Function at 0x14003a180
Capabilities:
Delete file
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1401e56c8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rcx, qword [0x1401ea1f0]
call qword [sym.imp.USER32.dll_IsWindow]
xor r14d, r14d
movabs r13, 0x7fffffffffffffff
test eax, eax
je 0x14003a4e7
mov rax, qword [0x1401e5a70]
cmp qword [0x1401e5a68], rax
je 0x14003a4e7
xorps xmm0, xmm0
movdqa xmm1, xmmword [0x1401c4b50]
movdqu xmmword [rbp - 0x79], xmm1
movdqu xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], r14
lea ecx, [r14 + 0x10]
call fcn.14015be00
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
lea rbx, [rax + 0x10]
mov qword [rbp + 0x1f], rbx
lea r8d, [r14 + 0x10]
lea rdx, [rbp - 0x79]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x17], rbx
cmp byte [reloc.WS2_32.dll_accept], r14b
je 0x14003a23e
mov byte [reloc.WS2_32.dll_accept], r14b
mov dword [rbp + 7], r14d
mov rdx, qword [0x1401e5a70]
sub rdx, qword [0x1401e5a68]
sar rdx, 2
lea r8, [rbp + 7]
call fcn.14003a860
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003a27b
imul rax, rax, 0x64
jmp 0x14003a296
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffe2329aff
cmp rax, rcx
jge 0x14003a2b1
add rax, 0x1dcd6500
mov qword [rbp + 7], rax
jmp 0x14003a2b5
mov qword [rbp + 7], r13
lea rcx, [rbp + 7]
call fcn.140010f20
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003a2dc
imul rbx, rax, 0x64
jmp 0x14003a2f8
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
movabs r12, 0x7ffffffffff0bdbf
nop dword [rax]
nop word [rax + rax]
movzx esi, r14w
mov dword [rbp + 7], r14d
mov rdx, qword [0x1401e5a70]
sub rdx, qword [0x1401e5a68]
sar rdx, 2
lea r8, [rbp + 7]
call fcn.14003a860
mov rdi, qword [rbp + 0xf]
mov r15, qword [rbp + 0x17]
cmp rdi, r15
je 0x14003a452
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, dword [rdi]
mov rax, qword [0x1401e5a50]
mov rcx, qword [rax + rcx*8]
test rcx, rcx
je 0x14003a37d
mov dword [rbp + 7], r14d
lea rdx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp + 7], 0x103
jne 0x14003a37d
inc si
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov r14, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp r14, 0x989680
jne 0x14003a39b
imul rax, rax, 0x64
jmp 0x14003a3b6
cqo
idiv r14
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv r14
add rax, rcx
cmp rax, r12
jge 0x14003a3c7
add rax, 0xf4240
mov qword [rbp + 7], rax
jmp 0x14003a3cb
mov qword [rbp + 7], r13
lea rcx, [rbp + 7]
call fcn.140010f20
test si, si
jg 0x14003a3ee
add rdi, 4
cmp rdi, r15
mov r14d, 0
jne 0x14003a350
jmp 0x14003a452
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x14003a40c
imul rax, rax, 0x64
jmp 0x14003a427
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7ffffffffa0a1eff
cmp rax, rcx
jge 0x14003a442
add rax, 0x5f5e100
mov qword [rbp + 7], rax
jmp 0x14003a446
mov qword [rbp + 7], r13
lea rcx, [rbp + 7]
call fcn.140010f20
xor r14d, r14d
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x14003a470
imul rax, rax, 0x64
jmp 0x14003a48b
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
sub rax, rbx
movabs rcx, 0x12a05f200
cmp rax, rcx
jge 0x14003a4a6
test si, si
jne 0x14003a310
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14003a4e7
mov rdx, qword [rbp + 0x1f]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a4e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a4e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015c094
cmp byte [0x1401ea0f4], 0
jne 0x14003a6f0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r14, rax
test rax, rax
je 0x14003a579
movsd xmm0, qword [0x1401ba020]
movsd qword [rbp - 0x79], xmm0
movzx ecx, word [0x1401ba028]
mov word [rbp - 0x71], cx
cmp byte [reloc.WS2_32.dll_gethostname], 0
je 0x14003a555
mov byte [rbp - 0x79], 0x57
xor byte [rbp - 0x78], 0x31
xor byte [rbp - 0x77], 0x32
xor byte [rbp - 0x76], 0x33
xor byte [rbp - 0x75], 0x34
xor byte [rbp - 0x74], 0x35
xor byte [rbp - 0x73], 0x36
xor byte [rbp - 0x72], 0x37
xor byte [rbp - 0x71], 0x38
xor byte [rbp - 0x70], 0x39
mov r8d, 0xf01ff
lea rdx, [rbp - 0x79]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x14003a5e5
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r12d, r12d
lea rdx, [rbp - 0x69]
call fcn.1400af1f0
lea rcx, [rbp - 0x21]
call fcn.140010730
lea rcx, [rbp - 0x41]
call fcn.140010730
lea rcx, [rbp - 0x61]
call fcn.140010730
mov ebx, r12d
cmp qword [0x1401ec440], 0
je 0x14003a763
movabs rsi, 0x7ffffffffa0a1efe
nop dword [rax + rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x14003a712
imul rax, rax, 0x64
jmp 0x14003a730
lea rdx, [rbp + 0xf]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14003a6d6
cmp dword [rbp + 0x13], 2
jne 0x14003a6bf
lea r8, [rbp + 0xf]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor r12d, r12d
test eax, eax
je 0x14003a6d9
mov ebx, r12d
cmp dword [rbp + 0x13], 2
jne 0x14003a6b0
movabs r15, 0x7fffffffe2329afe
cmp ebx, 5
jg 0x14003a6b0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x14003a65b
imul rax, rax, 0x64
jmp 0x14003a679
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, r15
jg 0x14003a68a
add rax, 0x1dcd6500
mov qword [rbp + 7], rax
jmp 0x14003a68e
mov qword [rbp + 7], r13
lea rcx, [rbp + 7]
call fcn.140010f20
lea rdx, [rbp + 0xf]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14003a6d9
inc ebx
cmp dword [rbp + 0x13], 2
je 0x14003a638
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14003a6d9
jmp 0x14003a6c2
xor r12d, r12d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14003a6f3
xor r12d, r12d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14003a57c
xor r12d, r12d
lea rcx, [0x1401ec4a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x1401ec5b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x14003a57c
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rsi
jg 0x14003a741
add rax, 0x5f5e100
mov qword [rbp + 7], rax
jmp 0x14003a745
mov qword [rbp + 7], r13
lea rcx, [rbp + 7]
call fcn.140010f20
cmp ebx, 0xa
jae 0x14003a763
inc ebx
cmp qword [0x1401ec440], 0
jne 0x14003a5c0
call fcn.14006da10
call fcn.14006cce0
mov rbx, qword [0x1401ea270]
mov qword [0x1401ea270], rbx
call fcn.140045b00
mov qword [0x1401ea270], r12
test rbx, rbx
je 0x14003a810
mov rcx, rbx
call fcn.14005b280
mov r8, qword [0x1401ea270]
test r8, r8
je 0x14003a807
mov r9d, dword [r8 + 0x3f58]
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14003a7fc
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], 0
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1401ec440]
test rcx, rcx
je 0x14003a821
call fcn.1400ed290
call fcn.1400f0850
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14015bde0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret