Function at 0x140026d40
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x1401c5538]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov rsi, rcx
xor r12d, r12d
call fcn.1400726a0
lea rdx, str.AcService.run
mov rcx, rax
call fcn.140072950
call fcn.1400726a0
mov rbx, rax
lea rcx, [rbp - 0x28]
call fcn.140030950
nop
cmp qword [rax + 0x18], 0x10
jb 0x140026dae
mov rax, qword [rax]
mov r8, rax
lea rdx, str.Starting_up_AcService__s_
mov rcx, rbx
call fcn.140072600
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140026dfc
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026df7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002753d
call fcn.1401452fc
lea rcx, [rsp + 0x70]
call fcn.14006fa70
nop
call fcn.1400726a0
mov rbx, rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 8]
call fcn.14006fdd0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140026e28
mov rax, qword [rax]
mov r8, qword [rsp + 0x70]
mov edx, dword [r8 + 0xc]
mov ecx, dword [r8 + 8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
mov r9d, dword [r8 + 4]
mov r8d, dword [r8]
lea rdx, str.Windows_version_is__d._d._d._d____s_
mov rcx, rbx
call fcn.140072600
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x140026e94
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026e8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027543
call fcn.1401452fc
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x20]
call fcn.140147800
lea rdx, [rbp + 0x20]
lea rcx, str.achelper.exe
call fcn.14006c680
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rbp + 0x20]
mov ecx, 0x140
call fcn.14004a430
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x350]
call fcn.140147800
lea r9, [rbp + 0x20]
lea r8, [0x140177600]
mov edx, 0x208
lea rcx, [rbp + 0x350]
call fcn.140017490
mov dl, 1
lea rcx, [rbp + 0x350]
call fcn.140071740
mov rbx, qword [0x1401c9d18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov edx, 0x20
lea rcx, [rbp - 0x48]
call fcn.140004ad0
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], reloc.WS2_32.dll_setsockopt
mov qword [rbp - 0x30], 0x1f
movups xmm0, xmmword [str.AcService.LogKeepDays]
movups xmmword [rax], xmm0
mov edx, dword [0x140177698]
mov dword [rax + 0x10], edx
movzx edx, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rax + 0x14], dl
mov byte [rax + 0x15], 0
mov edi, 7
mov r8d, edi
lea rdx, [rbp - 0x48]
mov rcx, rbx
call fcn.14006e610
mov ebx, eax
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140026fb9
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026fb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027549
call fcn.1401452fc
test ebx, ebx
cmovle ebx, edi
mov eax, ebx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.14006ecf0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x130]
call fcn.140147800
lea rdx, [rbp + 0x130]
lea rcx, str.stopservice.txt
call fcn.14006c680
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x240]
call fcn.140147800
lea rdx, [rbp + 0x240]
lea rcx, str.RestartService.exe
call fcn.14006c680
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp byte [rsi + 0x28], 0
jne 0x140027049
lea rcx, [0x1401c9d00]
call fcn.14005ea70
lea r13, [0x1401c9d40]
mov rdx, r13
lea rcx, str.AcService.db3
call fcn.14006c680
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov r14, 0xffffffffffffffff
mov rdi, r14
nop dword [rax + rax]
inc rdi
cmp byte [rdi + r13], 0
jne 0x140027080
movabs r15, 0x7fffffffffffffff
cmp rdi, r15
ja 0x14002754f
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x1400270c5
mov qword [rbp - 0x58], rdi
mov r8, rdi
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.140147160
mov byte [rbp + rdi - 0x68], 0
jmp 0x14002710e
mov rax, rdi
or rax, 0xf
cmp rax, r15
ja 0x1400270e0
mov r15, rax
mov ecx, socket
cmp rax, rcx
cmovb r15, rcx
lea rdx, [r15 + 1]
lea rcx, [rbp - 0x68]
call fcn.140004ad0
mov rbx, rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], r15
mov r8, rdi
mov rdx, r13
mov rcx, rax
call fcn.140147160
mov byte [rbx + rdi], 0
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x48]
call fcn.14001ba60
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140027158
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027153
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027555
call fcn.1401452fc
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], 0
lea rdx, str.VACUUM
lea rcx, [rsp + 0x48]
call fcn.14001bd40
nop
lea rcx, [rsp + 0x48]
call fcn.14001bb70
mov ecx, 0xb8
call fcn.1401452c0
mov qword [rsp + 0x40], rax
lea rdi, [rsi + 0x30]
test rax, rax
je 0x1400271a9
mov rdx, rdi
mov rcx, rax
call fcn.14001e990
jmp 0x1400271ac
mov rax, r12
mov qword [0x1401c9cb8], rax
call fcn.140023220
mov ecx, 0x18
call fcn.1401452c0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400271d9
mov qword [rax], rdi
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
jmp 0x1400271dc
mov rax, r12
mov qword [0x1401c9cd0], rax
mov rcx, rsi
call fcn.140026700
mov ecx, 8
call fcn.1401452c0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140027209
mov rcx, rax
call fcn.140068c70
jmp 0x14002720c
mov rax, r12
mov qword [0x1401c9cc8], rax
mov rcx, rax
call fcn.140069af0
test al, al
jne 0x140027243
call fcn.1400726a0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.AcService.initInfoISM:_InfoISM_not_found__error:__d
mov rcx, rbx
call fcn.140072400
xor al, al
jmp 0x140027259
call fcn.1400726a0
lea rdx, str.AcService.initInfoISM:_InfoISM_is_installed
mov rcx, rax
call fcn.140072600
mov al, 1
mov byte [reloc.WS2_32.dll_accept], al
mov rcx, rsi
call fcn.140025670
mov rcx, rsi
call fcn.140025590
mov ecx, 0x48
call fcn.1401452c0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002728d
mov rcx, rax
call fcn.140053e70
jmp 0x140027290
mov rax, r12
mov qword [0x1401c9ce8], rax
test rax, rax
je 0x1400272a4
mov rcx, rax
call fcn.140054260
mov rcx, rsi
call fcn.140025e40
mov rcx, qword [0x1401c9cd0]
call fcn.140014ba0
mov ecx, 0x40
call fcn.1401452c0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400272f4
mov qword [rax], rdi
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], r12
mov qword [rax + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rax + 0x20], 0
jmp 0x1400272f7
mov rax, r12
mov qword [0x1401c9cc0], rax
mov rcx, rsi
call fcn.140025f00
mov ecx, 8
call fcn.1401452c0
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002732a
mov rcx, qword [rsi + 0x40]
mov qword [rax], rcx
lock inc dword [rcx + 0x30]
jmp 0x14002732d
mov rbx, r12
mov qword [rsp + 0x40], rbx
mov ecx, 0x18
call fcn.1401452c0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002736a
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.std::_Ref_count_class_boost::asio::io_context::work_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rbx
jmp 0x14002736d
mov rax, r12
mov qword [rsi + 0x48], rbx
mov rbx, qword [rsi + 0x50]
mov qword [rsi + 0x50], rax
test rbx, rbx
je 0x1400273a9
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400273a9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400273a9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, select
call fcn.1401452c0
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140027415
mov ecx, select
call fcn.1401452c0
test rax, rax
je 0x1400273df
mov qword [rax], rsi
lea rcx, [0x140026680]
mov qword [rax + 8], rcx
jmp 0x1400273e2
mov rax, r12
mov qword [rbp - 0x78], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140007bd0]
xor edx, edx
xor ecx, ecx
call fcn.14014f93c
mov qword [rbx], rax
test rax, rax
je 0x14002755b
jmp 0x140027418
mov rbx, r12
mov qword [rbp - 0x70], rbx
mov ecx, 0x18
call fcn.1401452c0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140027454
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.std::_Ref_count_class_std::thread_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rbx
jmp 0x140027457
mov rax, r12
mov qword [rsi + 0x58], rbx
mov rbx, qword [rsi + 0x60]
mov qword [rsi + 0x60], rax
test rbx, rbx
je 0x140027492
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140027492
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r14d
cmp r14d, 1
jne 0x140027492
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsi + 0x58]
cmp dword [rbx + 8], 0
je 0x1400274cc
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbx + 8], eax
je 0x140027569
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x60], xmm0
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140142ddc
test eax, eax
jne 0x140027574
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140027507
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027502
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027537
call fcn.1401452fc
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.1401453a0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14014bf64
int3
call fcn.14014bf64
nop
call fcn.14014bf64
nop
call fcn.14014bf64
int3
call fcn.140002ae0
nop
call fcn.14014bf64
nop
mov dword [rdi], r12d
mov ecx, 6
call fcn.140143150
nop
mov ecx, 5
call fcn.140143150
int3
mov ecx, 2
call fcn.140143150
int3