Function at 0x140012a50
Capabilities:
Access peb ldr_data
Delete service
Resume thread
Start service
Suspend thread
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword gs:[0x30]
xor r13d, r13d
mov edi, 1
mov qword [rsp + 0x28], r13
mov r9d, edi
mov r8d, edi
mov ebx, r13d
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x20]
lea rcx, [rbp - 0x50]
movzx eax, word [rdx + 0x70]
mov qword [rbp - 0x50], rax
mov rax, qword [rdx + 0x78]
lea rdx, [0x140188070]
mov qword [rbp - 0x48], rax
lea rax, [fcn.140012a40]
mov qword [rsp + 0x20], rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhParseCommandLine
mov rcx, qword [0x140192400]
lea rax, str.process
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xe
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x1400133d6
mov r9, qword [0x140192408]
test r9, r9
je 0x140012bc6
mov r8, qword [r9]
mov ecx, r13d
shr r8, 1
je 0x140012b29
mov rdx, qword [r9 + 8]
nop dword [rax + rax]
movzx eax, word [rdx]
sub ax, 0x30
cmp ax, 0xa
jae 0x140012b29
inc rcx
add rdx, 2
cmp rcx, r8
jb 0x140012b10
lea r14, [0x1401689b0]
mov r12d, 0xfffd
cmp rcx, r8
jne 0x140012bd0
movups xmm0, xmmword [r9]
xor r15b, r15b
movq r9, xmm0
movups xmmword [rbp - 0x50], xmm0
test r9, r9
je 0x140012b7d
psrldq xmm0, 8
movq r10, xmm0
movzx ecx, word [r10]
lea eax, [rcx - 0x2b]
test r12w, ax
jne 0x140012b81
add r10, 2
sub r9, 2
cmp cx, 0x2d
sete r15b
jmp 0x140012b81
mov r10, qword [rbp - 0x48]
shr r9, 1
movzx r11d, dil
mov rcx, r13
mov rdx, r13
je 0x140012bb4
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x140012ba9
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
jmp 0x140012bac
xor r11b, r11b
inc rdx
cmp rdx, r9
jb 0x140012b90
mov rsi, rcx
neg rsi
test r15b, r15b
cmove rsi, rcx
test r11b, r11b
jne 0x140012c26
mov eax, 0xc000000d
jmp 0x14001385c
mov edx, 5
lea rcx, [rbp + 0x40]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEnumProcessesEx
mov ebx, eax
test eax, eax
js 0x14001385c
mov r15, qword [rbp + 0x40]
mov rdx, qword [0x140192408]
mov rcx, r15
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhFindProcessInformationByImageName
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
xor edx, edx
mov r8, r15
test rax, rax
jne 0x140012c1c
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000225
jmp 0x14001385c
mov rsi, qword [rax + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x140192410]
lea rax, str.terminate
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012ca7
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0x30
lea r9, [rbp - 0x50]
mov qword [rbp - 0x30], r13
lea r8, [rbp - 0x38]
mov dword [rbp - 0x20], r13d
mov edx, edi
mov qword [rbp - 0x28], r13
lea rcx, [rbp + 0x48]
mov qword [rbp - 0x50], rsi
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x48], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14001385a
mov rcx, qword [rbp + 0x48]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rcx, qword [rbp + 0x48]
jmp 0x140013852
mov rcx, qword [0x140192410]
lea rax, str.suspend
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xe
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012d29
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0x30
lea r9, [rbp - 0x50]
mov qword [rbp - 0x30], r13
lea r8, [rbp - 0x38]
mov dword [rbp - 0x20], r13d
mov edx, 0x800
mov qword [rbp - 0x28], r13
lea rcx, [rbp + 0x48]
mov qword [rbp - 0x50], rsi
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x48], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14001385a
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
mov rcx, qword [rbp + 0x48]
jmp 0x140013852
mov rcx, qword [0x140192410]
lea rax, str.resume
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xc
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012dab
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0x30
lea r9, [rbp - 0x50]
mov qword [rbp - 0x30], r13
lea r8, [rbp - 0x38]
mov dword [rbp - 0x20], r13d
mov edx, 0x800
mov qword [rbp - 0x28], r13
lea rcx, [rbp + 0x48]
mov qword [rbp - 0x50], rsi
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x48], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14001385a
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntdll.dll_NtResumeProcess]
