Function at 0x1400171a0
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push rdi
mov eax, 0x1860
call fcn.1400dab40
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1870], rbx
mov qword [rsp + 0x1878], rbp
mov qword [rsp + 0x1880], rsi
mov rax, qword [0x14012ce40]
xor rax, rsp
mov qword [rsp + 0x1858], rax
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140017215
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14001720c
mov rcx, rax
call fcn.140050830
jmp 0x14001720e
xor eax, eax
mov qword [0x1401370f0], rax
lea rdx, str.UninstallSIService__
mov rcx, rax
call fcn.140050c00
mov word [rsp + 0x30], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x32]
call fcn.1400b57e0
mov word [rsp + 0x640], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x642]
call fcn.1400b57e0
mov rdi, qword [0x140136ce8]
test rdi, rdi
jne 0x1400172c1
lea ecx, [rdi + 0x30]
call fcn.140084d88
mov rdi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400172b8
mov ecx, 0x20
call fcn.140084d88
nop
test rax, rax
je 0x1400172a7
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
jmp 0x1400172a9
xor eax, eax
mov qword [rdi + 0x28], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x1400172ba
xor edi, edi
mov qword [0x140136ce8], rdi
mov r9d, 0x104
lea r8, [rsp + 0x640]
lea rdx, str.SERVICE_NAME
mov rcx, rdi
call fcn.14004a950
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x1400ec900]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400b2160
lea r8, [rsp + 0x640]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400b2160
mov word [rsp + 0x850], 0
mov word [rsp + 0x240], 0
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x242]
call fcn.1400b57e0
lea r9, str._stop
lea r8, [0x1400f5f70]
mov edx, 0x200
lea rcx, [rsp + 0x240]
call fcn.1400b1010
lea r8, [rsp + 0x240]
mov edx, 0x800
lea rcx, [rsp + 0x850]
call fcn.1400b2160
lea r8, [rsp + 0x850]
lea rdx, [rsp + 0x30]
mov ecx, 1
call fcn.14004eb10
mov word [rsp + 0x850], 0
mov word [rsp + 0x240], 0
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x242]
call fcn.1400b57e0
lea r9, str._uninstall
lea r8, [0x1400f5f70]
mov edx, 0x200
lea rcx, [rsp + 0x240]
call fcn.1400b1010
lea r8, [rsp + 0x240]
mov edx, 0x800
lea rcx, [rsp + 0x850]
call fcn.1400b2160
lea r8, [rsp + 0x850]
lea rdx, [rsp + 0x30]
mov ecx, 1
call fcn.14004eb10
xor esi, esi
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140017525
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 2
je 0x140017502
mov rbx, qword [0x1401370f0]
test rbx, rbx
jne 0x1400174ee
mov ecx, 0x310
call fcn.140084d88
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400174e5
call fcn.140087bd0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14001751a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov word [rbx + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400f5b5c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x1400f5b5c]
mov rcx, rbx
call fcn.140006070
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x26c]
mov word [rcx], 0
lea r8, [0x1400f6478]
mov edx, 0x50
call fcn.1400b1b70
nop
jmp 0x1400174e7
xor ebx, ebx
mov qword [0x1401370f0], rbx
mov r9d, esi
lea r8, str.Attempt__d._DeleteFile_service_exe_failed
mov edx, ebp
mov rcx, rbx
call fcn.140050e40
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add esi, 1
cmp esi, 2
jae 0x140017525
jmp 0x140017411
mov ecx, 0x80004005
call fcn.140006300
nop
mov rcx, qword [rsp + 0x1858]
xor rcx, rsp
call fcn.1400b09d0
lea r11, [rsp + 0x1860]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret