Function at 0x1400010a0
Capabilities:
Create service
Delete service
Start service
Stop service
Terminate process

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x310
mov rax, qword [0x140055008]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rcx, qword [rdx + 8]
mov rbx, rdx
test rcx, rcx
je 0x1400014c7
mov qword [r11 + 0x20], rdi
lea rdx, [0x140051b68]
mov r8d, 3
mov qword [r11 - 0x18], r15
call fcn.140013f10
xor r15d, r15d
test eax, eax
je 0x1400010fe
cmp qword [rbx + 0x10], r15
je 0x1400014d7
lea edi, [r15 + 1]
jmp 0x14000112b
mov rcx, qword [rbx + 8]
lea rdx, [0x140051b6c]
mov r8d, 3
call fcn.140013f10
test eax, eax
je 0x140001127
cmp qword [rbx + 0x10], r15
je 0x1400014e7
mov edi, r15d
jmp 0x14000112b
mov edi, dword [rsp + 0x78]
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x308], r14
call fcn.140015470
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x140001173
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____There_was_a_problem_trying_to_open_the_process_handle:__ld_n
call fcn.140001010
lea eax, [r14 + 1]
jmp 0x140001496
lea rdx, [rsp + 0xa0]
lea rcx, str.Reaper.sys
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x1400011ce
xor r9d, r9d
lea r8, [rsp + 0x1e0]
mov edx, 0x104
lea rcx, [rsp + 0xcc]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x1400011ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____There_was_a_problem_trying_to_identify_the_full_driver_path:__ld_n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x140001496
xor edx, edx
mov qword [rsp + 0x330], rsi
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140001207
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____There_was_a_problem_trying_to_open_the_Service_Control_Manager:__ld_n
call fcn.140001010
jmp 0x1400012c7
mov qword [rsp + 0x60], r15
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x58], r15
lea r8, str.Reaper
mov qword [rsp + 0x50], r15
lea rdx, str.Reaper
mov qword [rsp + 0x48], r15
mov r9d, 0xf01ff
mov qword [rsp + 0x40], r15
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x320], rbp
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x140001283
lea rcx, str.___The_service_already_exists
jmp 0x1400012ba
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, 0x420
jne 0x1400012a1
lea rcx, str.___The_service_has_already_started
jmp 0x1400012ba
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.___Service_created_and_started_successfully_
call fcn.1400092b0
mov rbp, qword [rsp + 0x320]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, str..GlobalRootDeviceKProcessHacker2
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, qword [rsp + 0x330]
cmp rax, 0xffffffffffffffff
jne 0x14000131e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____There_was_a_problem_opening_the_driver:__ld_n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x140001496
test edi, edi
jne 0x140001368
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], r15
lea r9d, [rdi + 8]
mov dword [rsp + 0x28], 8
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov edx, 0x999920d7
mov rcx, rax
mov qword [rsp + 0x78], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, 1
jne 0x1400013bf
lea rcx, str.___Process__d_suspended__n
jmp 0x1400013b8
cmp edi, 1
jne 0x1400013bf
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], r15
lea r9d, [rdi + 0xf]
mov dword [rsp + 0x28], 8
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov edx, 0x999920df
mov rcx, rax
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x80], r15d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, edi
jne 0x1400013bf
lea rcx, str.___Process__d_killed__n
mov edx, ebx
call fcn.140001010
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x1400013eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____There_was_a_problem_trying_to_open_the_Service_Control_Manager:__ld_n
call fcn.140001010
mov r8d, 0x24
lea rdx, str.Reaper
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
jne 0x140001428
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____There_was_an_error_trying_to_open_the_service:__ld_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140001494
lea r8, [rsp + 0x78]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140001453
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____There_was_an_error_trying_to_stop_the_service:__ld_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140001476
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____There_was_an_error_trying_to_delete_the_service:__ld._Delete_the_service_with_the__sc_delete_Reaper__command_n
call fcn.140001010
jmp 0x140001494
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.___Service_uninstalled_successfully_
call fcn.1400092b0
xor eax, eax
mov r14, qword [rsp + 0x308]
mov rdi, qword [rsp + 0x338]
mov r15, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.140001510
add rsp, 0x310
pop rbx
ret
mov rcx, qword [rdx]
call fcn.140001070
xor ecx, ecx
call fcn.140008cd0
int3
mov rcx, qword [rbx]
call fcn.140001070
xor ecx, ecx
call fcn.140008cd0
int3
mov rcx, qword [rbx]
call fcn.140001070
xor ecx, ecx
call fcn.140008cd0
int3