mov rcx, qword [rbp + 0x48]
jmp 0x140013852
mov rcx, qword [0x140192410]
lea rax, str.priority
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x10
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012f78
mov rcx, qword [0x140192418]
test rcx, rcx
je 0x140012bc6
lea rax, str.idle
mov qword [rbp - 0x50], 8
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
jne 0x140012f0a
mov rcx, qword [0x140192418]
lea rax, str.normal
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xc
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012e45
mov dil, 2
jmp 0x140012f0a
mov rcx, qword [0x140192418]
lea rax, str.high
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 8
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012e78
mov dil, 3
jmp 0x140012f0a
mov rcx, qword [0x140192418]
lea rax, str.realtime
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x10
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012ea8
mov dil, 4
jmp 0x140012f0a
mov rcx, qword [0x140192418]
lea rax, str.abovenormal
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x16
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012ed8
mov dil, 6
jmp 0x140012f0a
mov rcx, qword [0x140192418]
lea rax, str.belownormal
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x16
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012bc6
mov dil, 5
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0x30
lea r9, [rbp - 0x50]
mov qword [rbp - 0x30], r13
lea r8, [rbp - 0x38]
mov dword [rbp - 0x20], r13d
mov edx, 0x200
mov qword [rbp - 0x28], r13
lea rcx, [rbp + 0x48]
mov qword [rbp - 0x50], rsi
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x48], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14001385a
mov rcx, qword [rbp + 0x48]
lea r8, [rbp + 0x40]
mov r9d, 2
mov byte [rbp + 0x40], r13b
mov edx, 0x12
mov byte [rbp + 0x41], dil
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x48]
jmp 0x140013852
mov rcx, qword [0x140192410]
lea rax, str.iopriority
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x1400130c5
mov rcx, qword [0x140192418]
test rcx, rcx
je 0x140012bc6
lea rax, str.verylow
mov qword [rbp - 0x50], 0xe
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012fe3
mov edi, r13d
jmp 0x140013074
mov rcx, qword [0x140192418]
lea rax, [0x1401593d8]
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 6
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
jne 0x140013074
mov rcx, qword [0x140192418]
lea rax, str.normal
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xc
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140013040
mov edi, 2
jmp 0x140013074
mov rcx, qword [0x140192418]
lea rax, str.high
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 8
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140012bc6
mov edi, 3
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0x30
lea r9, [rbp - 0x50]
mov qword [rbp - 0x30], r13
lea r8, [rbp - 0x38]
mov dword [rbp - 0x20], r13d
mov edx, 0x200
mov qword [rbp - 0x28], r13
lea rcx, [rbp + 0x48]
mov qword [rbp - 0x50], rsi
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x48], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14001385a
mov dword [rbp + 0x40], edi
mov edx, 0x21
jmp 0x1400131c8
mov rcx, qword [0x140192410]
lea rax, str.pagepriority
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x18
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x1400131e5
mov rax, qword [0x140192418]
test rax, rax
je 0x140012bc6
movups xmm0, xmmword [rax]
xor r11b, r11b
movq r9, xmm0
movups xmmword [rbp - 0x50], xmm0
test r9, r9
je 0x140013141
psrldq xmm0, 8
movq r10, xmm0
movzx ecx, word [r10]
lea eax, [rcx - 0x2b]
test r12w, ax
jne 0x140013145
add r10, 2
sub r9, 2
cmp cx, 0x2d
sete r11b
jmp 0x140013145
mov r10, qword [rbp - 0x48]
shr r9, 1
mov rcx, r13
mov rdx, r13
je 0x14001316f
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x140013167
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
inc rdx
cmp rdx, r9
jb 0x140013150
mov rax, rcx
mov dword [rbp - 0x38], 0x30
neg rax
mov qword [rbp - 0x30], r13
test r11b, r11b
mov dword [rbp - 0x20], r13d
xorps xmm0, xmm0
mov qword [rbp - 0x28], r13
cmove rax, rcx
mov qword [rbp - 0x50], rsi
lea rcx, [rbp + 0x48]
mov dword [rbp + 0x40], eax
lea r9, [rbp - 0x50]
mov qword [rbp - 0x48], r13
lea r8, [rbp - 0x38]
mov edx, 0x200
movdqu xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14001385a
mov edx, 0x27
mov rcx, qword [rbp + 0x48]
lea r8, [rbp + 0x40]
mov r9d, 4
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x48]
jmp 0x140013852
mov rcx, qword [0x140192410]
lea rax, str.injectdll
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001328e
cmp qword [0x140192418], r13
je 0x140012bc6
mov edx, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ProcessQueryAccess]
lea r9, [rbp - 0x50]
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0x30
or edx, 0x3a
mov qword [rbp - 0x30], r13
lea r8, [rbp - 0x38]
mov dword [rbp - 0x20], r13d
lea rcx, [rbp + 0x48]
mov qword [rbp - 0x28], r13
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14001385a
mov rdx, qword [0x140192418]
lea r8, [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x40], 0xfffffffffd050f80
mov rdx, qword [rdx + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhInjectDllProcess
mov rcx, qword [rbp + 0x48]
jmp 0x140013852
mov rcx, qword [0x140192410]
lea rax, str.unloaddll
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001385a
cmp qword [0x140192418], r13
je 0x140012bc6
mov edx, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ProcessQueryAccess]
lea r9, [rbp - 0x50]
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0x30
or edx, 0x3a
mov qword [rbp - 0x30], r13
lea r8, [rbp - 0x38]
mov dword [rbp - 0x20], r13d
lea rcx, [rbp + 0x48]
mov qword [rbp - 0x28], r13
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14001385a
mov rax, qword [0x140192418]
lea r8, [rbp + 0x40]
mov rdi, qword [rbp + 0x48]
mov r9d, 8
mov edx, 0x1a
mov qword [rbp - 0x40], r13
mov rcx, rdi
mov qword [rsp + 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rsi, [0x140013980]
test eax, eax
js 0x14001337d
cmp qword [rbp + 0x40], r13
je 0x14001337d
lea rax, [rbp - 0x50]
mov qword [rbp - 0x38], rsi
lea r8, [rbp - 0x38]
mov qword [rbp - 0x30], rax
lea rdx, [0x1400e8400]
mov dword [rbp - 0x28], r13d
mov rcx, rdi
call fcn.1400e8250
mov ebx, eax
jmp 0x140013380
mov ebx, dword [rbp + 0x40]
mov rdx, qword [rbp - 0x40]
test rdx, rdx
jne 0x1400133b2
lea rax, [rbp - 0x50]
mov qword [rbp - 0x38], rsi
lea r8, [rbp - 0x38]
mov qword [rbp - 0x30], rax
lea rdx, [0x1400e7f90]
mov dword [rbp - 0x28], r13d
mov rcx, rdi
call fcn.1400e7df0
mov rdx, qword [rbp - 0x40]
mov ebx, eax
test ebx, ebx
js 0x1400133cd
mov rcx, qword [rbp + 0x48]
lea r8, [rbp + 0x40]
mov qword [rbp + 0x40], 0xfffffffffd050f80
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUnloadDllProcess
mov ebx, eax
mov rcx, qword [rbp + 0x48]
jmp 0x140013854
mov rcx, qword [0x140192400]
lea rax, str.service
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xe
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140013701
cmp qword [0x140192408], rbx
je 0x140012bc6
mov rcx, qword [0x140192410]
lea rax, str.start
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xa
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x1400134ae
mov rax, qword [0x140192408]
mov r8d, edi
xor edx, edx
xor ecx, ecx
mov r14, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140013493
mov r8d, 0x10
mov rdx, r14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x140013493
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1400136da
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14001385c
movzx eax, ax
or eax, 0xc0070000
jmp 0x14001385c
mov rcx, qword [0x140192410]
lea rax, str.continue
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x10
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001352a
mov rax, qword [0x140192408]
mov r8d, edi
xor edx, edx
xor ecx, ecx
mov rsi, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140013493
mov r8d, 0x40
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x140013493
mov edx, 3
jmp 0x140013623
mov rcx, qword [0x140192410]
lea rax, str.pause
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xa
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x1400135a7
mov rax, qword [0x140192408]
mov r8d, edi
xor edx, edx
xor ecx, ecx
mov rsi, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140013493
mov r8d, 0x40
