Function at 0x1400856b0
Capabilities:
Create process on windows
Self delete

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsCloudStore
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:WindowsINF
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:ProgramData_username_MicrosoftXboxLiveNSALCache
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete_HKLMSYSTEMControlSet001ServicesBEService__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:UsersPublicDocuments
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:WindowsPrefetch
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalD3DSCache
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalCrashReportClient
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Windows_temp
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalMicrosoftWindowsSettingSyncmetastore
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:WindowsSoftwareDistributionDataStoreLogs
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:ProgramDataMicrosoftWindowsWERTemp
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalAMDDxCache
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q__C:Users_username_AppDataLocalNVIDIA_Corporation
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:WindowsPrefetch
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str._del__s__f__a:h___a_:_a___q_C:Usersusername_AppDataLocalPackagesMicrosoft.Windows.Cortana_cw5n1h2txyewy.
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str._del__s__f__a:h___a_:_a___q_C:Users_username_AppDataLocalMicrosoftWindowsWebCache.
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalPackagesMicrosoft.XboxGamingOverlay_8wekyb3d8bbweAC
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalPackagesMicrosoft.XboxGamingOverlay_8wekyb3d8bbweLocalCache
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalPackagesMicrosoft.XboxGamingOverlay_8wekyb3d8bbweSettings
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q__C:Users_username_AppDataLocalNVIDIA_Corporation
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.del__f__s__q_C:ProgramDataMicrosoftDataMartPaidWiFiNetworksCache
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.del__f__s__q_C:ProgramDataMicrosoftDataMartPaidWiFiRules
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:WindowsServiceProfilesNetworkServiceAppDataLocalMicrosoftWindowsDeliveryOptimizationCache
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalTemp
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalMicrosoftWindowsINetCache
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalMicrosoftWindowsINetCookies
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_AppDataLocalMicrosoftWindowsHistory
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:Users_username_Intel
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q_C:WindowsSystem32config_systemprofileAppDataLocalLowMicrosoftCryptnetUrlCacheMetaData
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.rmdir__s__q__C:Users_username_AppDataLocalMicrosoftFeeds_Cache
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Success..__n
lea rcx, [0x140412ac0]
add rsp, 0x28
jmp fcn.14005bdd0