Function at 0x140014ff0
Capabilities:
Delete file
Delete service
Get common file path
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1401040f0]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov edx, 0x104
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x140015056
mov rcx, rbx
call fcn.14000f4f0
lea rax, [rdi - 1]
jmp 0x140015772
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140015080
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call fcn.140018ea0
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r15, qword [rbp - 0x80]
sub rax, r15
cmp rax, 1
jb 0x1400157b4
lea r13, [rsp + 0x70]
mov r14, qword [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae r13, r14
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea r12, [r15 + 1]
mov edi, 0xf
lea rsi, [rsp + 0x50]
cmp r12, rdi
jbe 0x140015166
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x140015128
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14005ca1c
test rax, rax
je 0x1400157ba
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140015161
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140015150
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400157a8
jmp 0x140015109
test rcx, rcx
je 0x14001515f
call fcn.14005ca1c
mov rsi, rax
jmp 0x140015161
xor esi, esi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rdi
mov r8, r15
mov rdx, r13
mov rcx, rsi
call fcn.14005f670
mov byte [r15 + rsi], 0x5c
mov byte [rsi + r12], 0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140015195
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140018d60
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140015202
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400151fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400157c0
call fcn.14005ca58
xor edx, edx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], dl
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
lea r12, [rbp - 0x70]
mov rdi, qword [rbp - 0x70]
mov r15, qword [rbp - 0x58]
cmp r15, 0x10
cmovae r12, rdi
mov r13, qword [rbp - 0x60]
cmp r13, 0x10
jae 0x140015252
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x20], xmm0
lea esi, [rdx + 0xf]
jmp 0x1400152c9
mov rsi, r13
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmova rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400152a6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400157c6
mov rcx, rax
call fcn.14005ca1c
mov rcx, rax
test rax, rax
je 0x1400157cc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400152b5
test rcx, rcx
je 0x1400152b2
call fcn.14005ca1c
jmp 0x1400152b5
mov rax, rdx
mov qword [rsp + 0x20], rax
lea r8, [r13 + 1]
mov rdx, r12
mov rcx, rax
call fcn.14005f670
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
xor sil, sil
lea rdx, str.DeleteReadOnlyFile_n
lea rcx, [0x140106640]
call fcn.140001840
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x140015326
lea rdx, str.Failed_to_set_attributes_of_the_file_n
lea rcx, [0x140106640]
call fcn.140001840
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140015356
lea rdx, str.Failed_to_delete_file__n
lea rcx, [0x140106640]
call fcn.140001840
jmp 0x140015359
mov sil, 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140015396
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015391
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400157cc
call fcn.14005ca58
test sil, sil
jne 0x140015457
cmp r15, 0x10
jb 0x1400153d7
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400153ce
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400157de
mov rcx, rdi
call fcn.14005ca58
nop
mov rax, qword [rbp - 0x78]
cmp rax, 0x10
jb 0x140015413
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14001540a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400157a2
mov rcx, r14
call fcn.14005ca58
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001544d
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140015448
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400157ae
mov rcx, r8
call fcn.14005ca58
mov eax, 0xfffffffe
jmp 0x14001575f
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea r12, [rbp - 0x70]
cmp r15, 0x10
cmovae r12, rdi
cmp r13, 0x10
jae 0x140015489
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x20], xmm0
lea esi, [rax + 0xf]
jmp 0x1400154fb
mov rsi, r13
or rsi, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rsi, rcx
cmova rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400154dd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400157d2
mov rcx, rax
call fcn.14005ca1c
mov rcx, rax
test rax, rax
je 0x1400157d8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400154e7
test rcx, rcx
je 0x1400154e7
call fcn.14005ca1c
mov qword [rsp + 0x20], rax
lea r8, [r13 + 1]
mov rdx, r12
mov rcx, rax
call fcn.14005f670
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
xor r13b, r13b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r12, rax
test rax, rax
jne 0x14001553f
lea rdx, str.Failed_to_open_Service_Manager_n
lea rcx, [0x140106640]
call fcn.140001840
jmp 0x1400155b4
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rdx, qword [rsp + 0x20]
mov r8d, 0x10000
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x14001557c
lea rdx, str.Failed_to_open_Service__n
lea rcx, [0x140106640]
call fcn.140001840
jmp 0x1400155aa
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14001559e
lea rdx, str.Failed_to_Delete_Service__n
lea rcx, [0x140106640]
call fcn.140001840
jmp 0x1400155a1
mov r13b, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400155f2
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400155ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400157d8
call fcn.14005ca58
nop
test r13b, r13b
je 0x1400156b3
cmp r15, 0x10
jb 0x140015633
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14001562a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400157de
mov rcx, rdi
call fcn.14005ca58
nop
mov rax, qword [rbp - 0x78]
cmp rax, 0x10
jb 0x14001566f
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140015666
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400157a2
mov rcx, r14
call fcn.14005ca58
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400156a9
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400156a4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400157ae
mov rcx, r8
call fcn.14005ca58
mov eax, 0xfffffffd
jmp 0x14001575f
cmp r15, 0x10
jb 0x1400156eb
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400156e2
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400157de
mov rcx, rdi
call fcn.14005ca58
nop
mov rax, qword [rbp - 0x78]
cmp rax, 0x10
jb 0x140015727
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14001571e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400157a2
mov rcx, r14
call fcn.14005ca58
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001575d
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140015758
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400157ae
mov rcx, r8
call fcn.14005ca58
xor eax, eax
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14005cfc0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14006dea8
nop
call fcn.1400181e0
nop
call fcn.14006dea8
nop
call fcn.140018600
int3
call fcn.14006dea8
nop
call fcn.14006dea8
int3
call fcn.1400181e0
int3
call fcn.14006dea8
int3
call fcn.1400181e0
int3
call fcn.14006dea8
nop
call fcn.14006dea8
int3