Function at 0x14004acd0
Capabilities:
Contain obfuscated stackstrings
Empty recycle bin quietly
Empty the recycle bin

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
xor r9d, r9d
test eax, eax
jne 0x14004adbe
mov byte [rbp - 0x40], al
mov byte [rbp - 0x3f], 0x5d
mov byte [rbp - 0x3e], 0x6e
mov byte [rbp - 0x3d], 8
mov byte [rbp - 0x3c], 0x6e
mov byte [rbp - 0x3b], 0x35
mov byte [rbp - 0x3a], 0x6e
mov byte [rbp - 0x39], 0x35
mov byte [rbp - 0x38], 0x6e
mov byte [rbp - 0x37], 0x30
mov byte [rbp - 0x36], 0x6e
mov byte [rbp - 0x35], 0xd
mov byte [rbp - 0x34], 0x6e
mov byte [rbp - 0x33], 0xd
mov byte [rbp - 0x32], 0x6e
mov byte [rbp - 0x31], 0x6e
mov byte [rbp - 0x30], 0x6e
movzx eax, byte [rbp - 0x3f]
movzx eax, byte [rbp - 0x40]
test al, al
jne 0x14004adb5
mov r10d, r9d
nop word [rax + rax]
movzx ecx, byte [rbp + r10 - 0x3f]
mov eax, 0x81020409
sub ecx, 0x6e
imul r8d, ecx, 0x19
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r10 - 0x3f], r8b
inc r10
cmp r10, 0x10
jb 0x14004ad60
lea r14, [rbp - 0x3f]
jmp 0x14004ae68
mov byte [rbp - 0x50], 0
mov byte [rbp - 0x4f], 0x44
mov byte [rbp - 0x4e], 0x4d
mov byte [rbp - 0x4d], 0x63
mov byte [rbp - 0x4c], 0x4d
mov byte [rbp - 0x4b], 0
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4a
mov byte [rbp - 0x48], 0x4d
mov byte [rbp - 0x47], 0x71
mov byte [rbp - 0x46], 0x4d
mov byte [rbp - 0x45], 0x2e
mov byte [rbp - 0x44], 0x4d
mov byte [rbp - 0x43], 0x4d
mov byte [rbp - 0x42], 0x4d
movzx eax, byte [rbp - 0x4f]
movzx eax, byte [rbp - 0x50]
test al, al
jne 0x14004ae64
mov r8, r9
nop dword [rax]
movzx ecx, byte [rbp + r8 - 0x4f]
mov eax, 0x4d
sub eax, ecx
lea ecx, [rax + rax*8]
mov eax, 0x81020409
shl ecx, 2
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 - 0x4f], cl
inc r8
cmp r8, 0xe
jb 0x14004ae10
lea r14, [rbp - 0x4f]
mov byte [rbp - 0x28], 0
mov byte [rbp - 0x27], 0x5e
mov byte [rbp - 0x26], 3
mov byte [rbp - 0x25], 0x28
mov byte [rbp - 0x24], 3
mov byte [rbp - 0x23], 0x37
mov byte [rbp - 0x22], 3
mov byte [rbp - 0x21], 0x4b
mov byte [rbp - 0x20], 3
mov byte [rbp - 0x1f], 0x64
mov byte [rbp - 0x1e], 3
mov byte [rbp - 0x1d], 0x24
mov byte [rbp - 0x1c], 3
mov byte [rbp - 0x1b], 0x20
mov byte [rbp - 0x1a], 3
mov byte [rbp - 0x19], 0
mov byte [rbp - 0x18], 3
mov byte [rbp - 0x17], 0x75
mov byte [rbp - 0x16], 3
mov byte [rbp - 0x15], 0x64
mov byte [rbp - 0x14], 3
mov byte [rbp - 0x13], 0x75
mov byte [rbp - 0x12], 3
mov byte [rbp - 0x11], 0x23
mov byte [rbp - 0x10], 3
mov byte [rbp - 0xf], 0
mov byte [rbp - 0xe], 3
mov byte [rbp - 0xd], 0x27
mov byte [rbp - 0xc], 3
mov byte [rbp - 0xb], 0x24
mov byte [rbp - 0xa], 3
mov byte [rbp - 9], 3
mov byte [rbp - 8], 3
movzx eax, byte [rbp - 0x27]
movzx eax, byte [rbp - 0x28]
test al, al
jne 0x14004af55
nop dword [rax + rax]
movzx ecx, byte [rbp + r9 - 0x27]
mov eax, 0x81020409
sub ecx, 3
imul r8d, ecx, 0x33
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 - 0x27], r8b
inc r9
cmp r9, 0x20
jb 0x14004af00
mov rax, qword gs:[0x58]
mov rbx, qword [0x140146cd8]
mov edi, 1
add rdi, qword [rax]
cmp byte [rdi], 0
je 0x14004af87
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rcx, rbx
call fcn.140026390
mov byte [rdi], 0
lea rdx, [rbp - 0x27]
call fcn.140031610
cmp byte [rdi], 0
je 0x14004afaa
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rcx, rbx
call fcn.140026390
mov byte [rdi], 0
mov rdx, r14
call fcn.140031610
mov rcx, rbx
call fcn.140026320
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret