Function at 0x140012890
Capabilities:
Continue service
Delete service
Pause service
Resume thread
Start service
Suspend thread
Terminate process

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rdi, 0xffffffffffffffff
lea rdx, [rbp - 0x70]
mov rcx, rdi
call sym.ProcessHacker.exe_PhGetProcessCommandLine
mov r15d, eax
test eax, eax
js 0x140012c63
mov qword [rsp + 0x190], rbx
lea rax, [0x140012880]
mov rbx, qword [rbp - 0x70]
lea rdx, [0x14020d140]
mov qword [rsp + 0x198], rsi
mov rcx, rbx
mov esi, 1
mov qword [rsp + 0x1a0], r12
xor r12d, r12d
mov r9d, esi
mov qword [rsp + 0x28], r12
mov r8d, esi
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhParseCommandLine
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, esi
jne 0x140012929
call fcn.140106290
mov rcx, qword [0x140218980]
lea rax, str.process
mov qword [rsp + 0x168], r13
lea rdx, [rbp - 0x28]
movzx r8d, sil
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x160], r14
mov qword [rbp - 0x28], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140013246
mov r9, qword [0x140218988]
nop
test r9, r9
je 0x140012a4a
mov r8, qword [r9]
lea r14, [0x1401ca7b0]
shr r8, 1
mov rcx, r12
je 0x1400129ad
mov rdx, qword [r9 + 8]
nop
movzx eax, word [rdx]
sub ax, 0x30
cmp ax, 0xa
jae 0x140012a55
inc rcx
add rdx, 2
cmp rcx, r8
jb 0x140012990
nop dword [rax]
cmp rcx, r8
jne 0x140012a55
movups xmm0, xmmword ds:[r9]
xor bl, bl
movq r9, xmm0
movups xmmword [rbp - 0x28], xmm0
mov r10, qword [rbp - 0x20]
test r9, r9
je 0x1400129f3
movzx eax, word [r10]
cmp ax, 0x2d
je 0x1400129e7
cmp ax, 0x2b
jne 0x1400129f3
jmp 0x1400129eb
movzx ebx, sil
add r10, 2
sub r9, 2
shr r9, 1
movzx r11d, sil
mov rcx, r12
mov rdx, r12
je 0x140012a35
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x140012a29
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
jmp 0x140012a2c
xor r11b, r11b
inc rdx
cmp rdx, r9
jb 0x140012a10
mov rdi, rcx
neg rdi
test bl, bl
cmove rdi, rcx
test r11b, r11b
jne 0x140012ba5
mov eax, 0xc000000d
jmp 0x140012c3b
mov edx, 5
lea rcx, [rbp - 0x70]
call sym.ProcessHacker.exe_PhEnumProcessesEx
mov r15d, eax
test eax, eax
js 0x140012c3b
mov rax, qword [0x140218988]
mov r13, qword [rbp - 0x70]
mov qword [rsp + 0x38], rax
nop
movzx esi, word ds:[r13 + 0x38]
mov rdi, qword [r13 + 0x40]
cmp rsi, qword [rax]
jne 0x140012c8a
cmp byte [0x1402165de], 1
mov ecx, esi
mov r14, qword [rax + 8]
jb 0x140012afd
shr rcx, 4
test rcx, rcx
je 0x140012ae6
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140012aee
add rdi, 0x10
add r14, 0x10
sub rcx, 1
jne 0x140012ac0
shr rsi, 1
and esi, 7
jmp 0x140012b30
and esi, 0xf
shl rcx, 4
add rsi, rcx
shr rsi, 1
jmp 0x140012b30
shr rcx, 3
test rcx, rcx
je 0x140012b2a
nop word [rax + rax]
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x140012c7b
add rdi, 8
add r14, 8
sub rcx, 1
jne 0x140012b10
shr rsi, 1
and esi, 3
test rsi, rsi
je 0x140012b76
sub r14, rdi
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx r12d, word [r14 + rdi]
cmp cx, r12w
je 0x140012b6c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140012c8a
add rdi, 2
sub rsi, 1
jne 0x140012b40
test r13, r13
je 0x140013229
mov r8, qword [rbp - 0x70]
xor edx, edx
mov rcx, qword [0x140213cd0]
mov rdi, qword [r13 + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor r12d, r12d
lea r14, [0x1401ca7b0]
mov esi, 1
mov rcx, qword [0x140218990]
lea rax, str.terminate
mov r8b, 1
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0x18]
mov qword [rbp + 0x18], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x140012cab
xorps xmm0, xmm0
mov dword [rbp + 0x28], 0x30
lea r9, [rbp - 0x18]
mov qword [rbp + 0x30], r12
lea r8, [rbp + 0x28]
mov dword [rbp + 0x40], r12d
mov edx, esi
mov qword [rbp + 0x38], r12
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x18], rdi
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp - 0x10], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x140012c38
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rcx, qword [rsp + 0x30]
mov r15d, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, r15d
mov r13, qword [rsp + 0x168]
mov r14, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x190]
mov r12, qword [rsp + 0x1a0]
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.140161390
add rsp, 0x170
pop r15
pop rdi
pop rbp
ret
and esi, 7
lea rsi, [rsi + rcx*8]
shr rsi, 1
jmp 0x140012b30
mov eax, dword ds:[r13]
test eax, eax
je 0x140013229
add r13, rax
je 0x140013229
mov rax, qword [rsp + 0x38]
jmp 0x140012a80
mov rcx, qword [0x140218990]
lea rax, str.suspend
mov r8b, 1
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x18]
mov qword [rbp - 0x18], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012d35
xorps xmm0, xmm0
mov dword [rbp + 0x28], 0x30
lea r9, [rbp - 8]
mov qword [rbp + 0x30], r12
lea r8, [rbp + 0x28]
mov dword [rbp + 0x40], r12d
mov edx, 0x800
mov qword [rbp + 0x38], r12
lea rcx, [rsp + 0x30]
mov qword [rbp - 8], rdi
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x140012c38
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
nop dword [rax]
jmp 0x140012c2a
mov rcx, qword [0x140218990]
lea rax, str.resume
mov r8b, 1
mov qword [rbp], rax
lea rdx, [rbp - 8]
mov qword [rbp - 8], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012dbb
xorps xmm0, xmm0
mov dword [rbp + 0x28], 0x30
lea r9, [rbp + 8]
mov qword [rbp + 0x30], r12
lea r8, [rbp + 0x28]
mov dword [rbp + 0x40], r12d
mov edx, 0x800
mov qword [rbp + 0x38], r12
lea rcx, [rsp + 0x30]
mov qword [rbp + 8], rdi
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x10], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x140012c38
mov rcx, qword ds:[rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtResumeProcess]
jmp 0x140012c2a
mov rcx, qword [0x140218990]
lea rax, str.priority
mov r8b, 1
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 8]
mov qword [rbp + 8], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012f9b
mov rcx, qword [0x140218998]
test rcx, rcx
je 0x140012a4a
lea rax, str.idle
mov qword [rbp + 0x28], 8
mov r8b, 1
mov qword [rbp + 0x30], rax
lea rdx, [rbp + 0x28]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012e23
mov bl, 1
jmp 0x140012f21
mov rcx, qword [0x140218998]
lea rax, str.normal
mov r8b, 1
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x68]
mov qword [rbp - 0x68], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012e55
mov bl, 2
jmp 0x140012f21
mov rcx, qword [0x140218998]
lea rax, str.high
mov r8b, 1
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012e89
mov bl, 3
jmp 0x140012f21
mov rcx, qword [0x140218998]
lea rax, str.realtime
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012ebd
mov bl, 4
jmp 0x140012f21
mov rcx, qword [0x140218998]
lea rax, str.abovenormal
mov r8b, 1
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012eee
mov bl, 6
jmp 0x140012f21
mov rcx, qword [0x140218998]
lea rax, str.belownormal
mov r8b, 1
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012a4a
mov bl, 5
xorps xmm0, xmm0
mov dword [rbp - 0x58], 0x30
lea r9, [rbp - 0x80]
mov qword [rbp - 0x50], r12
lea r8, [rbp - 0x58]
mov dword [rbp - 0x40], r12d
mov edx, 0x200
mov qword [rbp - 0x48], r12
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x80], rdi
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x78], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x140012c38
mov rcx, qword ds:[rsp + 0x30]
lea r8, [rsp + 0x38]
mov byte [rsp + 0x38], 0
mov r9d, 2
mov byte [rsp + 0x39], bl
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x38], ax
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
jmp 0x140012c2a
mov rcx, qword [0x140218990]
lea rax, str.iopriority
mov r8b, 1
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140013106
mov rcx, qword [0x140218998]
test rcx, rcx
je 0x140012a4a
lea rax, str.verylow
mov qword [rsp + 0x70], 0xe
mov r8b, 1
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140013007
mov esi, r12d
jmp 0x1400130aa
mov rcx, qword [0x140218998]
lea rax, [0x1401b4a18]
mov r8b, 1
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 6
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140013040
mov esi, 1
jmp 0x1400130aa
mov rcx, qword [0x140218998]
lea rax, str.normal
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140013074
mov esi, 2
jmp 0x1400130aa
mov rcx, qword [0x140218998]
lea rax, str.high
mov r8b, 1
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012a4a
mov esi, 3
xorps xmm0, xmm0
mov dword [rbp - 0x58], 0x30
lea r9, [rbp - 0x68]
mov qword [rbp - 0x50], r12
lea r8, [rbp - 0x58]
mov dword [rbp - 0x40], r12d
mov edx, 0x200
mov qword [rbp - 0x48], r12
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x68], rdi
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x60], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x140012c38
mov dword [rsp + 0x38], esi
mov edx, 0x21
jmp 0x14001320e
mov rcx, qword [0x140218990]
lea rax, str.pagepriority
mov r8b, 1
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x140012c38
mov rax, qword [0x140218998]
test rax, rax
je 0x140012a4a
movups xmm0, xmmword [rax]
xor r11b, r11b
movq r9, xmm0
movups xmmword [rbp - 0x80], xmm0
mov r10, qword [rbp - 0x78]
test r9, r9
je 0x140013183
movzx eax, word [r10]
cmp ax, 0x2d
je 0x140013178
nop word [rax + rax]
cmp ax, 0x2b
jne 0x140013183
jmp 0x14001317b
mov r11b, 1
add r10, 2
sub r9, 2
shr r9, 1
mov rcx, r12
mov rdx, r12
je 0x1400131af
nop
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x1400131a7
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
inc rdx
cmp rdx, r9
jb 0x140013190
mov rbx, rcx
mov dword [rbp - 0x58], 0x30
neg rbx
mov qword [rbp - 0x50], r12
test r11b, r11b
mov dword [rbp - 0x40], r12d
xorps xmm0, xmm0
mov qword [rbp - 0x48], r12
cmove rbx, rcx
mov qword [rsp + 0x60], rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x68], r12
lea r9, [rsp + 0x60]
mov edx, 0x200
lea r8, [rbp - 0x58]
movdqu xmmword [rbp - 0x38], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x140012c38
mov dword [rsp + 0x38], ebx
mov edx, 0x27
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, 4
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
jmp 0x140012c2a
mov r8, qword [rbp - 0x70]
xor edx, edx
mov rcx, qword [0x140213cd0]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000225
jmp 0x140012c3b
mov rcx, qword [0x140218980]
lea rax, str.service
movzx r8d, sil
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x14001365b
cmp qword [0x140218988], r12
je 0x140012a4a
mov rcx, qword [0x140218990]
lea rax, str.start
movzx r8d, sil
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x140013343
mov rax, qword [0x140218988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140013640
mov r8d, 0x10
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140013640
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140013335
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x140013335
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140012c38
mov rcx, qword [0x140218990]
lea rax, [0x140193510]
movzx r8d, sil
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x140013407
mov rax, qword [0x140218988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140013640
mov r8d, 0x40
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140013640
lea r8, [rbp + 0x28]
mov edx, 3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400133f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x1400133f9
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140012c38
mov rcx, qword [0x140218990]
lea rax, str.pause
movzx r8d, sil
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400134c7
mov rax, qword [0x140218988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140013640
mov r8d, 0x40
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140013640
lea r8, [rbp + 0x28]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400134b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x1400134b9
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140012c38
mov rcx, qword [0x140218990]
lea rax, str.stop
movzx r8d, sil
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140013584
mov rax, qword [0x140218988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140013640
mov r8d, 0x20
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140013640
lea r8, [rbp + 0x28]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140013576
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x140013576
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140012c38
mov rcx, qword [0x140218990]
lea rax, [0x140193638]
movzx r8d, sil
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x68]
mov qword [rbp - 0x68], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x140012c38
mov rax, qword [0x140218988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140013640
mov r8d, 0x10000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140013640
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140013632
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x140013632
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140012c38
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140012c3b
movzx eax, ax
or eax, 0xc0070000
jmp 0x140012c3b
mov rcx, qword [0x140218980]
lea rax, str.thread
movzx r8d, sil
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140012c38
mov rax, qword [0x140218988]
test rax, rax
je 0x140012a4a
movups xmm0, xmmword [rax]
xor dil, dil
movq r9, xmm0
movups xmmword [rbp - 0x80], xmm0
mov r10, qword [rbp - 0x78]
test r9, r9
je 0x1400136d3
movzx eax, word [r10]
cmp ax, 0x2d
je 0x1400136c7
cmp ax, 0x2b
jne 0x1400136d3
jmp 0x1400136cb
movzx edi, sil
add r10, 2
sub r9, 2
shr r9, 1
movzx r11d, sil
mov rcx, r12
mov rdx, r12
je 0x140013715
lea rbx, [0x1401ca7b0]
nop dword [rax]
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [rbx + rax*4]
cmp r8d, 0xa
jae 0x140013709
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
jmp 0x14001370c
xor r11b, r11b
inc rdx
cmp rdx, r9
jb 0x1400136f0
mov rbx, rcx
neg rbx
test dil, dil
cmove rbx, rcx
test r11b, r11b
je 0x140012a4a
mov rcx, qword [0x140218990]
lea rax, str.terminate
movzx r8d, sil
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400137b5
xorps xmm0, xmm0
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], rbx
lea r8, [rbp - 0x58]
mov dword [rbp - 0x58], 0x30
mov edx, esi
mov qword [rbp - 0x50], r12
lea rcx, [rsp + 0x30]
mov dword [rbp - 0x40], r12d
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x48], r12
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov r15d, eax
test eax, eax
js 0x140012c38
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateThread]
nop
jmp 0x140012c2a
mov rcx, qword [0x140218990]
lea rax, str.suspend
movzx r8d, sil
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14001383e
xorps xmm0, xmm0
mov qword [rsp + 0x40], r12
lea r9, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
lea r8, [rbp - 0x58]
mov dword [rbp - 0x58], 0x30
mov edx, 2
mov qword [rbp - 0x50], r12
lea rcx, [rsp + 0x30]
mov dword [rbp - 0x40], r12d
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x48], r12
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov r15d, eax
test eax, eax
js 0x140012c38
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
jmp 0x140012c2a
mov rcx, qword [0x140218990]
lea rax, str.resume
movzx r8d, sil
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x140012c38
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
lea r9, [rbp - 0x68]
mov qword [rbp - 0x60], rbx
lea r8, [rbp - 0x58]
mov dword [rbp - 0x58], 0x30
mov edx, 2
mov qword [rbp - 0x50], r12
lea rcx, [rsp + 0x30]
mov dword [rbp - 0x40], r12d
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x48], r12
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov r15d, eax
test eax, eax
js 0x140012c38
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
nop
jmp 0x140012c2a