Function at 0x1800e9b70
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
lea eax, [r8 + 0x5a0]
mov rbp, rdx
mov dword [rsp + 0x50], eax
mov rdi, r9
mov r14d, r8d
mov rdx, rcx
cmp r8d, eax
jae 0x1800e9faf
mov r15, qword [rsp + 0x58]
lea r8, [0x180000000]
mov r12, qword [rsp + 0x58]
xor ebx, ebx
mov rsi, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
nop
cmp r14d, 0x1aa
ja 0x1800e9e4c
je 0x1800e9c78
lea eax, [r14 - 0x8a]
cmp eax, 0xef
ja case.0x1800e9c09.148
movzx eax, byte [r8 + rax + 0xea00c]
mov ecx, dword [r8 + rax*4 + 0xe9fe0]
add rcx, r8
jmp rcx
mov edi, 0x4d
mov eax, edi
sub eax, 0x4d
je 0x1800e9c22
cmp eax, 0x42
je 0x1800e9faf
jmp 0x1800e9c65
mov dword [rsp + 0x28], 0x102
lea r8, [rsp + 0xf0]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov dword [rsp + 0xf0], ebx
xor ecx, ecx
call fcn.1800e5fa0
test eax, eax
je 0x1800e9fc8
test byte [rbp], 2
jne 0x1800e9fa3
mov dword [rsp + 0x30], 1
add edi, 0x42
cmp edi, 0xd1
jb 0x1800e9c10
mov rdx, qword [rsp + 0xe0]
mov qword [rsi + 0x10], rdx
lea rax, [rsi + 0x48]
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov r9d, 0xcf
mov qword [rsi + 0x40], rbp
lea r8, [rsp + 0x48]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
call fcn.1800898b0
mov rdx, qword [rsp + 0xe0]
lea r8, [0x180000000]
jmp case.0x1800e9c09.148
mov qword [rsp + 0x28], rbx
mov r9d, 0x62
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
xor ecx, ecx
call fcn.180064120
mov qword [rsp + 0x68], rax
mov r13, rax
test rax, rax
je 0x1800e9fd6
mov rdx, qword [rsp + 0xe0]
lea r8, [0x180000000]
jmp case.0x1800e9c09.148
mov r9d, 0xa7
mov dword [rsp + 0xf0], 0xe0
xor r8d, r8d
lea rcx, [rsp + 0xf0]
mov rdx, rsi
call fcn.180056ec0
mov rdx, qword [rsp + 0xe0]
lea r8, [0x180000000]
mov qword [rsi + 8], rdi
jmp case.0x1800e9c09.148
mov rax, qword [rbp + 0x1f8]
mov r15d, dword [rbp + 0x20]
mov qword [rsp + 0x80], rax
mov eax, dword [rbp + 0x88]
mov dword [rsp + 0x40], eax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x78], rax
add r15, rax
jmp case.0x1800e9c09.148
test rsi, rsi
jne case.0x1800e9c09.148
mov rax, rbx
jmp 0x1800e9fb4
mov eax, 0x128
cmp eax, 0x128
je 0x1800e9fab
add eax, 0xdcd8
cmp eax, 0xdcd8
jbe 0x1800e9d80
lea r12, [rdi - 8]
jmp case.0x1800e9c09.148
mov r9, rdx
mov r8d, 0x122
mov rdx, rbp
xor ecx, ecx
call fcn.1800e50a0
mov rdx, qword [rsp + 0xe0]
lea r8, [0x180000000]
jmp case.0x1800e9c09.148
mov esi, 0x65
nop dword [rax]
mov eax, esi
sub eax, 0x65
je 0x1800e9de2
cmp eax, 1
je 0x1800e9faf
jmp 0x1800e9e0d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
neg edi
sbb eax, eax
neg eax
dec eax
mov dword [rsp + 0x30], eax
inc esi
cmp esi, 0x67
jb 0x1800e9dd0
xor r9d, r9d
mov dword [rsp + 0x38], 0xe0
lea r8, [rsp + 0x38]
mov rcx, rbp
lea edx, [r9 + 0x7c]
call fcn.18008b680
mov rdx, qword [rsp + 0xe0]
lea r8, [0x180000000]
mov rsi, rax
mov qword [rsp + 0x60], rax
jmp case.0x1800e9c09.148
mov eax, r14d
sub eax, 0x1c5
je 0x1800e9f82
sub eax, 0x45
je 0x1800e9f24
sub eax, 0x1b
je 0x1800e9ea1
cmp eax, 0x45
jne case.0x1800e9c09.148
lea r8, [rsi + 0xb0]
mov dword [rsp + 0xf0], 0x10
mov r9d, 0x134
lea rdx, [rsp + 0xf0]
mov rcx, rbp
call fcn.1800d9ca0
mov rax, rsi
jmp 0x1800e9fb4
cmp r15, r12
ja case.0x1800e9c09.148
mov rbx, qword [rsp + 0xe0]
mov r13, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x78]
mov ebp, dword [rsp + 0x40]
mov eax, dword [rbx]
lea r8, [rsp + 0xf0]
mov edi, r15d
mov dword [rsp + 0x48], eax
mov r9, r15
mov dword [rsp + 0xf0], ebp
mov edx, 0x3f
lea rcx, [rsp + 0x48]
sub edi, esi
call fcn.1800b2370
mov rcx, qword [rsp + 0x80]
add r15, r13
mov dword [rcx + rax*4], edi
cmp r15, r12
jbe 0x1800e9ec0
mov rbp, qword [rsp + 0xe8]
lea r8, [0x180000000]
mov rsi, qword [rsp + 0x60]
xor ebx, ebx
mov r13, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xe0]
jmp case.0x1800e9c09.148
lea r8, [rsi + 0x88]
mov dword [rsp + 0xf0], 0x10
mov r9d, 0x134
lea rdx, [rsp + 0xf0]
mov rcx, rbp
call fcn.1800d9ca0
lea r8, [rsi + 0x18]
mov dword [rsp + 0xf0], 0x10
mov r9d, 0x134
lea rdx, [rsp + 0xf0]
mov rcx, rbp
call fcn.1800d9ca0
mov rdx, qword [rsp + 0xe0]
lea r8, [0x180000000]
jmp case.0x1800e9c09.148
mov qword [rsp + 0x58], 3
add r14d, 0x60
cmp r14d, dword [rsp + 0x50]
jae 0x1800e9faf
mov rdi, qword [rsp + 0xf8]
jmp 0x1800e9bd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], ebx
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0x30]
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0xc
jmp 0x1800e9fab
mov dword [rsp + 0x30], 0xffffffff
jmp 0x1800e9faf