Function at 0x1800249e0
Capabilities:
Delete file
Delete service
Get common file path
Get startup folder
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1df0]
mov eax, 0x1ef0
call fcn.180035e50
sub rsp, rax
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rbp + 0x1de0], rax
call fcn.180024900
xor edx, edx
lea rcx, [rbp + 0x350]
mov r8d, 0x208
call fcn.18003b0b0
xor r9d, r9d
lea rax, [rbp + 0x350]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor edx, edx
lea rcx, [rbp + 0x560]
mov r8d, 0x208
call fcn.18003b0b0
lea r8, [rbp + 0x350]
lea rdx, str._sDisplaySessionContainers.log
lea rcx, [rbp + 0x560]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.18003b0b0
xor r9d, r9d
lea rdx, [rsp + 0x30]
xor ecx, ecx
lea r8d, [r9 + 0x2e]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor edx, edx
lea rcx, [rbp + 0x770]
mov r8d, 0x208
call fcn.18003b0b0
mov r8d, 0x104
lea rdx, [rbp + 0x770]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rbp + 0x980]
mov r8d, 0x208
call fcn.18003b0b0
lea r8, [rbp + 0x770]
lea rdx, [0x1800772cc]
lea rcx, [rbp + 0x980]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x5c
lea rcx, [rbp + 0x980]
call fcn.180023100
mov rbx, rax
test rax, rax
je 0x180024b20
xor eax, eax
mov word [rbx], ax
xor edx, edx
lea rcx, [rbp + 0xb90]
mov r8d, 0x208
call fcn.18003b0b0
mov r8, rbx
lea rdx, str._sApp.dat
lea rcx, [rbp + 0xb90]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0xb90]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.18003b0b0
xor r9d, r9d
lea rdx, [rbp + 0x140]
xor ecx, ecx
lea r8d, [r9 + 7]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.DiagnosticsHub.true
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0xda0]
mov r8d, 0x208
call fcn.18003b0b0
lea r8, [rsp + 0x30]
lea rdx, str._sDiagnosticsHub.true
lea rcx, [rbp + 0xda0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0xda0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0xfb0]
mov r8d, 0x208
call fcn.18003b0b0
lea r8, [rsp + 0x30]
lea rdx, str._sDiagnosticsHub.html
lea rcx, [rbp + 0xfb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0xfb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x180024c66
mov r8d, 0x10000
lea rdx, str.MyPyService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x180024c5d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
lea rcx, [rbp + 0x11c0]
mov r8d, 0x208
call fcn.18003b0b0
lea r8, [rsp + 0x30]
lea rdx, str._s_nssm.exe
lea rcx, [rbp + 0x11c0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x11c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x13d0]
mov r8d, 0x208
call fcn.18003b0b0
lea r8, [rsp + 0x30]
lea rdx, str._s_nssminstall.html
lea rcx, [rbp + 0x13d0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x13d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones01201
mov rcx, 0xffffffff80000001
call fcn.180024580
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LOCALMACHINE_LOCKDOWNSettingsLOCALMACHINE_CD_UNLOCK
mov rcx, 0xffffffff80000001
call fcn.180024580
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LOCALMACHINE_LOCKDOWNiexplore.exe
mov rcx, 0xffffffff80000001
call fcn.180024580
lea rdx, str..true
mov rcx, 0xffffffff80000000
call fcn.180024580
lea rdx, str.AAATURE
mov rcx, 0xffffffff80000000
call fcn.180024580
lea rdx, [0x180077c18]
mov rcx, 0xffffffff80000001
call fcn.180024580
xor edx, edx
lea rcx, [rbp + 0x15e0]
mov r8d, 0x800
call fcn.18003b0b0
call fcn.18000eb40
test eax, eax
lea rdx, [0x180077c20]
lea r8, [0x180078e48]
cmovne r8, rdx
lea rcx, [rbp + 0x15e0]
lea rdx, str.Console_s
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x15e0]
mov rcx, 0xffffffff80000001
call fcn.180024580
lea rdx, str.ConsolepInstallTime
mov rcx, 0xffffffff80000001
call fcn.180024580
call fcn.1800245d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]