Function at 0x1400025d0
Capabilities:
Delete service
Print debug messages
Stop service

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x140002625
mov rax, qword [rcx]
mov word [rax], r14w
call fcn.140001160
cmp eax, 1
jne 0x1400027f1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140001590
lea rcx, [rsp + 0x50]
test eax, eax
je 0x140002721
call fcn.140001690
nop
lea rdx, str.wfpcalloutx64win10PiaWFPCallout.inf
mov rcx, rax
call fcn.140003a10
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140003b10
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400026d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002e00
call fcn.140006cb0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400029a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000299e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ddc
jmp 0x14000299e
call fcn.140001690
nop
lea rdx, str.wfpcalloutx86win10PiaWFPCallout.inf
mov rcx, rax
call fcn.140003a10
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140003b10
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400027a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002e06
call fcn.140006cb0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400029a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000299e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002de2
jmp 0x14000299e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140001590
lea rcx, [rsp + 0x50]
test eax, eax
je 0x1400028db
call fcn.140001690
nop
lea rdx, str.wfpcalloutx64win7PiaWFPCallout.inf
mov rcx, rax
call fcn.140003a10
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140003b10
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002891
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000288b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002e0c
call fcn.140006cb0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400029a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000299e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002de8
jmp 0x14000299e
call fcn.140001690
nop
lea rdx, str.wfpcalloutx86win7PiaWFPCallout.inf
mov rcx, rax
call fcn.140003a10
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140003b10
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002961
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000295b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002e12
call fcn.140006cb0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400029a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000299e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002e18
call fcn.140006cb0
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400029b0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp edi, 1
jne 0x140002c17
lea rcx, str.install_start_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400029d9
mov rcx, qword [rbx]
call fcn.140006250
mov edi, eax
cmp eax, 0x14
jne 0x140002ab9
lea rcx, str.install_WFPCalloutDriver_successful_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x140002d5f
mov rcx, rax
call fcn.140005270
test eax, eax
je 0x140002a72
lea rcx, str.start_WFPCalloutDriver_service_successful_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140002a68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140002a63
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002e1e
mov rcx, r8
call fcn.140006cb0
mov eax, 0x14
jmp 0x140002d9f
lea rcx, str.start_WFPCalloutDriver_service_failure_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140002a68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140002a63
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002dee
jmp 0x140002a60
lea rcx, str.install_WFPCalloutDriver_service_failure_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r9, [rsp + 0x65]
mov r8d, edi
test edi, edi
jns 0x140002b20
neg r8d
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140002ae0
dec r9
mov byte [r9], 0x2d
jmp 0x140002b4a
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140002b20
movdqa xmm0, xmmword [0x14001d700]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
lea rax, [rsp + 0x65]
cmp r9, rax
je 0x140002b7c
lea r8, [rsp + 0x65]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140003db0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140002bd1
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002e24
call fcn.140006cb0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140002c10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140002c0b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002e2a
mov rcx, r8
call fcn.140006cb0
mov eax, edi
jmp 0x140002d9f
cmp edi, 2
jne 0x140002d5f
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.140008590
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140002d18
mov r8d, 0xf01ff
lea rdx, str.PiaWFPCallout
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140002c88
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0xf01ff
lea rdx, str.PiaWFPCallout
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140002cb8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.remove_WFPCalloutDriver_successful_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140002d0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140002d09
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002dd6
mov rcx, r8
call fcn.140006cb0
mov eax, 0x1e
jmp 0x140002d9f
lea rcx, str.remove_WFPCalloutDriver_failure_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140002d9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140002d95
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002df4
jmp 0x140002d92
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140002d9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140002d95
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002dfa
mov rcx, r8
call fcn.140006cb0
mov eax, 0x1f
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140006c50
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14000aa3c
nop
call fcn.14000aa3c
nop
call fcn.14000aa3c
int3
call fcn.14000aa3c
nop
call fcn.14000aa3c
int3
call fcn.14000aa3c
int3
call fcn.14000aa3c
nop
call fcn.14000aa3c
nop
call fcn.14000aa3c
nop
call fcn.14000aa3c
nop
call fcn.14000aa3c
nop
call fcn.14000aa3c
nop
call fcn.14000aa3c
nop
call fcn.14000aa3c
nop
call fcn.14000aa3c
int3