Function at 0x140002b60
Capabilities:
Execute command
Self delete

Disassembly:
sub rsp, 0x28
call fcn.140001230
lea rcx, str.rmdir__s__q___localappdata_Battle.net_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___localappdata_Blizzard_Entertainment_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___appdata_Battle.net_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___programdata_Battle.net_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___programdata_Blizzard_Entertainment_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___programdata_Activision_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___USERPROFILE_DocumentsCall_Of_Duty_Black_Ops_Cold_War_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___USERPROFILE_DocumentsCall_of_Duty_Modern_Warfare_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del___codmw_Datadata_shmem___s__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del___codmw_main_recipescmr_hist___s__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___localappdata_Battle.net_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___localappdata_Blizzard_Entertainment_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___appdata_Battle.net_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___programdata_Battle.net_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___programdata_Blizzard_Entertainment_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___USERPROFILE_DocumentsCall_of_Duty_Modern_Warfare_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:Program_Files__x86_Battle.net_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:Program_Files__x86_Call_of_Duty_Modern_Warfare12On7_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:Program_Files__x86_Call_of_Duty_Modern_WarfareBlizzardBrowser_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:Program_Files__x86_Call_of_Duty_Modern_Warfaremain_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:Program_Files__x86_Call_of_Duty_Modern_Warfare_telescopeCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:Program_Files__x86_Call_of_Duty_Modern_Warfarexpak_cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:Program_Files__x86_Call_of_Duty_Modern_WarfareDataindices_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:Program_Files__x86_Call_of_Duty_Modern_WarfareDataconfig_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:ProgramDataNVIDIA_CorporationNV_Cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__c:ProgramDataNVIDIA_CorporationNV_Cache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSoftwareBlizzard_EntertainmentBattle.net__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSoftwareWOW6432NodeBlizzard_Entertainment__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CURRENT_USERSoftwareBlizzard_EntertainmentBattle.netIdentity__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CURRENT_USERSoftwareMicrosoftDirectInput__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerBitBucketVolume__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionActivityDataModel__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREClasses_battlenet__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREClasses_blizzard__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREClassesBlizzard.URI.Battlenet__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREClassesBlizzard.URI.Blizzard__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREClassesBlizzard.URI.Heroes__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREClassesBlizzard.URI.SC2__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREClassesheroes__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREClasses_starcraft__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREClasses_battlenet__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESYSTEMHardwareConfig__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINEHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINEHARDWAREDESCRIPTIONSystemBIOS__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESYSTEMControlSet001ControlComputerName__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINEHARDWAREDEVICEMAPVIDEO__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOT_battlenet__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOT_blizzard__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOTBlizzard.URI.Battlenet__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOTBlizzard.URI.Blizzard__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOTBlizzard.URI.Heroes__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOTBlizzard.URI.SC2__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOTheroes__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOT_starcraft__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:ProgramDataBattle.net__s__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:ProgramDataBlizzard_Entertainment__s__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Users_USERNAME_AppDataLocalTemp__s__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:WindowsTemp__s__q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
lea r8, str.Shadow
lea rdx, str.Clean_Done
xor ecx, ecx
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_MessageBoxA]