Function at 0x14000e900
Capabilities:
Continue service
Delete service
Pause service
Resume thread
Start service
Stop service
Suspend thread
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword gs:[0x30]
xor esi, esi
mov r9d, 1
mov qword [rsp + 0x28], rsi
mov r8d, r9d
mov ebx, esi
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x20]
lea rcx, [rsp + 0x70]
movzx eax, word [rdx + 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rdx + 0x78]
lea rdx, [0x140153bc8]
mov qword [rsp + 0x78], rax
lea rax, [0x14000e8f0]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhParseCommandLine
mov rcx, qword [0x140160480]
lea rax, str.process
mov r8b, 1
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f0f6
mov r9, qword [0x140160488]
test r9, r9
je 0x14000ea79
mov r8, qword [r9]
mov ecx, esi
shr r8, 1
je 0x14000e9d9
mov rdx, qword [r9 + 8]
nop word [rax + rax]
movzx eax, word [rdx]
sub ax, 0x30
cmp ax, 0xa
jae 0x14000e9d9
inc rcx
add rdx, 2
cmp rcx, r8
jb 0x14000e9c0
cmp rcx, r8
jne 0x14000ea8c
movups xmm0, xmmword [r9]
xor r14b, r14b
movq r9, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r10, qword [rsp + 0x40]
test r9, r9
je 0x14000ea1a
movzx eax, word [r10]
cmp ax, 0x2d
je 0x14000ea0f
cmp ax, 0x2b
jne 0x14000ea1a
jmp 0x14000ea12
mov r14b, 1
add r10, 2
sub r9, 2
shr r9, 1
mov r11b, 1
mov rdi, rsi
mov rdx, rsi
je 0x14000ea6c
mov qword [rsp + 0x268], r15
lea r15, [0x140136c40]
nop word [rax + rax]
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r15 + rax*4]
cmp r8d, 0xa
jae 0x14000ea59
lea rcx, [rdi + rdi*4]
lea rdi, [r8 + rcx*2]
jmp 0x14000ea5c
xor r11b, r11b
inc rdx
cmp rdx, r9
jb 0x14000ea40
mov r15, qword [rsp + 0x268]
test r14b, r14b
je 0x14000ea74
neg rdi
test r11b, r11b
jne 0x14000eaed
mov eax, 0xc000000d
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, 5
lea rcx, [rsp + 0x48]
call sym.ProcessHacker.exe_PhEnumProcessesEx
mov ebx, eax
test eax, eax
js 0x14000f52f
mov r14, qword [rsp + 0x48]
mov rdx, qword [0x140160488]
mov rcx, r14
call sym.ProcessHacker.exe_PhFindProcessInformationByImageName
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
mov r8, r14
test rax, rax
jne 0x14000eae3
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000225
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdi, qword [rax + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x140160490]
lea rax, str.terminate
mov r8b, 1
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000eb71
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 1
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14000f52d
cmp qword [0x14015c480], rsi
mov rdi, qword [rbp + 0x1b0]
je 0x14000eb58
xor edx, edx
mov rcx, rdi
call fcn.1400c00e0
mov ebx, eax
cmp eax, 0xc00000bb
jne 0x14000eb65
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov ebx, eax
mov rcx, qword [rbp + 0x1b0]
jmp 0x14000f527
mov rcx, qword [0x140160490]
lea rax, str.suspend
mov r8b, 1
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ebd1
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 0x800
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rcx, qword [rbp + 0x1b0]
call sym.ProcessHacker.exe_PhSuspendProcess
mov rcx, qword [rbp + 0x1b0]
jmp 0x14000f525
mov rcx, qword [0x140160490]
lea rax, str.resume
mov r8b, 1
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ec31
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 0x800
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rcx, qword [rbp + 0x1b0]
call sym.ProcessHacker.exe_PhResumeProcess
mov rcx, qword [rbp + 0x1b0]
jmp 0x14000f525
mov rcx, qword [0x140160490]
lea rax, str.priority
mov r8b, 1
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ede3
mov rcx, qword [0x140160498]
test rcx, rcx
je 0x14000ea79
lea rax, str.idle
mov qword [rbp - 0x40], 8
mov r8b, 1
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ec9a
mov sil, 1
jmp 0x14000ed8d
mov rcx, qword [0x140160498]
lea rax, str.normal
mov r8b, 1
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x30], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000eccc
mov sil, 2
jmp 0x14000ed8d
mov rcx, qword [0x140160498]
lea rax, str.high
mov r8b, 1
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ecfe
mov sil, 3
jmp 0x14000ed8d
mov rcx, qword [0x140160498]
lea rax, str.realtime
mov r8b, 1
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ed2d
mov sil, 4
jmp 0x14000ed8d
mov rcx, qword [0x140160498]
lea rax, str.abovenormal
mov r8b, 1
mov qword [rbp + 8], rax
lea rdx, [rbp]
mov qword [rbp], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ed5c
mov sil, 6
jmp 0x14000ed8d
mov rcx, qword [0x140160498]
lea rax, str.belownormal
mov r8b, 1
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ea79
mov sil, 5
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 0x200
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rcx, qword [rbp + 0x1b0]
lea r8, [rbp + 0x1a0]
mov r9d, 2
mov byte [rbp + 0x1a0], 0
mov byte [rbp + 0x1a1], sil
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x1b0]
jmp 0x14000f525
mov rcx, qword [0x140160490]
lea rax, str.iopriority
mov r8b, 1
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x20], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ef15
mov rcx, qword [0x140160498]
test rcx, rcx
je 0x14000ea79
lea rax, str.verylow
mov qword [rbp + 0x30], 0xe
mov r8b, 1
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14000eedd
mov rcx, qword [0x140160498]
lea rax, [0x140126c18]
mov r8b, 1
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x40], 6
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ee79
mov esi, 1
jmp 0x14000eedd
mov rcx, qword [0x140160498]
lea rax, str.normal
mov r8b, 1
mov qword [rbp + 0x58], rax
lea rdx, [rbp + 0x50]
mov qword [rbp + 0x50], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000eeaa
mov esi, 2
jmp 0x14000eedd
mov rcx, qword [0x140160498]
lea rax, str.high
mov r8b, 1
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x60]
mov qword [rbp + 0x60], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ea79
mov esi, 3
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 0x200
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rcx, qword [rbp + 0x1b0]
mov edx, esi
call sym.ProcessHacker.exe_PhSetProcessIoPriority
mov rcx, qword [rbp + 0x1b0]
jmp 0x14000f525
mov rcx, qword [0x140160490]
lea rax, str.pagepriority
mov r8b, 1
mov qword [rbp + 0x78], rax
lea rdx, [rbp + 0x70]
mov qword [rbp + 0x70], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000efb0
mov rcx, qword [0x140160498]
test rcx, rcx
je 0x14000ea79
lea r8, [rsp + 0x50]
mov edx, 0xa
call sym.ProcessHacker.exe_PhStringToInteger64
mov eax, dword [rsp + 0x50]
lea rcx, [rbp + 0x1b0]
mov r8, rdi
mov dword [rbp + 0x1a8], eax
mov edx, 0x200
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rcx, qword [rbp + 0x1b0]
lea r8, [rbp + 0x1a8]
mov r9d, 4
lea edx, [r9 + 0x23]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x1b0]
jmp 0x14000f525
mov rcx, qword [0x140160490]
lea rax, str.injectdll
mov r8b, 1
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x80]
mov qword [rbp + 0x80], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f043
cmp qword [0x140160498], rsi
je 0x14000ea79
mov edx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
lea rcx, [rbp + 0x1b0]
or edx, 0x3a
mov r8, rdi
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rdx, qword [0x140160498]
lea r8, [rsp + 0x58]
mov rcx, qword [rbp + 0x1b0]
mov qword [rsp + 0x58], 0xfffffffffd050f80
mov rdx, qword [rdx + 8]
call sym.ProcessHacker.exe_PhInjectDllProcess
mov rcx, qword [rbp + 0x1b0]
jmp 0x14000f525
mov rcx, qword [0x140160490]
lea rax, str.unloaddll
mov r8b, 1
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x90]
mov qword [rbp + 0x90], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f52d
cmp qword [0x140160498], rsi
je 0x14000ea79
mov edx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
lea rcx, [rbp + 0x1b0]
or edx, 0x3a
mov r8, rdi
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rdx, qword [0x140160498]
lea r8, [rsp + 0x68]
mov rcx, qword [rbp + 0x1b0]
call fcn.14000f680
mov ebx, eax
test eax, eax
js 0x14000eb65
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rcx, qword [rbp + 0x1b0]
mov qword [rsp + 0x60], 0xfffffffffd050f80
call sym.ProcessHacker.exe_PhUnloadDllProcess
mov rcx, qword [rbp + 0x1b0]
jmp 0x14000f525
mov rcx, qword [0x140160480]
lea rax, str.service
mov r8b, 1
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa0]
mov qword [rbp + 0xa0], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f39b
cmp qword [0x140160488], rbx
je 0x14000ea79
mov rcx, qword [0x140160490]
lea rax, str.start
mov r8b, 1
mov qword [rbp + 0xb8], rax
lea rdx, [rbp + 0xb0]
mov qword [rbp + 0xb0], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f1c1
mov rcx, qword [0x140160488]
mov edx, 0x10
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
jne 0x14000f1ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14000f52f
movzx eax, ax
or eax, 0xc0070000
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x14000f369
mov rcx, qword [0x140160490]
lea rax, str.continue
mov r8b, 1
mov qword [rbp + 0xc8], rax
lea rdx, [rbp + 0xc0]
mov qword [rbp + 0xc0], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f22f
mov rcx, qword [0x140160488]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14000f18a
lea r8, [rbp + 0x140]
mov edx, 3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x14000f369
mov rcx, qword [0x140160490]
lea rax, str.pause
mov r8b, 1
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0xd0]
mov qword [rbp + 0xd0], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f29d
mov rcx, qword [0x140160488]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14000f18a
lea r8, [rbp + 0x140]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x14000f369
mov rcx, qword [0x140160490]
lea rax, str.stop
mov r8b, 1
mov qword [rbp + 0xe8], rax
lea rdx, [rbp + 0xe0]
mov qword [rbp + 0xe0], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f308
mov rcx, qword [0x140160488]
mov edx, 0x20
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14000f18a
lea r8, [rbp + 0x140]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x14000f369
mov rcx, qword [0x140160490]
lea rax, [0x14010ce98]
mov r8b, 1
mov qword [rbp + 0xf8], rax
lea rdx, [rbp + 0xf0]
mov qword [rbp + 0xf0], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f52d
mov rcx, qword [0x140160488]
mov edx, 0x10000
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14000f18a
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14000f382
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14000f382
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [0x140160480]
lea rax, str.thread
mov r8b, 1
mov qword [rbp + 0x108], rax
lea rdx, [rbp + 0x100]
mov qword [rbp + 0x100], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f52d
mov rcx, qword [0x140160488]
test rcx, rcx
je 0x14000ea79
lea r8, [rsp + 0x30]
mov edx, 0xa
call sym.ProcessHacker.exe_PhStringToInteger64
test al, al
je 0x14000ea79
mov rcx, qword [0x140160490]
lea rax, str.terminate
mov r8b, 1
mov qword [rbp + 0x118], rax
lea rdx, [rbp + 0x110]
mov qword [rbp + 0x110], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f460
mov r8, qword [rsp + 0x30]
lea rcx, [rbp + 0x1b8]
mov edx, 1
call sym.ProcessHacker.exe_PhOpenThread
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rcx, qword [rbp + 0x1b8]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateThread]
jmp 0x14000f51e
mov rcx, qword [0x140160490]
lea rax, str.suspend
mov r8b, 1
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x120]
mov qword [rbp + 0x120], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f4c0
mov r8, qword [rsp + 0x30]
lea rcx, [rbp + 0x1b8]
mov edx, 2
call sym.ProcessHacker.exe_PhOpenThread
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rcx, qword [rbp + 0x1b8]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
jmp 0x14000f51e
mov rcx, qword [0x140160490]
lea rax, str.resume
mov r8b, 1
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x130]
mov qword [rbp + 0x130], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000f52d
mov r8, qword [rsp + 0x30]
lea rcx, [rbp + 0x1b8]
mov edx, 2
call sym.ProcessHacker.exe_PhOpenThread
mov ebx, eax
test eax, eax
js 0x14000f52d
mov rcx, qword [rbp + 0x1b8]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rcx, qword [rbp + 0x1b8]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret