Function at 0x140006454
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14007e4a8]
xor rax, rsp
mov qword [rbp - 8], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x58], edi
jne 0x1400064cd
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
lea r8, [rbp - 0x30]
mov rcx, 0xffffffff80000002
mov qword [rbp - 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140006677
mov rdx, qword [rbx + 8]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 1
jmp 0x140006677
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x140006637
mov rdx, qword [rbx + 8]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400065ec
lea r15, [rbx + 0x24]
mov edx, 1
mov r8, r15
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14000657d
mov rdx, qword [rbx + 0x10]
lea rcx, str.Stopping__s.
call fcn.140006bc0
jmp 0x140006545
cmp dword [rbx + 0x28], 3
jne 0x140006560
lea rcx, [0x14005df20]
call fcn.140006bc0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140006533
cmp dword [rbx + 0x28], 1
lea rcx, str._n_s_stopped._n
mov rdx, qword [rbx + 0x10]
je 0x140006578
lea rcx, str._n_s_failed_to_stop._n
call fcn.140006bc0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x1400065a1
mov rdx, qword [rbx + 0x10]
lea rcx, str._s_removed._n
call fcn.140006bc0
mov edi, 1
jmp 0x1400065e1
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140005cec
cmp qword [rax + 0x18], 8
jb 0x1400065b7
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.DeleteService_failed____s_n
call fcn.140006bc0
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400065e1
mov rcx, qword [rbp - 0x28]
lea rdx, [rdx*2 + 2]
call fcn.140002570
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000662c
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140005cec
cmp qword [rax + 0x18], 8
jb 0x140006602
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.OpenService_failed____s_n
call fcn.140006bc0
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14000662c
mov rcx, qword [rbp - 0x28]
lea rdx, [rdx*2 + 2]
call fcn.140002570
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140006677
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140005cec
cmp qword [rax + 0x18], 8
jb 0x14000664d
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.OpenSCManager_failed____s_n
call fcn.140006bc0
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140006677
mov rcx, qword [rbp - 0x28]
lea rdx, [rdx*2 + 2]
call fcn.140002570
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140020250
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret