Function at 0x1400cc4b0
Capabilities:
Delete service
Stop service
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x840
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rcx, qword [0x14020b0c0]
xor edi, edi
mov ebx, edi
mov ebp, edi
cmp qword [rcx + 0x48], rbx
je 0x1400cc92f
lea rcx, [rsp + 0x80]
call fcn.1400012c0
lea rcx, [rsp + 0x80]
call fcn.140176e90
lea rcx, str.EVERYTHING_TASKBAR_NOTIFICATION
call fcn.1400d6dc0
test rax, rax
mov rbx, rax
je 0x1400cc5a8
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400cc5a8
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov edx, 0xea60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400cc59f
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400cc59f
lea r9, str.Timed_out_while_waiting_for_Everything.exe_to_close
lea r8, str._main_close_existing_process
lea rcx, str.._srcmain.c
mov edx, 0x1bf
call fcn.1400b37b0
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x1400cc625
lea rcx, [rsp + 0x620]
call fcn.1400ea1f0
lea rdx, [rsp + 0x620]
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rsi, rax
je 0x1400cc61c
lea r8, [rsp + 0x48]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400cc613
lea rdx, [rsp + 0x620]
mov rcx, rbx
call fcn.1400ea2b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [0x14020b0c0]
mov rcx, qword [rsp + 0x88]
lea r8, str.Everything.exe
mov rdx, qword [rdx + 0x48]
call fcn.1400cbc10
test eax, eax
jne 0x1400cc672
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_copy_Everything.exe:__d
lea r8, str._main_do_command_line_installs
lea rcx, str.._srcmain.c
mov edx, 0x264
mov dword [rsp + 0x20], eax
call fcn.1400b37b0
int3
mov rdx, qword [0x14020b0c0]
mov rcx, qword [rsp + 0x88]
lea r8, str.Changes.txt
mov rdx, qword [rdx + 0x48]
call fcn.1400cbc10
mov rdx, qword [0x14020b0c0]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rdx + 0x48]
lea r8, str.License.txt
call fcn.1400cbc10
mov rdx, qword [0x14020b0c0]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rdx + 0x48]
lea r8, str.Everything.lng
call fcn.1400cbc10
mov rdx, qword [0x14020b0c0]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rdx + 0x48]
lea r8, str.Uninstall.exe
call fcn.1400cbc10
test eax, eax
je 0x1400cc895
lea rcx, [rsp + 0x620]
call fcn.1400012c0
lea rcx, [rsp + 0x3e0]
call fcn.1400012c0
lea rcx, [rsp + 0x2c0]
call fcn.1400012c0
lea rcx, [rsp + 0x500]
call fcn.1400012c0
lea rcx, [rsp + 0x1a0]
call fcn.1400012c0
mov rdx, qword [0x14020b0c0]
lea r8, str.Uninstall.exe
mov rdx, qword [rdx + 0x48]
lea rcx, [rsp + 0x620]
call fcn.140176610
mov rdx, qword [0x14020b0c0]
lea r8, str.Everything.exe
mov rdx, qword [rdx + 0x48]
lea rcx, [rsp + 0x3e0]
call fcn.140176610
lea rcx, [rsp + 0x500]
call fcn.140178220
lea rcx, [rsp + 0x1a0]
call fcn.140178270
mov r8, qword [rsp + 0x508]
lea rdx, str.Everything__s
lea rcx, [rsp + 0x2c0]
call fcn.140176700
mov r9, qword [rsp + 0x2c8]
lea r8, str.DisplayName
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
mov rcx, 0xffffffff80000002
call fcn.1400e0b40
mov r9, qword [rsp + 0x628]
lea r8, str.UninstallString
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
mov rcx, 0xffffffff80000002
call fcn.1400e0b40
lea r9, str.David_Carpenter
lea r8, str.Publisher
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
mov rcx, 0xffffffff80000002
call fcn.1400e0b40
mov r9, qword [rsp + 0x3e8]
lea r8, str.DisplayIcon
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
mov rcx, 0xffffffff80000002
call fcn.1400e0b40
mov r9, qword [rsp + 0x1a8]
lea r8, str.DisplayVersion
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
mov rcx, 0xffffffff80000002
call fcn.1400e0b40
lea rcx, [rsp + 0x1a0]
call fcn.140175010
lea rcx, [rsp + 0x500]
call fcn.140175010
lea rcx, [rsp + 0x2c0]
call fcn.140175010
lea rcx, [rsp + 0x3e0]
call fcn.140175010
lea rcx, [rsp + 0x620]
call fcn.140175010
mov rax, qword [0x14020b0c0]
cmp qword [rax + 0x50], rdi
je 0x1400cc916
mov rax, qword [rax + 0x50]
cmp byte [rax], dil
je 0x1400cc916
lea rcx, [rsp + 0x620]
call fcn.1400012c0
mov rdx, qword [0x14020b0c0]
lea r8, str.Everything.exe
mov rdx, qword [rdx + 0x48]
lea rcx, [rsp + 0x620]
call fcn.140176610
mov r9, qword [0x14020b0c0]
mov rdx, qword [rsp + 0x628]
mov r9, qword [r9 + 0x50]
mov dword [rsp + 0x30], 1
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
call fcn.1400d67b0
lea rcx, [rsp + 0x620]
call fcn.140175010
lea rcx, [rsp + 0x80]
call fcn.140175010
mov rcx, qword [0x14020b0c0]
mov ebx, 1
bt dword [rcx], 0xf
jae 0x1400cca65
lea rcx, str.EVERYTHING_TASKBAR_NOTIFICATION
call fcn.1400d6dc0
test rax, rax
mov rbx, rax
je 0x1400cc9d8
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400cc9d8
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov edx, 0xea60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400cc9cf
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400cc9cf
lea r9, str.Timed_out_while_waiting_for_Everything.exe_to_close
lea r8, str._main_close_existing_process
lea rcx, str.._srcmain.c
mov edx, 0x1bf
call fcn.1400b37b0
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1401401c0
call fcn.140140da0
call fcn.140140a00
lea rcx, [rsp + 0x80]
call fcn.1400012c0
lea rcx, [rsp + 0x80]
call fcn.140176e90
mov rcx, qword [rsp + 0x88]
xor edx, edx
call fcn.1400cbd80
lea rcx, [rsp + 0x80]
call fcn.140177310
mov rcx, qword [rsp + 0x88]
xor edx, edx
call fcn.1400cbd80
lea rcx, [rsp + 0x80]
call fcn.140177510
test eax, eax
je 0x1400cca4c
mov rcx, qword [rsp + 0x88]
xor edx, edx
call fcn.1400cbd80
lea rcx, [rsp + 0x80]
call fcn.140175010
mov rcx, qword [0x14020b0c0]
mov ebx, 1
cmp qword [rcx + 0x58], rdi
je 0x1400ccc17
lea rcx, str.EVERYTHING_TASKBAR_NOTIFICATION
call fcn.1400d6dc0
test rax, rax
mov rbx, rax
je 0x1400ccb0e
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400ccb0e
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov edx, 0xea60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400ccb05
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400ccb05
lea r9, str.Timed_out_while_waiting_for_Everything.exe_to_close
lea r8, str._main_close_existing_process
lea rcx, str.._srcmain.c
mov edx, 0x1bf
call fcn.1400b37b0
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x1400ccbc0
lea rcx, [rsp + 0x620]
call fcn.1400ea1f0
lea rdx, [rsp + 0x620]
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rsi, rax
je 0x1400ccb86
lea r8, [rsp + 0x48]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400ccb7d
lea rdx, [rsp + 0x620]
mov rcx, rbx
call fcn.1400ea2b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x620]
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rsi, rax
je 0x1400ccbb7
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.1401401c0
call fcn.140140da0
call fcn.140140a00
call fcn.1401417e0
call fcn.140141380
call fcn.140141e50
call fcn.140141c50
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
mov rcx, 0xffffffff80000002
call fcn.1400d93c0
mov rcx, qword [0x14020b0c0]
mov edx, 1
mov rcx, qword [rcx + 0x58]
call fcn.1400cbd80
mov rcx, qword [0x14020b0c0]
mov ebx, 1
bt dword [rcx + 4], 0x13
jae 0x1400ccc2e
mov ebp, 1
mov byte [0x14020ae23], 1
mov edi, ebp
jmp 0x1400ccc41
bt dword [rcx + 8], 0x13
jae 0x1400ccc43
mov byte [0x14020ae23], dil
mov edi, 1
mov ebx, edi
test byte [rcx + 4], 2
je 0x1400ccc50
call fcn.1401464d0
jmp 0x1400ccc5b
test byte [rcx + 8], 2
je 0x1400ccc67
call fcn.1401401c0
mov rcx, qword [0x14020b0c0]
mov ebx, 1
bt dword [rcx + 4], 0x19
jae 0x1400ccc75
call fcn.1401467f0
jmp 0x1400ccc81
bt dword [rcx + 8], 0x19
jae 0x1400ccc8d
call fcn.1401405e0
mov rcx, qword [0x14020b0c0]
mov ebx, 1
test byte [rcx + 4], 4
je 0x1400ccc9a
call fcn.140146b10
jmp 0x1400ccca5
test byte [rcx + 8], 4
je 0x1400cccb1
call fcn.140140a00
mov rcx, qword [0x14020b0c0]
mov ebx, 1
test byte [rcx + 4], 8
je 0x1400cccbe
call fcn.140146d70
jmp 0x1400cccc9
test byte [rcx + 8], 8
je 0x1400cccd5
call fcn.140140da0
mov rcx, qword [0x14020b0c0]
mov ebx, 1
bt dword [rcx + 4], 0x18
jae 0x1400ccce3
call fcn.140146f60
jmp 0x1400cccef
bt dword [rcx + 8], 0x18
jae 0x1400cccfb
call fcn.140141090
mov rcx, qword [0x14020b0c0]
mov ebx, 1
test byte [rcx + 4], 0x10
je 0x1400ccd08
call fcn.140147150
jmp 0x1400ccd13
test byte [rcx + 8], 0x10
je 0x1400ccd1f
call fcn.140141380
mov rcx, qword [0x14020b0c0]
mov ebx, 1
test byte [rcx + 4], 0x20
je 0x1400ccd2c
call fcn.140147740
jmp 0x1400ccd37
test byte [rcx + 8], 0x20
je 0x1400ccd43
call fcn.140141c50
mov rcx, qword [0x14020b0c0]
mov ebx, 1
test byte [rcx + 4], 0x40
je 0x1400ccd50
call fcn.140147880
jmp 0x1400ccd5b
test byte [rcx + 8], 0x40
je 0x1400ccd67
call fcn.140141e50
mov rcx, qword [0x14020b0c0]
mov ebx, 1
bt dword [rcx + 4], 0x11
jae 0x1400ccd75
call fcn.1401474d0
jmp 0x1400ccd81
bt dword [rcx + 8], 0x11
jae 0x1400ccd8d
call fcn.1401417e0
mov rcx, qword [0x14020b0c0]
mov ebx, 1
test byte [rcx + 4], 0x80
je 0x1400ccd9c
mov byte [0x14020ac66], 1
jmp 0x1400ccda9
test byte [rcx + 8], 0x80
je 0x1400ccdb0
mov byte [0x14020ac66], 0
mov edi, 1
mov ebx, edi
bt dword [rcx + 4], 0x16
jae 0x1400ccdc0
mov byte [0x14020ae3b], 1
jmp 0x1400ccdce
bt dword [rcx + 8], 0x16
jae 0x1400ccdd5
mov byte [0x14020ae3b], 0
mov ebp, 1
mov ebx, ebp
bt dword [rcx + 4], 0x14
jae 0x1400ccdfa
mov byte [reloc.WS2_32.dll_accept], 0
mov byte [0x14020ac84], 0
mov byte [reloc.WS2_32.dll_accept], 0
mov byte [0x14020ac85], 0
jmp 0x1400cce0f
bt dword [rcx + 8], 0x14
jae 0x1400cce16
mov byte [reloc.WS2_32.dll_accept], 1
mov byte [reloc.WS2_32.dll_accept], 1
mov edi, 1
mov ebx, edi
cmp dword [rcx + 0xa0], 0
je 0x1400cce26
mov edi, 1
mov ebx, edi
mov edx, dword [rcx + 0xac]
sub edx, 1
je 0x1400cce55
sub edx, 1
je 0x1400cce4e
sub edx, 1
je 0x1400cce47
cmp edx, 1
jne 0x1400cce74
call fcn.1400ea7b0
jmp 0x1400cce68
call fcn.1400ea5f0
jmp 0x1400cce68
call fcn.1400ea340
jmp 0x1400cce68
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
call fcn.1400ea9e0
mov rcx, qword [0x14020b0c0]
mov ebx, 1
mov edx, dword [rcx + 0xb0]
sub edx, 1
je 0x1400ccea3
sub edx, 1
je 0x1400cce9c
sub edx, 1
je 0x1400cce95
cmp edx, 1
jne 0x1400cceb4
call fcn.140005920
jmp 0x1400ccea8
call fcn.140005810
jmp 0x1400ccea8
call fcn.1400056c0
jmp 0x1400ccea8
call fcn.140005a40
mov rcx, qword [0x14020b0c0]
mov ebx, 1
cmp qword [rcx + 0xc8], 0
je 0x1400ccf11
mov rbx, qword [rcx + 0xc8]
test rbx, rbx
je 0x1400ccf0c
nop
nop
mov eax, dword [rbx + 8]
cmp eax, 1
jne 0x1400cceed
mov r9d, dword [rbx + 0x1c]
mov r8d, dword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
xor ecx, ecx
call fcn.140144010
jmp 0x1400ccefd
cmp eax, 2
jne 0x1400ccefd
mov rdx, qword [rbx + 0x10]
xor ecx, ecx
call fcn.1401440e0
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400cced0
mov rcx, qword [0x14020b0c0]
mov ebx, 1
cmp qword [rcx + 0x70], 0
je 0x1400ccf3d
mov rdx, qword [rcx + 0x70]
mov rcx, qword [0x14020aee0]
call fcn.140174640
mov rcx, qword [0x14020b0c0]
mov edi, 1
mov qword [0x14020aee0], rax
mov ebx, edi
bt dword [rcx], 0xb
jae 0x1400ccfae
call fcn.1400d9b90
call fcn.1400cba60
mov edx, 1
xor ecx, ecx
call fcn.14012eb60
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400ccf9d
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x1400ccf70
call fcn.14012e3f0
mov rcx, qword [0x14020b0c0]
mov ebx, 1
cmp qword [rcx + 0xe8], 0
je 0x1400ccffb
cmp qword [rcx + 0xf0], 0
je 0x1400ccffb
mov rax, qword [rcx + 0x108]
mov r9, qword [rcx + 0x100]
mov r8, qword [rcx + 0xf8]
mov rdx, qword [rcx + 0xf0]
mov rcx, qword [rcx + 0xe8]
mov qword [rsp + 0x20], rax
call fcn.1400bf880
mov rcx, qword [0x14020b0c0]
mov ebx, 1
cmp qword [rcx + 0x68], 0
je 0x1400cd009
mov ebx, 1
jmp 0x1400cd00d
test edi, edi
je 0x1400cd014
xor ecx, ecx
call fcn.14000d310
test ebp, ebp
je 0x1400cd022
mov ecx, 1
call fcn.14000d310
mov eax, ebx
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1401a6ae0
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret