Function at 0x1400071e0
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push rdi
mov eax, 0x1860
call fcn.14007a110
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1870], rbx
mov qword [rsp + 0x1878], rbp
mov qword [rsp + 0x1880], rsi
mov rax, qword [0x1400a5de0]
xor rax, rsp
mov qword [rsp + 0x1858], rax
mov rbx, qword [0x1400ae080]
test rbx, rbx
jne 0x1400072e5
mov ecx, 0x310
call fcn.1400278b8
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400072dc
call fcn.14002790c
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14000726c
mov ecx, 0x80004005
call fcn.140007e00
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov word [rbx + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rbx
call fcn.140008260
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x1400072de
xor ebx, ebx
mov qword [0x1400ae080], rbx
lea rdx, str.UninstallSIService__
mov rcx, rbx
call fcn.14000d860
mov word [rsp + 0x30], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x32]
call fcn.140057420
mov word [rsp + 0x640], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x642]
call fcn.140057420
mov rdi, qword [0x1400ae090]
test rdi, rdi
jne 0x140007391
lea ecx, [rdi + 0x30]
call fcn.1400278b8
mov rdi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140007388
mov ecx, 0x20
call fcn.1400278b8
nop
test rax, rax
je 0x140007377
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
jmp 0x140007379
xor eax, eax
mov qword [rdi + 0x28], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x14000738a
xor edi, edi
mov qword [0x1400ae090], rdi
mov r9d, 0x104
lea r8, [rsp + 0x640]
lea rdx, str.SERVICE_NAME
mov rcx, rdi
call fcn.140012ca0
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140087db8]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400539f0
lea r8, [rsp + 0x640]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400539f0
mov word [rsp + 0x850], 0
mov word [rsp + 0x240], 0
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x242]
call fcn.140057420
lea r9, str._stop
lea r8, [0x14008a8e0]
mov edx, 0x200
lea rcx, [rsp + 0x240]
call fcn.140052ea0
lea r8, [rsp + 0x240]
mov edx, 0x800
lea rcx, [rsp + 0x850]
call fcn.1400539f0
lea r8, [rsp + 0x850]
lea rdx, [rsp + 0x30]
mov ecx, 1
call fcn.14000eea0
mov word [rsp + 0x850], 0
mov word [rsp + 0x240], 0
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x242]
call fcn.140057420
lea r9, str._uninstall
lea r8, [0x14008a8e0]
mov edx, 0x200
lea rcx, [rsp + 0x240]
call fcn.140052ea0
lea r8, [rsp + 0x240]
mov edx, 0x800
lea rcx, [rsp + 0x850]
call fcn.1400539f0
lea r8, [rsp + 0x850]
lea rdx, [rsp + 0x30]
mov ecx, 1
call fcn.14000eea0
xor esi, esi
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400075f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 2
je 0x1400075d2
mov rbx, qword [0x1400ae080]
test rbx, rbx
jne 0x1400075be
mov ecx, 0x310
call fcn.1400278b8
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400075b5
call fcn.14002790c
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x1400075ea
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov word [rbx + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rbx
call fcn.140008260
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x1400075b7
xor ebx, ebx
mov qword [0x1400ae080], rbx
mov r9d, esi
lea r8, str.Attempt__d._DeleteFile_service_exe_failed
mov edx, ebp
mov rcx, rbx
call fcn.14000daa0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add esi, 1
cmp esi, 2
jae 0x1400075f5
jmp 0x1400074e1
mov ecx, 0x80004005
call fcn.140007e00
nop
mov rcx, qword [rsp + 0x1858]
xor rcx, rsp
call fcn.1400524a0
lea r11, [rsp + 0x1860]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret