Function at 0x140028640
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x20]
lea rcx, [0x1401978c0]
movzx eax, word [rdx + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rdx + 0x78]
xor edx, edx
mov qword [rsp + 0x48], rax
lea r8d, [rdx + 0x68]
call fcn.14010ed90
xor ebx, ebx
lea rax, [0x140028040]
mov qword [rsp + 0x28], rbx
lea rdx, [0x14018adc0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
lea r8d, [rbx + 0x1c]
call sym.ProcessHacker.exe_PhParseCommandLine
test al, al
je 0x1400286ba
mov eax, dword [0x1401978c0]
bt eax, 0xe
jae 0x1400286e2
lea r8, str.Command_line_options:_n_n_c_n_ctype_command_type_n_cobject_command_object_n_caction_command_action_n_cvalue_command_value_n_debug_n_elevate_n_help_n_hide_n_installkph_n_newinstance_n_nokph_n_noplugins_n_nosettings_n_plugin_pluginname:value_n_priority_rhnl_n_s_n_selectpid_pid_to_select_n_selecttab_name_of_tab_to_select_n_settings_filename_n_sysinfo__section_name__n_uninstallkph_n_v_n
mov edx, 0x40
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowMessage
mov eax, dword [0x1401978c0]
bt eax, 0xe
jae 0x1400286e2
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
test al, 0x20
je 0x140028750
mov rcx, qword [0x140192528]
lea rdx, str.kprocesshacker.sys
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov dword [rsp + 0x90], 2
lea r8, [rsp + 0x90]
mov byte [rsp + 0x94], 1
mov rdx, qword [rax + 8]
call fcn.1400dc960
mov ebx, eax
test eax, eax
jns 0x140028747
test dword [0x1401978c0], 0x2000
jne 0x140028747
xor r9d, r9d
lea rdx, str.Unable_to_install_KProcessHacker
mov r8d, eax
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowStatus
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
test al, 0x40
je 0x140028862
xor edx, edx
mov qword [rsp + 0x98], rsi
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140028794
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14002882d
movzx ebx, ax
or ebx, 0xc0070000
jmp 0x14002882d
mov r8d, 0x10020
mov qword [rsp + 0xa0], rdi
lea rdx, str.KProcessHacker3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140028805
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400287fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400287f1
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14002881c
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14002881c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140028813
mov ebx, eax
jmp 0x14002881c
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
test ebx, ebx
jns 0x140028859
test dword [0x1401978c0], 0x2000
jne 0x140028859
xor r9d, r9d
lea rdx, str.Unable_to_uninstall_KProcessHacker
mov r8d, ebx
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowStatus
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
bt eax, 0xc
jae 0x1400288a9
lea rcx, [rsp + 0x50]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [rax + 8], 1
jne 0x1400288a3
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov dword [rsp + 0x20], 5
lea r9d, [rdx + 1]
lea r8d, [rdx + 5]
call sym.ProcessHacker.exe_PhShellProcessHacker
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
mov eax, dword [0x1401978c0]
test al, al
jns 0x1400288b2
call fcn.140013740
add rsp, 0x80
pop rbx
ret