Function at 0x180067c40
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x18009da48]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13d, r8d
mov dword [rbp - 0x31], r8d
mov r8, rdx
mov qword [rbp - 0x29], rdx
mov r15, rcx
lea edx, [r13 + 0xb]
mov dword [rbp - 0x59], edx
cmp r13d, edx
jae case.0x180067cd2.1
mov edi, dword [rbp - 0x39]
lea edx, [r13 - 0xf3]
mov rbx, qword [rbp - 0x29]
mov r12d, dword [rbp - 0x39]
mov r14, qword [rbp - 0x29]
mov eax, dword [rbp - 0x59]
mov dword [rbp - 0x49], edx
lea r10, [0x180082770]
lea r9, [0x180000000]
cmp edx, 0x22
ja case.default.0x180067cd2
movzx eax, byte [r9 + rdx + 0x68114]
mov ecx, dword [r9 + rax*4 + 0x680ec]
add rcx, r9
jmp rcx
mov eax, dword [rbp - 0x39]
xor r11d, r11d
movsxd r9, eax
test eax, eax
jle 0x180067e36
lea esi, [r11 + 4]
mov r13d, eax
nop dword [rax]
mov r10d, 0x25
nop word [rax + rax]
mov eax, r10d
sub eax, 0x25
je 0x180067de9
sub eax, 1
je 0x180067dd8
cmp eax, 1
jne 0x180067e14
lea r8, [r11 + 1]
cmp r8, r9
jge 0x180067d88
nop word [rax + rax]
mov edx, 0xb8
mov eax, edx
sub eax, 0xb8
je 0x180067d4c
cmp eax, 0xf
jne 0x180067d75
mov rdi, rbx
shr rdi, 0x1c
jmp 0x180067d75
mov rax, qword [r15 + 0x10]
mov ecx, dword [rax + r8*4]
mov eax, r12d
imul rcx, rax
mov eax, dword [r14]
lea rbx, [rax + rcx*2]
mov eax, edi
add rbx, rax
mov eax, ebx
and eax, 0xfffffff
mov dword [r14], eax
add r14, 4
add edx, 0xf
cmp edx, 0xd6
jb 0x180067d35
inc r8
cmp r8, r9
jl 0x180067d30
test edi, edi
je 0x180067e14
mov ecx, 0xca
cmp ecx, 0xca
je 0x180067dbc
cmp ecx, 0x7f0a
jne 0x180067dc4
mov eax, ebx
mov rdi, rbx
and eax, 0xfffffff
mov dword [r14], eax
add r14, 4
shr rdi, 0x1c
jmp 0x180067dc4
mov ebx, dword [r14]
mov eax, edi
add rbx, rax
add ecx, 0x7e40
cmp ecx, 0xfc80
jbe 0x180067d95
test edi, edi
jne 0x180067d90
jmp 0x180067e14
mov rax, qword [r15 + 0x10]
mov r14, qword [rbp - 0x11]
add r14, rsi
mov r12d, dword [rax + r11*4]
jmp 0x180067e14
mov rax, qword [r15 + 0x10]
mov ebx, dword [rax + r11*4]
mov rax, qword [rbp - 0x11]
imul rbx, rbx
lea rcx, [rax + r11*8]
mov eax, dword [rax + r11*8]
add rbx, rax
mov eax, ebx
mov rdi, rbx
and eax, 0xfffffff
mov dword [rcx], eax
shr rdi, 0x1c
inc r10d
cmp r10d, 0x28
jb 0x180067d00
add rsi, 8
inc r11
sub r13, 1
jne 0x180067cf0
mov r13d, dword [rbp - 0x31]
xor edx, edx
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x21]
xor r8d, r8d
lea ecx, [rdx + 3]
call fcn.18003f700
mov edx, dword [rbp - 0x49]
jmp case.0x180067cd2.9
cmp qword [r15 + 0x28], 0
je 0x180067f76
cmp qword [r15 + 0x30], 0
jne 0x180067fd0
mov esi, SHTestTokenMembership
cmp esi, 0x126a9
ja 0x180067f54
je 0x180067f34
cmp esi, 0xf1
je 0x180067f1a
cmp esi, 0x4a5f
je 0x180067efc
cmp esi, 0x93cd
je 0x180067ecd
cmp esi, 0xdd3b
jne 0x180067fbb
mov r8d, 3
mov byte [rbp + 3], 0
