Function at 0x1800b9bf0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x1800f6ae8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rdx
mov qword [rsp + 0x28], rdx
mov r13d, ecx
mov dword [rsp + 0x24], ecx
lea eax, [rcx + 0x10]
lea rsi, [0x180000000]
mov ecx, 0x65
cmp r13d, eax
jae 0x1800b9d95
lea ebx, [r13 - 0x94]
lea edi, [rcx - 0x55]
lea edx, [rcx + 6]
lea r14d, [rcx - 0x26]
lea r12d, [rcx + 3]
lea r8d, [rcx - 0x12]
lea r9d, [rcx + 9]
lea r10d, [rcx + 0x10]
lea r11d, [rcx - 4]
lea r13d, [rcx - 0x11]
cmp ebx, 0x23
ja case.default.0x1800b9c8d
movzx eax, byte [rsi + rbx + 0xba418]
mov ecx, dword [rsi + rax*4 + 0xba3d4]
add rcx, rsi
jmp rcx
mov word [rbp - 0x53], r14w
jmp case.0x1800b9c8d.16
mov word [rbp - 0x47], r12w
jmp case.0x1800b9c8d.16
mov dword [rbp - 1], 0x780065
mov ecx, 0x65
mov word [rbp + 3], cx
jmp case.default.0x1800b9c8d
mov dword [rbp - 9], 0x67006d
mov dword [rbp - 5], 0x2e0072
jmp case.0x1800b9c8d.16
mov word [rbp - 0xb], dx
jmp case.0x1800b9c8d.16
mov word [rbp - 0x59], r8w
jmp case.0x1800b9c8d.16
mov dword [rbp - 0x4e], 0x617320
mov dword [rbp - 0x4b], 0x6b615320
jmp case.0x1800b9c8d.16
mov r8d, 3
lea rdx, [0x1800e51ac]
lea rcx, [rbp - 0x71]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x62
mov word [rbp - 0x6f], ax
mov edx, 0x6b
lea r8d, [rdx - 0x18]
lea r9d, [rdx + 3]
lea r10d, [rdx + 0xa]
lea r11d, [rdx - 0xa]
jmp case.0x1800b9c8d.16
mov word [rbp - 0x43], r9w
jmp case.0x1800b9c8d.16
mov word [rbp - 0x58], r10w
jmp case.0x1800b9c8d.16
mov word [rbp - 0x46], r11w
jmp case.0x1800b9c8d.16
mov word [rbp - 0x52], r13w
mov dword [rbp - 0x51], 0x656d69
jmp case.0x1800b9c8d.16
mov dword [rbp - 0x57], 0x72656d6d
jmp case.0x1800b9c8d.16
mov rdx, qword [r15 + 0x30]
mov ecx, 0x8c
call fcn.1800afb40
jmp 0x1800b9d11
mov dword [rbp - 0x11], 0x610074
mov eax, 0x73
mov word [rbp - 0xd], ax
jmp case.0x1800b9c8d.16
mov eax, 0x696c
mov word [rbp - 0x45], ax
mov ecx, 0x65
inc ebx
sub rdi, 1
jne 0x1800b9c72
mov r13d, dword [rsp + 0x24]
lea eax, [r13 + 0xf]
xor edi, edi
movzx r12d, byte [rsp + 0x20]
cmp r13d, eax
jae 0x1800b9ef4
lea ebx, [r13 - 0xa4]
mov edi, 0xf
lea edx, [rdi + 0x5d]
lea r8d, [rdi + 0x57]
lea r9d, [rdi + 0x5e]
lea r14d, [rdi + 0x63]
lea r11d, [rdi + 0x65]
lea r10d, [rdi + 0x69]
lea r13d, [rdi + 0x61]
lea r15d, [rdi + 0x1f]
cmp ebx, 0x17
ja case.default.0x1800b9de8
mov ecx, dword [rsi + rbx*4 + 0xba43c]
add rcx, rsi
jmp rcx
mov dword [rbp - 0x3b], 0x6d0066
jmp case.0x1800b9de8.7
mov ecx, 0x65
mov word [rbp - 0x64], cx
jmp case.default.0x1800b9de8
mov eax, dword [str.rVis]
mov dword [rbp - 0x6b], eax
movzx eax, word [0x1800e51b8]
mov word [rbp - 0x67], ax
movzx eax, byte [0x1800e51ba]
mov byte [rbp - 0x65], al
jmp case.0x1800b9de8.7
mov dword [rbp - 0x37], 0x6e006f
mov word [rbp - 0x33], r15w
jmp case.0x1800b9de8.7
mov ecx, 0x65
mov word [rbp - 0x3f], cx
jmp case.default.0x1800b9de8
lea rcx, [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edx, 0x6c
lea r8d, [rdx - 6]
lea r9d, [rdx + 1]
lea r10d, [rdx + 0xc]
lea r11d, [rdx + 8]
jmp case.0x1800b9de8.7
mov r8d, 1
lea rdx, [0x1800deaa0]
lea rcx, [rbp - 0x71]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x1800b9e50
movzx eax, word [0x1800e51bc]
mov word [rbp - 0x62], ax
movzx eax, byte [0x1800e51be]
mov byte [rbp - 0x60], al
mov r12b, 1
jmp case.0x1800b9de8.7
mov word [rbp - 0x3d], r14w
jmp case.0x1800b9de8.7
mov word [rbp - 0x41], r13w
jmp case.0x1800b9de8.7
mov ecx, 0x65
mov dword [rbp - 0x2d], ecx
jmp case.default.0x1800b9de8
xor eax, eax
mov word [rbp + 5], ax
jmp case.0x1800b9de8.7
movzx eax, word [0x1800e51c0]
mov word [rbp - 0x6e], ax
mov word [rbp - 0x6c], r11w
jmp case.0x1800b9de8.7
mov word [rbp - 0x65], dx
jmp case.0x1800b9de8.7
mov dword [rbp - 0x31], 0x780065
mov ecx, 0x65
inc ebx
sub rdi, 1
jne 0x1800b9dd5
mov r15, qword [rsp + 0x28]
mov r13d, dword [rsp + 0x24]
mov esi, r13d
imul eax, r13d, 0xf0
mov dword [rsp + 0x24], eax
movzx ebx, byte [rsp + 0x20]
cmp r13d, eax
ja 0x1800ba046
movabs rdx, 0x7000780065
mov r10d, 0x6f
lea r11d, [r10 - 0xc]
movabs r8, 0x2e00340036
movabs r9, 0x6500780065
mov r14, qword [rsp + 0x28]
movabs rax, 0x63006f0072
cmp esi, 0x2274
ja 0x1800ba0a7
je 0x1800ba092
cmp esi, 0xbf4
ja 0x1800ba02e
je 0x1800ba025
mov eax, esi
sub eax, 0xa4
je 0x1800ba00c
sub eax, 0x10
je 0x1800ba003
cmp eax, 0xa30
jne 0x1800b9feb
test r12b, r12b
je 0x1800b9feb
mov edi, 0x115
mov eax, edi
sub eax, 0x114
je 0x1800b9fb0
cmp eax, 1
jne 0x1800b9fb9
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
jmp 0x1800b9fb9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec edi
cmp edi, 0x113
ja 0x1800b9f92
movabs rdx, 0x7000780065
movabs r8, 0x2e00340036
movabs r9, 0x6500780065
mov r10d, 0x6f
lea r11d, [r10 - 0xc]
mov eax, r13d
shl eax, 4
add esi, eax
cmp esi, dword [rsp + 0x24]
ja 0x1800ba046
xor edi, edi
lea ecx, [rdi + 0x65]
jmp 0x1800b9f3d
mov dword [rbp - 0x29], 0x720070
jmp 0x1800b9feb
lea rdx, [rbp - 0x71]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov r14, rax
test rax, rax
jne 0x1800b9fc3
xor r12b, r12b
jmp 0x1800b9fc3
mov dword [rbp - 0x25], 0x63006f
jmp 0x1800b9feb
cmp esi, 0x1524
je 0x1800ba086
cmp esi, 0x1734
je 0x1800ba076
cmp esi, 0x1f64
jne 0x1800b9feb
movzx eax, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800d1090
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov word [rbp - 0x21], cx
mov dword [rbp - 0x1f], 0x700078
jmp 0x1800b9feb
cmp qword [r15], 0xffffffffffffffff
setne bl
jmp 0x1800b9feb
mov eax, 0x2e
mov word [rbp - 0x1b], ax
mov dword [rbp - 0x19], 0x780065
jmp 0x1800b9feb
cmp esi, 0x4f74
ja 0x1800ba0f8
je 0x1800ba0ef
cmp esi, 0x2db4
je 0x1800ba0e3
cmp esi, 0x38f4
je 0x1800ba0d6
cmp esi, 0x4434
jne 0x1800b9feb
mov qword [rbp + 9], rax
jmp 0x1800b9feb
mov eax, 0x70
mov dword [rbp + 7], eax
jmp 0x1800b9feb
mov dword [rbp - 0x15], 0x65
jmp 0x1800b9feb
mov qword [rbp + 0xf], rdx
jmp 0x1800b9feb
cmp esi, 0x5ab4
je 0x1800ba3bd
cmp esi, 0x65f4
je 0x1800ba28e
cmp esi, 0x7134
jne 0x1800b9feb
mov qword [rsp + 0x48], rdi
mov qword [rbp - 0x79], 7
mov word [rsp + 0x38], di
lea rax, [rbp - 0x29]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800ba140
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x38]
call fcn.1800354e0
nop
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x1800ba186
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x10], xmm1
mov eax, 7
mov word [rsp + 0x38], di
add qword [r15 + 8], 0x20
jmp 0x1800ba197
lea r8, [rsp + 0x38]
mov rcx, r15
call fcn.180002dc0
mov rax, qword [rbp - 0x79]
cmp rax, 8
jb 0x1800ba1d4
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ba1cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ba3ca
call fcn.1800d08e4
mov qword [rsp + 0x48], rdi
mov qword [rbp - 0x79], 7
mov word [rsp + 0x38], di
lea rax, [rbp + 7]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800ba1f1
lea rdx, [rbp + 7]
lea rcx, [rsp + 0x38]
call fcn.1800354e0
nop
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x1800ba237
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x38], di
add qword [r15 + 8], 0x20
jmp 0x1800ba248
lea r8, [rsp + 0x38]
mov rcx, r15
call fcn.180002dc0
mov rdx, qword [rbp - 0x79]
cmp rdx, 8
jb 0x1800b9fc3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1800ba284
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ba3ca
call fcn.1800d08e4
jmp 0x1800b9fc3
mov qword [rsp + 0x48], rdi
mov qword [rbp - 0x79], 7
mov word [rsp + 0x38], di
lea rax, [rbp - 0x11]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800ba2b0
lea rdx, [rbp - 0x11]
lea rcx, [rsp + 0x38]
call fcn.1800354e0
nop
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x1800ba2f6
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x10], xmm1
mov eax, 7
mov word [rsp + 0x38], di
add qword [r15 + 8], 0x20
jmp 0x1800ba307
lea r8, [rsp + 0x38]
mov rcx, r15
call fcn.180002dc0
mov rax, qword [rbp - 0x79]
cmp rax, 8
jb 0x1800ba344
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ba33f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ba3ca
call fcn.1800d08e4
mov qword [rsp + 0x48], rdi
mov qword [rbp - 0x79], 7
mov word [rsp + 0x38], di
lea rax, [rbp - 0x41]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800ba361
lea rdx, [rbp - 0x41]
lea rcx, [rsp + 0x38]
call fcn.1800354e0
nop
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x1800ba3a7
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x38], di
add qword [r15 + 8], 0x20
jmp 0x1800ba3b8
lea r8, [rsp + 0x38]
mov rcx, r15
call fcn.180002dc0
mov rdx, qword [rbp - 0x79]
jmp 0x1800ba248
mov qword [rbp + 0x15], r8
mov qword [rbp + 0x1b], r9
jmp 0x1800b9feb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3