Function at 0x140002a10
Capabilities:
Empty the recycle bin
Execute command
Self delete

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140093040]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x14008abd0]
movdqu xmmword [rbp - 9], xmm1
mov rax, qword [str.del__Q]
mov dword [rbp - 0x19], eax
movzx eax, word [0x14005c7a4]
mov word [rbp - 0x15], ax
movzx eax, byte [0x14005c7a6]
mov byte [rbp - 0x13], al
mov byte [rbp - 0x12], 0
movups xmmword [rbp + 0x27], xmm0
mov ecx, 0x30
call fcn.1400598b0
mov qword [rbp + 0x27], rax
movdqa xmm0, xmmword [0x14008abf0]
movdqu xmmword [rbp + 0x37], xmm0
movups xmm1, xmmword [str.C:WindowsPrefetchRADIANT..pf]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14005c7b8]
movups xmmword [rax + 0x10], xmm0
mov byte [rax + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov ecx, 0x20
call fcn.1400598b0
mov rdx, rax
mov qword [rbp + 7], rax
movdqa xmm0, xmmword [0x14008abe0]
movdqu xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [str.C:WindowsPrefetchCMD.EXE.pf]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x14005c7e0]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14005c7e8]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14005c7ec]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x14005c7ee]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
lea r8, [rbp + 0x27]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140005a70
cmp qword [rax + 0x18], 0xf
jbe 0x140002b1c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140002b63
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059b34
lea r8, [rbp + 7]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140005a70
cmp qword [rax + 0x18], 0xf
jbe 0x140002b7e
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140002bc5
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bc0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059b34
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 6]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140002c13
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c0d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059b34
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x140002c52
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059b34
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x140002c90
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059b34
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140059890
add rsp, 0xb0
pop rbp
ret