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x140013493
mov edx, 2
jmp 0x140013623
mov rcx, qword [0x140192410]
lea rax, str.stop
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 8
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140013657
mov rax, qword [0x140192408]
mov r8d, edi
xor edx, edx
xor ecx, ecx
mov rsi, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x140013493
mov r8d, 0x20
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, r14
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x140013493
mov edx, edi
lea r8, [rbp - 0x38]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140013649
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140013649
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001385a
mov rcx, qword [0x140192410]
lea rax, [0x14013f758]
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xc
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001385a
mov rax, qword [0x140192408]
mov r8d, edi
xor edx, edx
xor ecx, ecx
mov r14, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140013493
mov r8d, 0x10000
mov rdx, r14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x140013493
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400136f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400136f3
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001385a
mov rcx, qword [0x140192400]
lea rax, str.thread
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xc
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001385a
mov rax, qword [0x140192408]
test rax, rax
je 0x140012bc6
movups xmm0, xmmword [rax]
xor r15b, r15b
movq r9, xmm0
movups xmmword [rbp - 0x50], xmm0
test r9, r9
je 0x140013783
psrldq xmm0, 8
mov r12d, 0xfffd
movq r10, xmm0
movzx ecx, word [r10]
lea eax, [rcx - 0x2b]
test r12w, ax
jne 0x140013787
add r10, 2
sub r9, 2
cmp cx, 0x2d
sete r15b
jmp 0x140013787
mov r10, qword [rbp - 0x48]
shr r9, 1
movzx r11d, dil
mov rcx, r13
mov rdx, r13
je 0x1400137c4
lea r14, [0x1401689b0]
nop dword [rax]
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x1400137b9
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
jmp 0x1400137bc
xor r11b, r11b
inc rdx
cmp rdx, r9
jb 0x1400137a0
mov rsi, rcx
neg rsi
test r15b, r15b
cmove rsi, rcx
test r11b, r11b
je 0x140012bc6
mov rcx, qword [0x140192410]
lea rax, str.terminate
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x140013877
xorps xmm0, xmm0
mov qword [rbp - 0x50], r13
lea r9, [rbp - 0x50]
mov qword [rbp - 0x48], rsi
lea r8, [rbp - 0x38]
mov dword [rbp - 0x38], 0x30
mov edx, edi
mov qword [rbp - 0x30], r13
lea rcx, [rbp + 0x40]
mov dword [rbp - 0x20], r13d
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x28], r13
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
test eax, eax
js 0x14001385a
mov rcx, qword [rbp + 0x40]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateThread]
mov rcx, qword [rbp + 0x40]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x140192410]
lea rax, str.suspend
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xe
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x1400138f7
xorps xmm0, xmm0
mov qword [rbp - 0x50], r13
lea r9, [rbp - 0x50]
mov qword [rbp - 0x48], rsi
lea r8, [rbp - 0x38]
mov dword [rbp - 0x38], 0x30
mov edx, 2
mov qword [rbp - 0x30], r13
lea rcx, [rbp + 0x40]
mov dword [rbp - 0x20], r13d
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x28], r13
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
test eax, eax
js 0x14001385a
mov rcx, qword [rbp + 0x40]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
jmp 0x14001384e
mov rcx, qword [0x140192410]
lea rax, str.resume
movzx r8d, dil
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0xc
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001385a
xorps xmm0, xmm0
mov qword [rbp - 0x50], r13
lea r9, [rbp - 0x50]
mov qword [rbp - 0x48], rsi
lea r8, [rbp - 0x38]
mov dword [rbp - 0x38], 0x30
mov edx, 2
mov qword [rbp - 0x30], r13
lea rcx, [rbp + 0x40]
mov dword [rbp - 0x20], r13d
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x28], r13
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
test eax, eax
js 0x14001385a
mov rcx, qword [rbp + 0x40]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
jmp 0x14001384e