1800255d8]
call fcn.180007d50
mov qword [rsp + 0x50], rax
lea rcx, [0x1800256d0]
call fcn.180007d50
mov qword [rsp + 0x48], rax
lea rcx, [0x1800256f0]
call fcn.180007d50
mov qword [rsp + 0x28], rax
lea rcx, [0x180025700]
call fcn.180007d50
mov qword [rsp + 0x40], rax
lea rcx, [0x180025720]
call fcn.180007d50
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x1800063c6
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x1c
jae 0x1800065ef
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x10
lea rcx, [0x1800244a0]
mov rcx, qword [rcx + rax]
call fcn.180007d50
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x10
lea rcx, [0x1800244a0]
mov rcx, qword [rcx + rax + 8]
call fcn.180007d50
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x480]
call fcn.18000ceb4
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x480]
call fcn.18000ce88
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x480]
call fcn.18000ce88
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x690]
call fcn.18000ceb4
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x690]
call fcn.18000ce88
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x690]
call fcn.18000ce88
mov r8d, 0x104
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x104
lea rdx, [rsp + 0xab0]
lea rcx, [rsp + 0x690]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x60]
call fcn.18000ceb4
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.18000ce88
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18000ce88
lea rdx, [rsp + 0xab0]
lea rcx, [rsp + 0x270]
call fcn.18000ceb4
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x270]
call fcn.18000ce88
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x270]
call fcn.18000ce88
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x60]
call fcn.18000ceb4
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.18000ce88
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.18000ce88
lea rdx, [rsp + 0xab0]
lea rcx, [rsp + 0x270]
call fcn.18000ceb4
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x270]
call fcn.18000ce88
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x270]
call fcn.18000ce88
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x8a0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rsp + 0xab0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rsp + 0x58]
call fcn.180007e50
mov rcx, qword [rsp + 0x30]
call fcn.180007e50
jmp 0x1800063bc
mov rcx, qword [rsp + 0x38]
call fcn.180007e50
mov rcx, qword [rsp + 0x40]
call fcn.180007e50
mov rcx, qword [rsp + 0x28]
call fcn.180007e50
mov rcx, qword [rsp + 0x48]
call fcn.180007e50
mov rcx, qword [rsp + 0x50]
call fcn.180007e50
xor eax, eax
mov rcx, qword [rsp + 0xcc0]
xor rcx, rsp
call fcn.180009540
add rsp, 0xcd8
ret