Function at 0x1400d8900
Capabilities:
Delete directory
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1360]
mov eax, 0x1460
call fcn.1401e33b0
sub rsp, rax
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x1350], rax
mov rbx, rcx
call fcn.1401cf250
cmp dword [rbx + 0x1f0], 0
jne 0x1400d8968
mov rcx, qword [rbx + 0x1e8]
test rcx, rcx
je 0x1400d8968
mov r9d, dword [0x1402bbd98]
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_PostMessageW]
xor edx, edx
lea rcx, [rbp + 0x350]
mov r8d, 0x800
call fcn.1401e7e40
xor edx, edx
lea rcx, [rbp + 0xb50]
mov r8d, 0x800
call fcn.1401e7e40
cmp qword [rbx + 0x180], 0
je 0x1400d8aa4
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x238]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x48]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r9, rax
lea r8, [rbp + 0xb50]
lea rdx, str.SILENTREBOOT
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rcx, r9
call qword [case.0x1400136d6.0]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x258]
call qword [case.0x1400136d6.0]
test eax, eax
je 0x1400d8a5b
lea rdx, [0x140252f04]
lea rcx, [rbp + 0xb50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400d8a5b
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x238]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x48]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r9, rax
lea r8, [0x1402533f8]
lea rdx, str.RebootYesNo
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, r9
call qword [case.0x1400136d6.0]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x238]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x48]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov r9, rax
lea r8, [rbp + 0x350]
lea rdx, str.RebootYesNo
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rcx, r9
call qword [case.0x1400136d6.0]
jmp 0x1400d8ab8
lea rdx, [0x140253384]
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x2d8]
call qword [case.0x1400136d6.0]
mov rcx, qword [rbx + 0x1b8]
xor edi, edi
test rcx, rcx
je 0x1400d8ae8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x1b8], rdi
mov rax, qword [rbx + 0x190]
test rax, rax
je 0x1400d8b0e
mov rcx, qword [rax + 0x60]
test rcx, rcx
je 0x1400d8b0e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx + 0x190]
mov qword [rax + 0x60], rdi
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x228]
call qword [case.0x1400136d6.0]
movzx eax, word [0x1402bbd98]
cmp eax, 8
je 0x1400d8b45
cmp eax, 0x64
je 0x1400d8b45
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x350]
call qword [case.0x1400136d6.0]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.1401e7e40
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.1401e7e40
call fcn.14018d2c0
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov edx, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x1400d8bd3
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rcx, [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x1400d8bd3
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x1400136d6.0]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400136d6.0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, str.Canon_
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.PrnUninstall_
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, [0x1402533f8]
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400d8c59
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x288]
call qword [case.0x1400136d6.0]
mov rbx, qword [0x1402a8360]
lea rsi, [0x1402a8360]
cmp rbx, rsi
je 0x1400d8c93
test rbx, rbx
je 0x1400d8c8c
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400d8c84
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rbx + 8], rdi
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400d8c71
mov qword [0x1402a8360], rsi
mov eax, 1
mov rcx, qword [rbp + 0x1350]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x1460]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret