Function at 0x1400359b0
Capabilities:
Execute command
Self delete

Disassembly:
sub rsp, 0xc68
lea rdx, str.rmdir__s__q_F:Users_username_AppDataRoamingMicrosoftWindowsCloudStore__nul_2_1
lea rcx, [rsp + 0x7d0]
call fcn.140034940
mov rcx, rax
call fcn.140034970
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalFortniteGameSaved__nul_2_1
lea rcx, [rsp + 0x3b0]
call fcn.140034990
mov rcx, rax
call fcn.1400349c0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:WindowsINF__nul_2_1
lea rcx, [rsp + 0x20]
call fcn.140031ed0
mov rcx, rax
call fcn.140031f00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:ProgramData_username_MicrosoftXboxLiveNSALCache__nul_2_1
lea rcx, [rsp + 0x4f0]
call fcn.1400349e0
mov rcx, rax
call fcn.140034a10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:UsersPublicDocuments__nul_2_1
lea rcx, [rsp + 0xd0]
call fcn.140031d90
mov rcx, rax
call fcn.140031dc0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140157100]
lea rcx, [rsp + 0x70]
call fcn.140034a30
mov rcx, rax
call fcn.140034a60
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalD3DSCache__nul_2_1
lea rcx, [rsp + 0x1d0]
call fcn.140034a80
mov rcx, rax
call fcn.140034ab0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalCrashReportClient__nul_2_1
lea rcx, [rsp + 0x360]
call fcn.140034ad0
mov rcx, rax
call fcn.140034b00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Windows_temp__nul_2_1
lea rcx, [rsp + 0x48]
call fcn.140034b20
mov rcx, rax
call fcn.140034b50
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalMicrosoftWindowsSettingSyncmetastore__nul_2_1
lea rcx, [rsp + 0x890]
call fcn.140034b70
mov rcx, rax
call fcn.140034ba0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:WindowsSoftwareDistributionDataStoreLogs__nul_2_1
lea rcx, [rsp + 0x270]
call fcn.140033950
mov rcx, rax
call fcn.140033980
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:ProgramDataMicrosoftWindowsWERTemp__nul_2_1
lea rcx, [rsp + 0x180]
call fcn.140033a40
mov rcx, rax
call fcn.140033a70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalAMDDxCache__nul_2_1
lea rcx, [rsp + 0x220]
call fcn.140034bc0
mov rcx, rax
call fcn.140034bf0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140157340]
lea rcx, [rsp + 0x450]
call fcn.140032fa0
mov rcx, rax
call fcn.140032fd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:WindowsPrefetch__nul_2_1
lea rcx, [rsp + 0xa0]
call fcn.140034a30
mov rcx, rax
call fcn.140034a60
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._del__s__f__a:h___a_:_a___q_F:Usersusername_AppDataLocalPackagesMicrosoft.Windows.Cortana_cw5n1h2txyewy.__nul_2_1
lea rcx, [rsp + 0xbe0]
call fcn.140033540
mov rcx, rax
call fcn.140033570
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._del__s__f__a:h___a_:_a___q_F:Users_username_AppDataLocalMicrosoftWindowsWebCache.__nul_2_1
lea rcx, [rsp + 0x900]
call fcn.140034c10
mov rcx, rax
call fcn.140034c40
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalPackagesMicrosoft.XboxGamingOverlay_8wekyb3d8bbweAC__nul_2_1
lea rcx, [rsp + 0x970]
call fcn.140033860
mov rcx, rax
call fcn.140033890
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalPackagesMicrosoft.XboxGamingOverlay_8wekyb3d8bbweLocalCache__nul_2_1
lea rcx, [rsp + 0xae0]
call fcn.140034c60
mov rcx, rax
call fcn.140034c90
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalPackagesMicrosoft.XboxGamingOverlay_8wekyb3d8bbweSettings__nul_2_1
lea rcx, [rsp + 0x9e0]
call fcn.140034cb0
mov rcx, rax
call fcn.140034ce0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q__F:Program_FilesEpic_GamesFortniteEnginePlugins__nul_2_1
lea rcx, [rsp + 0x400]
call fcn.140034990
mov rcx, rax
call fcn.1400349c0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q__F:Program_FilesEpic_GamesFortniteFortniteGamePlugins__nul_2_1
lea rcx, [rsp + 0x650]
call fcn.140034d00
mov rcx, rax
call fcn.140034d30
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q__F:Program_FilesEpic_GamesFortniteFortniteGamePersistentDownloadDir__nul_2_1
lea rcx, [rsp + 0x830]
call fcn.140034d50
mov rcx, rax
call fcn.140034d80
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q__F:Program_FilesEpic_GamesFortniteFortniteGameConfig__nul_2_1
lea rcx, [rsp + 0x590]
call fcn.140034e40
mov rcx, rax
call fcn.140034e70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q__F:Users_username_AppDataLocalNVIDIA_Corporation__nul_2_1
lea rcx, [rsp + 0x4a0]
call fcn.140032fa0
mov rcx, rax
call fcn.140032fd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataRoamingEasyAntiCheat__nul_2_1
lea rcx, [rsp + 0x2c0]
call fcn.140034df0
mov rcx, rax
call fcn.140034e20
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.del__f__s__q_F:ProgramDataMicrosoftDataMartPaidWiFiNetworksCache__nul_2_1
lea rcx, [rsp + 0x5f0]
call fcn.140034e40
mov rcx, rax
call fcn.140034e70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.del__f__s__q_F:ProgramDataMicrosoftDataMartPaidWiFiRules__nul_2_1
lea rcx, [rsp + 0x310]
call fcn.140034df0
mov rcx, rax
call fcn.140034e20
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:WindowsServiceProfilesNetworkServiceAppDataLocalMicrosoftWindowsDeliveryOptimizationCache__nul_2_1
lea rcx, [rsp + 0xb60]
call fcn.140033270
mov rcx, rax
call fcn.1400332a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalTemp__nul_2_1
lea rcx, [rsp + 0x140]
call fcn.140034030
mov rcx, rax
call fcn.140034060
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalMicrosoftWindowsINetCache__nul_2_1
lea rcx, [rsp + 0x710]
call fcn.140034e90
mov rcx, rax
call fcn.140034ec0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalMicrosoftWindowsINetCookies__nul_2_1
lea rcx, [rsp + 0x770]
call fcn.140034ee0
mov rcx, rax
call fcn.140034f10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_AppDataLocalMicrosoftWindowsHistory__nul_2_1
lea rcx, [rsp + 0x6b0]
call fcn.140032f00
mov rcx, rax
call fcn.140032f30
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:Users_username_Intel__nul_2_1
lea rcx, [rsp + 0x108]
call fcn.140031d90
mov rcx, rax
call fcn.140031dc0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q_F:WindowsSystem32config_systemprofileAppDataLocalLowMicrosoftCryptnetUrlCacheMetaData__nul_2_1
lea rcx, [rsp + 0xa60]
call fcn.140034cb0
mov rcx, rax
call fcn.140034ce0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.rmdir__s__q__F:Users_username_AppDataLocalMicrosoftFeeds_Cache__nul_2_1
lea rcx, [rsp + 0x540]
call fcn.140034da0
mov rcx, rax
call fcn.140034dd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0xc68
ret