Function at 0x14000f170
Capabilities:
Delete directory
Delete volume shadow copies
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor edi, edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x40
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsSettingSync_
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x1403b44e0]
call fcn.14000a4c0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000c950
mov rcx, rax
call fcn.14000a780
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14000f226
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x1403b4680]
call fcn.14000a4c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140006030
mov rcx, rax
call fcn.14000a780
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa55
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x50
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsExplorerThumbCacheToDelete_
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x1403b44e0]
call fcn.14000a4c0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000c950
mov rcx, rax
call fcn.14000a780
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14000f308
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x1403b4680]
call fcn.14000a4c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140006030
mov rcx, rax
call fcn.14000a780
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f348
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f343
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa5b
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x49
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftTerminal_Server_ClientCache_
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x1403b44e0]
call fcn.14000a4c0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000c950
mov rcx, rax
call fcn.14000a780
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14000f3ea
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x1403b4680]
call fcn.14000a4c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140006030
mov rcx, rax
call fcn.14000a780
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f42a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f425
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa61
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8d, 0x3e
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsINetCache_
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rdx, str.Excluindo_diret
lea rcx, [0x1403b44e0]
call fcn.14000a4c0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000c950
mov rcx, rax
call fcn.14000a780
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14000f4cc
lea rdx, str.Erro_ao_excluir_diret
lea rcx, [0x1403b4680]
call fcn.14000a4c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140006030
mov rcx, rax
call fcn.14000a780
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f50c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f507
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa67
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x42
lea rdx, str.C:Users_USERNAME_AppDataLocalMicrosoftWindowsWebCache.log
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rcx, [rbp - 0x20]
call fcn.14000ec20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f57c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f577
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa6d
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x19
lea rdx, str.C:windowslogscbs.log
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rcx, [rbp - 0x20]
call fcn.14000ec20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f5ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f5e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa73
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x32
lea rdx, str.C:Users_USERNAME_AppDataLocalCrashDumps.log
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rcx, [rbp - 0x20]
call fcn.14000ec20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f65c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa79
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x1d
lea rdx, str.C:WindowsLogsMoSetup.log
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rcx, [rbp - 0x20]
call fcn.14000ec20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f6cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f6c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa7f
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x18
lea rdx, str.C:WindowsPanther.log
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rcx, [rbp - 0x20]
call fcn.14000ec20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f73c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa85
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x14
lea rdx, str.C:Windowsinf.log
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rcx, [rbp - 0x20]
call fcn.14000ec20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f7ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f7a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa8b
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x15
lea rdx, str.C:Windowslogs.log
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rcx, [rbp - 0x20]
call fcn.14000ec20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f81c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f817
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa91
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x25
lea rdx, str.C:WindowsSoftwareDistribution.log
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rcx, [rbp - 0x20]
call fcn.14000ec20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f88c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f887
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa97
call fcn.1400bad8c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x1e
lea rdx, str.C:WindowsMicrosoft.NET.log
lea rcx, [rbp - 0x20]
call fcn.140001b90
nop
lea rcx, [rbp - 0x20]
call fcn.14000ec20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000f8fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f8f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa4f
call fcn.1400bad8c
lea rcx, str.rd__s__q__C:MSOCache_
call fcn.14000f010
lea rcx, str.rd__s__q__C:UsersPublicShared_Files_
call fcn.14000f010
lea rcx, str.RunDll32.exe_InetCpl.cpl_ClearMyTracksByProcess_8
call fcn.14000f010
lea rcx, str.erase___LOCALAPPDATA_MicrosoftWindowsTempor1.___f__s__q
call fcn.14000f010
lea rcx, str.netsh_interface_set_interface__Local_Area_Connection__disable
call fcn.14000f010
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalIconCache.db_
call fcn.14000f010
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalupdater.log_
call fcn.14000f010
lea rcx, str.del__a__q__s__C:Users_Username_AppDataLocalIconCache.db_
call fcn.14000f010
lea rcx, str.del___localappdata_MicrosoftFeeds___s__f__q
call fcn.14000f010
lea rcx, str.del__s__f__q_C:WindowsPublicLibraries.
call fcn.14000f010
lea rcx, str.del__s__f__q__windir__system32dllcache.
call fcn.14000f010
lea rcx, str.rd__s__q__windir__system32dllcache
call fcn.14000f010
lea rcx, str.md__windir__system32dllcache
call fcn.14000f010
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryOBJECTS.DATA._
call fcn.14000f010
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryINDEX.BTR._
call fcn.14000f010
lea rcx, str.rmdir__s__q___systemdrive_WindowsSystem32wbemRepositoryMAPPING3.MAP._
call fcn.14000f010
lea rcx, str.ipconfig__flushdns
call fcn.1400c687c
lea rcx, str.netsh_interface_ip_delete_arpcache
call fcn.1400c687c
lea rcx, str.certutil__URLCache__delete
call fcn.1400c687c
lea rcx, str.netsh_winsock_reset
call fcn.1400c687c
lea rcx, str.netsh_advfirewall_reset
call fcn.1400c687c
lea rcx, str.ipconfig__flushdns
call fcn.1400c687c
lea rcx, str.netsh_interface_ip_delete_arpcache
call fcn.1400c687c
lea rcx, str.certutil__URLCache__delete
call fcn.1400c687c
lea rcx, str.netsh_winsock_reset
call fcn.1400c687c
lea rcx, str.netsh_advfirewall_reset
call fcn.1400c687c
lea rcx, str.vssadmin_delete_shadows
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
jmp fcn.1400c687c
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3
call fcn.1400c14a8
int3