Function at 0x140008090
Capabilities:
Delete service
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rdi, rdx
mov ebx, ecx
lea rcx, [0x1400901f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
cmp ebx, 1
jle 0x140008118
lea rdx, str.install
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
jne 0x1400080ec
call fcn.140006330
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
lea rdx, str.uninstall
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
jne 0x140008118
call fcn.140007bd0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rax, qword [str.RtkBtManServ]
mov qword [rsp + 0x28], rax
lea rax, [0x140007230]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [0x14006fb18]
call fcn.140010f80
lea r9, [0x140090270]
mov r8d, 0x60
lea rdx, str.RunService
lea rcx, str.__hs_____d_:_____s
call fcn.140011770
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, str.CurrentProcessID_from_RunService_is__d
call fcn.140010f80
lea r9, [0x140090270]
mov r8d, 0x62
lea rdx, str.RunService
lea rcx, str.__hs_____d_:_____s
call fcn.140011770
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_StartServiceCtrlDispatcherW]
lea rcx, str.RunService_normal
call fcn.140010f80
lea r9, [0x140090270]
mov r8d, 0x43
lea rdx, str.wmain
lea rcx, str.__hs_____d_:_____s
call fcn.140011770
cmp dword [0x1400901c4], 0
je 0x14000831a
call fcn.140002de0
mov rcx, rax
test rax, rax
je 0x14000832c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, str.uninstall_service_entry
lea rcx, [rsp + 0x70]
call fcn.140006100
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x1400082d5
mov r8d, 0x10024
mov rdx, qword [str.RtkBtManServ]
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400082a2
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x14000828e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, str.DeleteService_failed:_GetLastError__0x__x
lea rcx, [rsp + 0x70]
call fcn.140006100
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x1400082fe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, str.OpenService_failed:_GetLastError__0x__x
lea rcx, [rsp + 0x70]
call fcn.140006100
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x1400082fe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, str.OpenSCManager_failed:_GetLastError__0x__x
lea rcx, [rsp + 0x70]
call fcn.140006100
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000831a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002520
int3