Function at 0x7ff7bffd2890
Capabilities:
Continue service
Delete service
Pause service
Resume thread
Start service
Suspend thread
Terminate process

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rdi, 0xffffffffffffffff
lea rdx, [rbp - 0x70]
mov rcx, rdi
call sym.ProcessHacker.exe_PhGetProcessCommandLine
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c63
mov qword [rsp + 0x190], rbx
lea rax, [0x7ff7bffd2880]
mov rbx, qword [rbp - 0x70]
lea rdx, [0x7ff7c01cd140]
mov qword [rsp + 0x198], rsi
mov rcx, rbx
mov esi, 1
mov qword [rsp + 0x1a0], r12
xor r12d, r12d
mov r9d, esi
mov qword [rsp + 0x28], r12
mov r8d, esi
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhParseCommandLine
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, esi
jne 0x7ff7bffd2929
call fcn.7ff7c00c6290
mov rcx, qword [0x7ff7c01d8980]
lea rax, [0x7ff7c0174950]
mov qword [rsp + 0x168], r13
lea rdx, [rbp - 0x28]
movzx r8d, sil
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x160], r14
mov qword [rbp - 0x28], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd3246
mov r9, qword [0x7ff7c01d8988]
nop
test r9, r9
je 0x7ff7bffd2a4a
mov r8, qword [r9]
lea r14, [0x7ff7c018a7b0]
shr r8, 1
mov rcx, r12
je 0x7ff7bffd29ad
mov rdx, qword [r9 + 8]
nop
movzx eax, word [rdx]
sub ax, 0x30
cmp ax, 0xa
jae 0x7ff7bffd2a55
inc rcx
add rdx, 2
cmp rcx, r8
jb 0x7ff7bffd2990
nop dword [rax]
cmp rcx, r8
jne 0x7ff7bffd2a55
movups xmm0, xmmword ds:[r9]
xor bl, bl
movq r9, xmm0
movups xmmword [rbp - 0x28], xmm0
mov r10, qword [rbp - 0x20]
test r9, r9
je 0x7ff7bffd29f3
movzx eax, word [r10]
cmp ax, 0x2d
je 0x7ff7bffd29e7
cmp ax, 0x2b
jne 0x7ff7bffd29f3
jmp 0x7ff7bffd29eb
movzx ebx, sil
add r10, 2
sub r9, 2
shr r9, 1
movzx r11d, sil
mov rcx, r12
mov rdx, r12
je 0x7ff7bffd2a35
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x7ff7bffd2a29
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
jmp 0x7ff7bffd2a2c
xor r11b, r11b
inc rdx
cmp rdx, r9
jb 0x7ff7bffd2a10
mov rdi, rcx
neg rdi
test bl, bl
cmove rdi, rcx
test r11b, r11b
jne 0x7ff7bffd2ba5
mov eax, 0xc000000d
jmp 0x7ff7bffd2c3b
mov edx, 5
lea rcx, [rbp - 0x70]
call sym.ProcessHacker.exe_PhEnumProcessesEx
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c3b
mov rax, qword [0x7ff7c01d8988]
mov r13, qword [rbp - 0x70]
mov qword [rsp + 0x38], rax
nop
movzx esi, word ds:[r13 + 0x38]
mov rdi, qword [r13 + 0x40]
cmp rsi, qword [rax]
jne 0x7ff7bffd2c8a
cmp byte [0x7ff7c01d65de], 1
mov ecx, esi
mov r14, qword [rax + 8]
jb 0x7ff7bffd2afd
shr rcx, 4
test rcx, rcx
je 0x7ff7bffd2ae6
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x7ff7bffd2aee
add rdi, 0x10
add r14, 0x10
sub rcx, 1
jne 0x7ff7bffd2ac0
shr rsi, 1
and esi, 7
jmp 0x7ff7bffd2b30
and esi, 0xf
shl rcx, 4
add rsi, rcx
shr rsi, 1
jmp 0x7ff7bffd2b30
shr rcx, 3
test rcx, rcx
je 0x7ff7bffd2b2a
nop word [rax + rax]
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x7ff7bffd2c7b
add rdi, 8
add r14, 8
sub rcx, 1
jne 0x7ff7bffd2b10
shr rsi, 1
and esi, 3
test rsi, rsi
je 0x7ff7bffd2b76
sub r14, rdi
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx r12d, word [r14 + rdi]
cmp cx, r12w
je 0x7ff7bffd2b6c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x7ff7bffd2c8a
add rdi, 2
sub rsi, 1
jne 0x7ff7bffd2b40
test r13, r13
je 0x7ff7bffd3229
mov r8, qword [rbp - 0x70]
xor edx, edx
mov rcx, qword [0x7ff7c01d3cd0]
mov rdi, qword [r13 + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor r12d, r12d
lea r14, [0x7ff7c018a7b0]
mov esi, 1
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c01528d8]
mov r8b, 1
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0x18]
mov qword [rbp + 0x18], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x7ff7bffd2cab
xorps xmm0, xmm0
mov dword [rbp + 0x28], 0x30
lea r9, [rbp - 0x18]
mov qword [rbp + 0x30], r12
lea r8, [rbp + 0x28]
mov dword [rbp + 0x40], r12d
mov edx, esi
mov qword [rbp + 0x38], r12
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x18], rdi
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp - 0x10], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c38
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rcx, qword [rsp + 0x30]
mov r15d, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, r15d
mov r13, qword [rsp + 0x168]
mov r14, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x190]
mov r12, qword [rsp + 0x1a0]
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.7ff7c0121390
add rsp, 0x170
pop r15
pop rdi
pop rbp
ret
and esi, 7
lea rsi, [rsi + rcx*8]
shr rsi, 1
jmp 0x7ff7bffd2b30
mov eax, dword ds:[r13]
test eax, eax
je 0x7ff7bffd3229
add r13, rax
je 0x7ff7bffd3229
mov rax, qword [rsp + 0x38]
jmp 0x7ff7bffd2a80
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0152c10]
mov r8b, 1
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x18]
mov qword [rbp - 0x18], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2d35
xorps xmm0, xmm0
mov dword [rbp + 0x28], 0x30
lea r9, [rbp - 8]
mov qword [rbp + 0x30], r12
lea r8, [rbp + 0x28]
mov dword [rbp + 0x40], r12d
mov edx, 0x800
mov qword [rbp + 0x38], r12
lea rcx, [rsp + 0x30]
mov qword [rbp - 8], rdi
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c38
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
nop dword [rax]
jmp 0x7ff7bffd2c2a
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0152c48]
mov r8b, 1
mov qword [rbp], rax
lea rdx, [rbp - 8]
mov qword [rbp - 8], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2dbb
xorps xmm0, xmm0
mov dword [rbp + 0x28], 0x30
lea r9, [rbp + 8]
mov qword [rbp + 0x30], r12
lea r8, [rbp + 0x28]
mov dword [rbp + 0x40], r12d
mov edx, 0x800
mov qword [rbp + 0x38], r12
lea rcx, [rsp + 0x30]
mov qword [rbp + 8], rdi
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x10], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c38
mov rcx, qword ds:[rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtResumeProcess]
jmp 0x7ff7bffd2c2a
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0174960]
mov r8b, 1
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 8]
mov qword [rbp + 8], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2f9b
mov rcx, qword [0x7ff7c01d8998]
test rcx, rcx
je 0x7ff7bffd2a4a
lea rax, [0x7ff7c0174978]
mov qword [rbp + 0x28], 8
mov r8b, 1
mov qword [rbp + 0x30], rax
lea rdx, [rbp + 0x28]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2e23
mov bl, 1
jmp 0x7ff7bffd2f21
mov rcx, qword [0x7ff7c01d8998]
lea rax, [0x7ff7c0174988]
mov r8b, 1
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x68]
mov qword [rbp - 0x68], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2e55
mov bl, 2
jmp 0x7ff7bffd2f21
mov rcx, qword [0x7ff7c01d8998]
lea rax, [0x7ff7c0174998]
mov r8b, 1
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2e89
mov bl, 3
jmp 0x7ff7bffd2f21
mov rcx, qword [0x7ff7c01d8998]
lea rax, [0x7ff7c01749a8]
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2ebd
mov bl, 4
jmp 0x7ff7bffd2f21
mov rcx, qword [0x7ff7c01d8998]
lea rax, [0x7ff7c01749c0]
mov r8b, 1
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2eee
mov bl, 6
jmp 0x7ff7bffd2f21
mov rcx, qword [0x7ff7c01d8998]
lea rax, [0x7ff7c01749d8]
mov r8b, 1
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2a4a
mov bl, 5
xorps xmm0, xmm0
mov dword [rbp - 0x58], 0x30
lea r9, [rbp - 0x80]
mov qword [rbp - 0x50], r12
lea r8, [rbp - 0x58]
mov dword [rbp - 0x40], r12d
mov edx, 0x200
mov qword [rbp - 0x48], r12
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x80], rdi
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x78], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c38
mov rcx, qword ds:[rsp + 0x30]
lea r8, [rsp + 0x38]
mov byte [rsp + 0x38], 0
mov r9d, 2
mov byte [rsp + 0x39], bl
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x38], ax
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
jmp 0x7ff7bffd2c2a
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c01749f0]
mov r8b, 1
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd3106
mov rcx, qword [0x7ff7c01d8998]
test rcx, rcx
je 0x7ff7bffd2a4a
lea rax, [0x7ff7c0174a08]
mov qword [rsp + 0x70], 0xe
mov r8b, 1
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd3007
mov esi, r12d
jmp 0x7ff7bffd30aa
mov rcx, qword [0x7ff7c01d8998]
lea rax, [0x7ff7c0174a18]
mov r8b, 1
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 6
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd3040
mov esi, 1
jmp 0x7ff7bffd30aa
mov rcx, qword [0x7ff7c01d8998]
lea rax, [0x7ff7c0174988]
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd3074
mov esi, 2
jmp 0x7ff7bffd30aa
mov rcx, qword [0x7ff7c01d8998]
lea rax, [0x7ff7c0174998]
mov r8b, 1
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2a4a
mov esi, 3
xorps xmm0, xmm0
mov dword [rbp - 0x58], 0x30
lea r9, [rbp - 0x68]
mov qword [rbp - 0x50], r12
lea r8, [rbp - 0x58]
mov dword [rbp - 0x40], r12d
mov edx, 0x200
mov qword [rbp - 0x48], r12
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x68], rdi
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x60], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c38
mov dword [rsp + 0x38], esi
mov edx, 0x21
jmp 0x7ff7bffd320e
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0174a20]
mov r8b, 1
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x7ff7bffd2c38
mov rax, qword [0x7ff7c01d8998]
test rax, rax
je 0x7ff7bffd2a4a
movups xmm0, xmmword [rax]
xor r11b, r11b
movq r9, xmm0
movups xmmword [rbp - 0x80], xmm0
mov r10, qword [rbp - 0x78]
test r9, r9
je 0x7ff7bffd3183
movzx eax, word [r10]
cmp ax, 0x2d
je 0x7ff7bffd3178
nop word [rax + rax]
cmp ax, 0x2b
jne 0x7ff7bffd3183
jmp 0x7ff7bffd317b
mov r11b, 1
add r10, 2
sub r9, 2
shr r9, 1
mov rcx, r12
mov rdx, r12
je 0x7ff7bffd31af
nop
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x7ff7bffd31a7
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
inc rdx
cmp rdx, r9
jb 0x7ff7bffd3190
mov rbx, rcx
mov dword [rbp - 0x58], 0x30
neg rbx
mov qword [rbp - 0x50], r12
test r11b, r11b
mov dword [rbp - 0x40], r12d
xorps xmm0, xmm0
mov qword [rbp - 0x48], r12
cmove rbx, rcx
mov qword [rsp + 0x60], rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x68], r12
lea r9, [rsp + 0x60]
mov edx, 0x200
lea r8, [rbp - 0x58]
movdqu xmmword [rbp - 0x38], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c38
mov dword [rsp + 0x38], ebx
mov edx, 0x27
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, 4
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
jmp 0x7ff7bffd2c2a
mov r8, qword [rbp - 0x70]
xor edx, edx
mov rcx, qword [0x7ff7c01d3cd0]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000225
jmp 0x7ff7bffd2c3b
mov rcx, qword [0x7ff7c01d8980]
lea rax, [0x7ff7c0174a40]
movzx r8d, sil
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x7ff7bffd365b
cmp qword [0x7ff7c01d8988], r12
je 0x7ff7bffd2a4a
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c01534d8]
movzx r8d, sil
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x7ff7bffd3343
mov rax, qword [0x7ff7c01d8988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x7ff7bffd3640
mov r8d, 0x10
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x7ff7bffd3640
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x7ff7bffd3335
call qword [sym.imp.kernel32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x7ff7bffd3335
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x7ff7bffd2c38
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0153510]
movzx r8d, sil
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x7ff7bffd3407
mov rax, qword [0x7ff7c01d8988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x7ff7bffd3640
mov r8d, 0x40
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x7ff7bffd3640
lea r8, [rbp + 0x28]
mov edx, 3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x7ff7bffd33f9
call qword [sym.imp.kernel32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x7ff7bffd33f9
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x7ff7bffd2c38
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0153550]
movzx r8d, sil
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd34c7
mov rax, qword [0x7ff7c01d8988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x7ff7bffd3640
mov r8d, 0x40
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x7ff7bffd3640
lea r8, [rbp + 0x28]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x7ff7bffd34b9
call qword [sym.imp.kernel32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x7ff7bffd34b9
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x7ff7bffd2c38
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0153580]
movzx r8d, sil
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd3584
mov rax, qword [0x7ff7c01d8988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x7ff7bffd3640
mov r8d, 0x20
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x7ff7bffd3640
lea r8, [rbp + 0x28]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x7ff7bffd3576
call qword [sym.imp.kernel32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x7ff7bffd3576
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x7ff7bffd2c38
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0153638]
movzx r8d, sil
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x68]
mov qword [rbp - 0x68], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x7ff7bffd2c38
mov rax, qword [0x7ff7c01d8988]
mov r8d, esi
xor edx, edx
xor ecx, ecx
mov rbx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x7ff7bffd3640
mov r8d, 0x10000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x7ff7bffd3640
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x7ff7bffd3632
call qword [sym.imp.kernel32.dll_GetLastError]
mov r15d, eax
test eax, eax
jle 0x7ff7bffd3632
movzx r15d, ax
or r15d, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x7ff7bffd2c38
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jle 0x7ff7bffd2c3b
movzx eax, ax
or eax, 0xc0070000
jmp 0x7ff7bffd2c3b
mov rcx, qword [0x7ff7c01d8980]
lea rax, [0x7ff7c0174a50]
movzx r8d, sil
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd2c38
mov rax, qword [0x7ff7c01d8988]
test rax, rax
je 0x7ff7bffd2a4a
movups xmm0, xmmword [rax]
xor dil, dil
movq r9, xmm0
movups xmmword [rbp - 0x80], xmm0
mov r10, qword [rbp - 0x78]
test r9, r9
je 0x7ff7bffd36d3
movzx eax, word [r10]
cmp ax, 0x2d
je 0x7ff7bffd36c7
cmp ax, 0x2b
jne 0x7ff7bffd36d3
jmp 0x7ff7bffd36cb
movzx edi, sil
add r10, 2
sub r9, 2
shr r9, 1
movzx r11d, sil
mov rcx, r12
mov rdx, r12
je 0x7ff7bffd3715
lea rbx, [0x7ff7c018a7b0]
nop dword [rax]
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [rbx + rax*4]
cmp r8d, 0xa
jae 0x7ff7bffd3709
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
jmp 0x7ff7bffd370c
xor r11b, r11b
inc rdx
cmp rdx, r9
jb 0x7ff7bffd36f0
mov rbx, rcx
neg rbx
test dil, dil
cmove rbx, rcx
test r11b, r11b
je 0x7ff7bffd2a4a
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c01528d8]
movzx r8d, sil
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd37b5
xorps xmm0, xmm0
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], rbx
lea r8, [rbp - 0x58]
mov dword [rbp - 0x58], 0x30
mov edx, esi
mov qword [rbp - 0x50], r12
lea rcx, [rsp + 0x30]
mov dword [rbp - 0x40], r12d
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x48], r12
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c38
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateThread]
nop
jmp 0x7ff7bffd2c2a
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0152c10]
movzx r8d, sil
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffd383e
xorps xmm0, xmm0
mov qword [rsp + 0x40], r12
lea r9, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
lea r8, [rbp - 0x58]
mov dword [rbp - 0x58], 0x30
mov edx, 2
mov qword [rbp - 0x50], r12
lea rcx, [rsp + 0x30]
mov dword [rbp - 0x40], r12d
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x48], r12
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c38
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
jmp 0x7ff7bffd2c2a
mov rcx, qword [0x7ff7c01d8990]
lea rax, [0x7ff7c0152c48]
movzx r8d, sil
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x7ff7bffd2c38
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
lea r9, [rbp - 0x68]
mov qword [rbp - 0x60], rbx
lea r8, [rbp - 0x58]
mov dword [rbp - 0x58], 0x30
mov edx, 2
mov qword [rbp - 0x50], r12
lea rcx, [rsp + 0x30]
mov dword [rbp - 0x40], r12d
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x48], r12
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov r15d, eax
test eax, eax
js 0x7ff7bffd2c38
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
nop
jmp 0x7ff7bffd2c2a