Function at 0x1400149e0
Capabilities:
Delete directory
Delete volume shadow copies
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor edi, edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x40
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsSettingSync_
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x1417aa2a0]
call fcn.140010800
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140012510
mov rcx, rax
call fcn.140010ac0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140014a96
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x1417aa440]
call fcn.140010800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14000cd00
mov rcx, rax
call fcn.140010ac0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140014ad6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014ad1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152c5
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x50
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsExplorerThumbCacheToDelete_
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x1417aa2a0]
call fcn.140010800
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140012510
mov rcx, rax
call fcn.140010ac0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140014b78
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x1417aa440]
call fcn.140010800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14000cd00
mov rcx, rax
call fcn.140010ac0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140014bb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014bb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152cb
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x49
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftTerminal_Server_ClientCache_
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x1417aa2a0]
call fcn.140010800
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140012510
mov rcx, rax
call fcn.140010ac0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140014c5a
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x1417aa440]
call fcn.140010800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14000cd00
mov rcx, rax
call fcn.140010ac0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140014c9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014c95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152d1
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x3e
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsINetCache_
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x1417aa2a0]
call fcn.140010800
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140012510
mov rcx, rax
call fcn.140010ac0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140014d3c
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x1417aa440]
call fcn.140010800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14000cd00
mov rcx, rax
call fcn.140010ac0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140014d7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014d77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152d7
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x42
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsWebCache.log
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rcx, [rbp - 0x20]
call fcn.1400144f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140014dec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014de7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152dd
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x19
lea rdx, str.C:windowslogscbs.log
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rcx, [rbp - 0x20]
call fcn.1400144f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140014e5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014e57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152e3
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x32
lea rdx, str.C:Users_USERNAME_AppDataLocalCrashDumps.log
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rcx, [rbp - 0x20]
call fcn.1400144f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140014ecc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014ec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152e9
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x1d
lea rdx, str.C:WindowsLogsMoSetup.log
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rcx, [rbp - 0x20]
call fcn.1400144f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140014f3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014f37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152ef
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x18
lea rdx, str.C:WindowsPanther.log
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rcx, [rbp - 0x20]
call fcn.1400144f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140014fac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014fa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152f5
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x14
lea rdx, str.C:Windowsinf.log
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rcx, [rbp - 0x20]
call fcn.1400144f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14001501c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015017
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152fb
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x15
lea rdx, str.C:Windowslogs.log
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rcx, [rbp - 0x20]
call fcn.1400144f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14001508c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015087
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015301
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x25
lea rdx, str.C:WindowsSoftwareDistribution.log
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rcx, [rbp - 0x20]
call fcn.1400144f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1400150fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400150f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015307
call fcn.1400c1b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x1e
lea rdx, str.C:WindowsMicrosoft.NET.log
lea rcx, [rbp - 0x20]
call fcn.140005cb0
nop
lea rcx, [rbp - 0x20]
call fcn.1400144f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14001516c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015167
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400152bf
call fcn.1400c1b20
lea rcx, str.rd__s__q__C:MSOCache_
call fcn.140014880
lea rcx, str.rd__s__q__C:UsersPublicShared_Files_
call fcn.140014880
lea rcx, str.RunDll32.exe_InetCpl.cpl_ClearMyTracksByProcess_8
call fcn.140014880
lea rcx, str.erase___LOCALAPPDATA_MicrosoftWindowsTempor1.___f__s__q
call fcn.140014880
lea rcx, str.netsh_interface_set_interface__Local_Area_Connection__disable
call fcn.140014880
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalIconCache.db_
call fcn.140014880
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalupdater.log_
call fcn.140014880
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalIconCache.db_
call fcn.140014880
lea rcx, str.del___localappdata_MicrosoftFeeds___s__f__q
call fcn.140014880
lea rcx, str.del__s__f__q_C:WindowsPublicLibraries.
call fcn.140014880
lea rcx, str.del__s__f__q__windir__system32dllcache.
call fcn.140014880
lea rcx, str.rd__s__q__windir__system32dllcache
call fcn.140014880
lea rcx, str.md__windir__system32dllcache
call fcn.140014880
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryOBJECTS.DATA._
call fcn.140014880
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryINDEX.BTR._
call fcn.140014880
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryMAPPING3.MAP._
call fcn.140014880
lea rcx, str.ipconfig__flushdns
call fcn.1400cc4e4
lea rcx, str.netsh_interface_ip_delete_arpcache
call fcn.1400cc4e4
lea rcx, str.certutil__URLCache__delete
call fcn.1400cc4e4
lea rcx, str.netsh_winsock_reset
call fcn.1400cc4e4
lea rcx, str.netsh_advfirewall_reset
call fcn.1400cc4e4
lea rcx, str.ipconfig__flushdns
call fcn.1400cc4e4
lea rcx, str.netsh_interface_ip_delete_arpcache
call fcn.1400cc4e4
lea rcx, str.certutil__URLCache__delete
call fcn.1400cc4e4
lea rcx, str.netsh_winsock_reset
call fcn.1400cc4e4
lea rcx, str.netsh_advfirewall_reset
call fcn.1400cc4e4
lea rcx, str.vssadmin_delete_shadows
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
jmp fcn.1400cc4e4
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3
call fcn.1400c7f74
int3