lea rdx, [0x180095ffe]
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180067fbb
movzx eax, word [0x180095ea7]
mov word [rbp - 3], ax
movzx eax, byte [0x180095ea9]
mov byte [rbp - 1], al
movzx eax, word [0x180095ef8]
mov word [rbp], ax
movzx eax, byte [0x180095efa]
mov byte [rbp + 2], al
jmp 0x180067fbb
movzx eax, word [0x180095e01]
mov word [rbp - 6], ax
movzx eax, byte [0x180095e03]
mov byte [rbp - 4], al
mov byte [rbp - 3], 0
jmp 0x180067fbb
movzx eax, word [0x180095e38]
mov word [rbp - 9], ax
movzx eax, byte [0x180095e3a]
mov byte [rbp - 7], al
jmp 0x180067fbb
mov r8d, 4
lea rdx, [0x180095e77]
lea rcx, [rbp + 6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp + 0xa], 0x65757165
jmp 0x180067fbb
cmp esi, 0x17017
je 0x180067fa0
cmp esi, 0x1b985
je 0x180067f7f
cmp esi, 0x202f3
jne 0x180067fbb
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov byte [rbp - 0x41], 0
jmp case.0x180067cd2.1
mov r8d, 1
mov byte [rbp + 0xf], 0
lea rdx, [0x180095e21]
lea rcx, [rbp + 0xf]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x10], 0
jmp 0x180067fbb
mov r8d, 1
mov byte [rbp + 0xe], 0
lea rdx, [0x180095fdc]
lea rcx, [rbp + 0xe]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esi, 0x496e
cmp esi, 0x24b70
jbe 0x180067e73
mov edx, dword [rbp - 0x49]
cmp qword [r15 + 0x38], 0
je 0x180067f76
jmp case.0x180067cd2.9
mov eax, dword [r15]
lea rcx, [rbp - 0x21]
mov dword [rbp - 0x39], eax
mov r9d, 0xba
xor r8d, r8d
xor edx, edx
lea esi, [rax*2 + 1]
lea rax, [rbp - 0x31]
mov dword [rbp - 0x31], esi
mov qword [rsp + 0x20], rax
call fcn.18006f800
test eax, eax
jne 0x1800680b1
mov edx, dword [rbp - 0x49]
mov dword [rbp - 0x21], esi
jmp case.0x180067cd2.9
xor r9d, r9d
lea rcx, [rbp - 0x21]
xor r8d, r8d
lea edx, [r9 + 0xa]
call fcn.18003c210
mov edx, dword [rbp - 0x49]
mov dword [rbp - 0x41], 0
jmp case.0x180067cd2.9
mov qword [rsp + 0x30], r8
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x31]
lea rax, [rbp - 0x41]
mov qword [rbp - 0x31], 0
mov r8, r15
mov qword [rsp + 0x20], rax
mov edx, 0xa0
mov qword [rbp - 0x41], r10
xor ecx, ecx
mov byte [rbp - 0x51], 1
call fcn.180007840
mov edx, dword [rbp - 0x49]
jmp 0x180068090
xor r9d, r9d
lea rcx, [rbp - 0x21]
lea edx, [r9 + 0x44]
call fcn.180040e40
mov edx, dword [rbp - 0x49]
jmp case.0x180067cd2.9
mov rax, qword [r15 + 0x10]
mov qword [rbp - 0x41], rax
mov eax, dword [rbp - 0x59]
inc r13d
inc edx
mov dword [rbp - 0x31], r13d
mov dword [rbp - 0x49], edx
cmp r13d, eax
jae case.0x180067cd2.1
mov r8, qword [rbp - 0x29]
jmp 0x180067ca7
mov dword [rbp - 0x41], eax
jmp case.0x180067cd2.1
cmp qword [r15 + 0x20], 0
setne byte [rbp - 0x41]
mov rax, qword [rbp - 0x41]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180083f10
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret