Function at 0x140014ae0
Capabilities:
Get common file path
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1040]
mov eax, 0x1140
call fcn.14003f630
sub rsp, rax
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rbp + 0x1030], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14001527e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140015289
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140015294
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x30]
call fcn.14005fd20
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x830]
call fcn.14005fd20
mov edx, 0x400
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, 0x400
lea rcx, [rbp + 0x830]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
lea rax, [rbp + 0x30]
mov r13, 0xffffffffffffffff
mov r8, r13
inc r8
cmp word [rax + r8*2], 0
jne 0x140014bd2
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140002da0
lea rax, [rbp + 0x830]
mov r8, r13
inc r8
cmp word [rax + r8*2], 0
jne 0x140014bf5
lea rdx, [rbp + 0x830]
lea rcx, [rsp + 0x50]
call fcn.140002da0
lea rax, [rbp + 0x30]
mov r8, r13
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140014c20
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.140002da0
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rax - 0x10]
xor esi, esi
test ecx, ecx
je 0x140014ca5
lea ebx, [rcx - 1]
test ebx, ebx
js 0x14001529f
cmp ebx, ecx
jg 0x14001529f
lea rdi, [rcx*2 - 2]
movzx ecx, word [rdi + rax]
cmp cx, 0x5c
je 0x140014c73
cmp cx, 0x2f
jne 0x140014ca5
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, ebx
or ecx, edx
jge 0x140014c95
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.140002b00
mov rax, qword [rsp + 0x58]
cmp ebx, dword [rax - 0xc]
jg 0x14001529f
mov dword [rax - 0x10], ebx
mov word [rdi + rax], si
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax - 0x10]
test ecx, ecx
je 0x140014d0f
lea ebx, [rcx - 1]
test ebx, ebx
js 0x14001529f
cmp ebx, ecx
jg 0x14001529f
lea rdi, [rcx*2 - 2]
movzx ecx, word [rdi + rax]
cmp cx, 0x5c
je 0x140014cdd
cmp cx, 0x2f
jne 0x140014d0f
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, ebx
or ecx, edx
jge 0x140014cff
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140002b00
mov rax, qword [rsp + 0x50]
cmp ebx, dword [rax - 0xc]
jg 0x14001529f
mov dword [rax - 0x10], ebx
mov word [rdi + rax], si
mov rax, qword [rsp + 0x48]
movsxd rcx, dword [rax - 0x10]
test ecx, ecx
je 0x140014d79
lea ebx, [rcx - 1]
test ebx, ebx
js 0x14001529f
cmp ebx, ecx
jg 0x14001529f
lea rdi, [rcx*2 - 2]
movzx ecx, word [rdi + rax]
cmp cx, 0x5c
je 0x140014d47
cmp cx, 0x2f
jne 0x140014d79
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, ebx
or ecx, edx
jge 0x140014d69
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140002b00
mov rax, qword [rsp + 0x48]
cmp ebx, dword [rax - 0xc]
jg 0x14001529f
mov dword [rax - 0x10], ebx
mov word [rdi + rax], si
lea rbx, str.lodctr.exe
mov r8, r13
inc r8
cmp word [rbx + r8*2], si
jne 0x140014d83
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140002b60
mov r8, r13
nop dword [rax]
inc r8
cmp word [rbx + r8*2], si
jne 0x140014da0
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140002b60
lea rdx, str.wbemwinmgmt.exe
mov r8, r13
inc r8
cmp word [rdx + r8*2], si
jne 0x140014dc1
lea rcx, [rsp + 0x48]
call fcn.140002b60
call fcn.140001a70
test rax, rax
je 0x140015273
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdi, [0x14006f4c4]
cmp rdi, 0x10000
jae 0x140014e14
movzx edx, di
lea rcx, [rsp + 0x20]
call fcn.140002950
jmp 0x140014e38
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x140014e20
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140002da0
movzx ebx, di
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140014970
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140014e6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140001a70
test rax, rax
je 0x140015273
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
cmp rdi, 0x10000
jae 0x140014ea2
movzx edx, bx
lea rcx, [rsp + 0x28]
call fcn.140002950
jmp 0x140014ebe
mov r8, r13
inc r8
cmp word [rdi + r8*2], 0
jne 0x140014ea5
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140002da0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140014970
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140014eed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140001a70
test rax, rax
je 0x140015273
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str._RESYNCPERF
cmp rdx, 0x10000
jae 0x140014f2c
movzx edx, dx
lea rcx, [rsp + 0x30]
call fcn.140002950
jmp 0x140014f46
mov r8, r13
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x140014f30
lea rcx, [rsp + 0x30]
call fcn.140002da0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.140014970
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140014f75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [0x14006f4e8]
mov qword [rbp + 0x20], rax
lea rax, str.winmgmt
mov qword [rbp + 0x28], rax
lea rdi, [rbp + 0x20]
mov qword [rsp + 0x38], rdi
movabs r14, 0x4924924924924925
nop
mov r15, qword [rdi]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x68], rsi
movdqa xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], esi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
lea edx, [rax + 2]
lea rcx, [rbp - 0x80]
call fcn.14003e3cc
mov dword [rsp + 0x60], esi
mov byte [rbp - 0x30], 1
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x25]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140015146
mov r8d, 0xf01ff
mov rdx, r15
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
je 0x14001513d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], eax
lea rdx, [rbp - 0x20]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140015134
mov eax, dword [rbp - 0x1c]
dec eax
test eax, 0xfffffffd
je 0x140015090
lea r8, [rbp - 0x20]
mov edx, 1
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140015134
nop word [rax + rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
xor ecx, ecx
mov r8d, 0x20001
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140015113
mov r8d, 0x84
mov rdx, r15
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
jne 0x1400150d8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140015113
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], eax
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x140015113
cmp dword [rbp + 4], 1
je 0x14001511e
inc esi
cmp esi, 0xa
jb 0x140015090
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
xor esi, esi
movabs r14, 0x4924924924924925
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, r15
call fcn.14002e060
mov r8b, 1
mov rdx, r15
call fcn.14002e210
nop
lea rcx, [rbp - 0x80]
call fcn.14003e3c8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400151c9
mov rdx, qword [rsp + 0x70]
call fcn.14000ebe0
mov rcx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x68]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x38
mov rax, r8
cmp rdx, 0x1000
jb 0x1400151c1
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001526d
mov rcx, r8
call fcn.14003eed0
add rdi, 8
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x30]
cmp rdi, rax
jne 0x140014fa0
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400151ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001521f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14001523d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x1030]
xor rcx, rsp
call fcn.14003f1d0
lea r11, [rsp + 0x1140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14004b3fc
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80070057
call fcn.1400018b0
int3