Function at 0x140009d74
Capabilities:
Delete service
Query service status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140034f78], eax
jg 0x140007de8
lea rbx, [0x140034e78]
mov rdi, qword [rbx]
mov rcx, 0xffffffff80000000
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
nop dword [rax + rax]
test eax, eax
je 0x140007dc9
mov rcx, qword [rsp + 0x28]
lea r8, str.mrcommon_sdk_simulation_servicesperceptionsimulationexemain.cpp
mov r9d, 0x80004005
mov edx, 0x130
call fcn.140003ee0
mov rdx, rdi
lea rcx, str.Failed_to_delete_key_HKCR_ls_n
call fcn.14001bf40
add rbx, 8
lea rax, [0x140034e90]
cmp rbx, rax
jne 0x140007d81
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140009d74
lea rcx, [0x140034f78]
call fcn.14001b538
cmp dword [0x140034f78], 0xffffffff
jne 0x140007d7a
lea rax, str.AppID9F7BC6EE_A81C_479D_B8A5_DAC928772875
mov qword [0x140034e78], rax
lea rcx, [0x140034f78]
lea rax, str.AppIDPerceptionSimulationService.exe
mov qword [0x140034e80], rax
lea rax, str.CLSIDAC7FBAB1_2C10_4A11_97B8_D563F29980DB
mov qword [0x140034e88], rax
call fcn.14001b4d0
jmp 0x140007d7a
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400344c8]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
lea r13, fcn.14000a0b0
and qword [rbp - 0x38], rbx
xor eax, eax
and qword [rbp - 0x48], rbx
xorps xmm0, xmm0
xor edx, edx
mov qword [rbp - 0x40], r13
lea r12d, [rbx + 1]
mov qword [rbp - 0x50], r13
mov r8d, r12d
mov qword [rbp - 0x20], rax
xor ecx, ecx
mov dword [rbp - 0x18], eax
movups xmmword [rbp - 0x30], xmm0
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x38]
mov rdi, rax
cmp rax, rcx
je 0x140009e1c
test rcx, rcx
je 0x140009e15
mov rax, qword [rbp - 0x40]
movabs r10, 0xefcdb65178560a70
mov rax, qword [rax]
lea rcx, [rbp - 0x40]
call qword [0x140029ce8]
test al, al
je 0x14000a040
mov rcx, rdi
mov qword [rbp - 0x38], rcx
mov edi, 0x80070000
test rcx, rcx
jne 0x140009e56
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
lea rcx, str.OpenSCManager_failed__0x_08X__n
or ebx, edi
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.14001bf40
test ebx, ebx
js 0x140009fb9
mov rcx, qword [rbp - 0x38]
lea r15, str.PerceptionSimulation
mov r8d, 0x10024
mov rdx, r15
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
mov rsi, rax
mov rax, qword [rbp - 0x48]
cmp rsi, rax
je 0x140009ead
test rax, rax
je 0x140009ea6
mov rax, qword [rbp - 0x50]
movabs r10, 0xefcdb65178560a70
mov rax, qword [rax]
lea rcx, [rbp - 0x50]
call qword [0x140029ce8]
test al, al
je 0x14000a063
mov rax, rsi
mov qword [rbp - 0x48], rax
test rax, rax
jne 0x140009eda
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
lea rcx, str.OpenService_failed__0x_08X__n
or ebx, edi
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.14001bf40
mov rax, qword [rbp - 0x48]
test ebx, ebx
js 0x140009fbd
lea r8, [rbp - 0x30]
mov edx, r12d
mov rcx, rax
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
nop dword [rax + rax]
test eax, eax
je 0x140009f6e
mov rdx, r15
lea rcx, str.Stopping__ls
call fcn.14001bf40
lea rcx, [0x14002ba78]
call fcn.14001bf40
mov ecx, 0xfa
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
je 0x140009f46
cmp dword [rbp - 0x2c], 3
je 0x140009f0b
lea rcx, [0x14002ace0]
call fcn.14001bf40
lea rcx, str._ls_is_stopped._n
mov rdx, r15
cmp dword [rbp - 0x2c], r12d
je 0x140009f69
lea rcx, str._ls_failed_to_stop._n
call fcn.14001bf40
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
nop dword [rax + rax]
test eax, eax
jne 0x140009faa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
lea rcx, str.DeleteService_failed__0x_08X__n
or ebx, edi
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.14001bf40
test ebx, ebx
js 0x140009fb9
mov rdx, r15
lea rcx, str._ls_is_removed._n
call fcn.14001bf40
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x50], r13
test rax, rax
je 0x140009fdc
lea rcx, [rbp - 0x50]
call fcn.14000a0b0
test al, al
je 0x14000a082
and qword [rbp - 0x48], 0
cmp qword [rbp - 0x38], 0
mov qword [rbp - 0x40], r13
je 0x140009ff4
lea rcx, [rbp - 0x40]
call fcn.14000a0b0
test al, al
je 0x14000a021
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001ae50
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, r12d
or ecx, edi
test eax, eax
cmovle ecx, eax
call fcn.1400062e0
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, r12d
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.1400062e0
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, r12d
or ecx, edi
test eax, eax
cmovle ecx, eax
call fcn.1400062e0
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, r12d
or ecx, edi
test eax, eax
cmovle ecx, eax
call fcn.1400062e0
int3