Function at 0x14001e5f0
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov qword [rsp + 0x198], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x278], rax
mov rsi, r8
mov rbx, rdx
mov rbp, qword [0x1400d50a8]
mov qword [rsp + 0x70], rbp
xor r13b, r13b
mov qword [r11 - 0xe8], 7
xor edi, edi
mov qword [r11 - 0xf0], rdi
mov word [rsp + 0x1b8], di
lea r8d, [rdi + 0x1c]
lea rdx, str.IMInstaller::IM_UninstallInf
lea rcx, [r11 - 0x108]
call fcn.140001870
nop
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
lea rax, str.Function_start
mov qword [rsp + 0x20], rax
lea edx, [rdi + 0x32]
lea r8d, [rdi + 1]
mov rcx, rbp
call fcn.1400144a0
lea ecx, [rdi + 8]
call fcn.140065e94
test rax, rax
je 0x14001e6bf
lea rcx, [rsp + 0xa0]
mov qword [rax], rcx
jmp 0x14001e6c2
mov rax, rdi
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], rdi
mov ecx, 8
call fcn.140065e94
test rax, rax
je 0x14001e6fe
lea rcx, [rsp + 0x100]
mov qword [rax], rcx
jmp 0x14001e701
mov rax, rdi
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x1f8], 7
mov qword [rsp + 0x1f0], rdi
mov word [rsp + 0x1e0], di
mov byte [rsp + 0x20], 1
mov r9, rsi
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call fcn.1400226e0
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rsi
lea r12, str.Parameter___s_:__i
mov qword [rsp + 0x20], r12
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
mov rdx, qword [rsp + 0x120]
sub rdx, qword [rsp + 0x118]
movabs r8, 0x6666666666666667
mov rax, r8
imul rdx
mov rdi, rdx
sar rdi, 4
mov rcx, rdi
shr rcx, 0x3f
add rdi, rcx
mov rcx, qword [rsp + 0xc0]
sub rcx, qword [rsp + 0xb8]
mov rax, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, rdi
je 0x14001e844
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdx
lea rax, str.Wrong_parameter___i_:___i_
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
xor r14d, r14d
jmp 0x14001fb2b
test rdx, rdx
je 0x14001fad0
xor r14d, r14d
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x40], r14d
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x44]
mov rdx, rbx
mov rcx, rbp
call fcn.140023750
test eax, eax
jns 0x14001e87e
cmp eax, 0x4a020
jne 0x14001fb2b
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov dword [rsp + 0x30], eax
lea rax, [0x1400aefe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov edi, dword [rsp + 0x44]
mov dword [rsp + 0x30], edi
lea rax, str.bFound
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov ebx, dword [rsp + 0x40]
mov dword [rsp + 0x30], ebx
lea rax, str.bDeleted
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
test ebx, ebx
jne 0x14001e988
test edi, edi
je 0x14001e988
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
lea rax, str.Component_no_Deleted
mov qword [rsp + 0x20], rax
lea edx, [rbx + 0x14]
lea r8d, [rbx + 1]
mov rcx, rbp
call fcn.1400144a0
jmp 0x14001fb2b
mov ecx, 8
call fcn.140065e94
test rax, rax
je 0x14001e9a4
lea rcx, [rsp + 0xd0]
mov qword [rax], rcx
jmp 0x14001e9a7
mov rax, r14
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0xf8], r14
mov ecx, 8
call fcn.140065e94
test rax, rax
je 0x14001e9e3
lea rcx, [rsp + 0x140]
mov qword [rax], rcx
jmp 0x14001e9e6
mov rax, r14
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x158], r14
mov qword [rsp + 0x160], r14
mov qword [rsp + 0x168], r14
mov byte [rsp + 0x20], 1
mov r9, rsi
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0xd0]
mov rcx, rbp
call fcn.1400226e0
mov dword [rsp + 0x4c], eax
mov rbx, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
cmp rbx, rdi
jbe 0x14001ea4c
call fcn.1400679f0
mov rdi, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rbx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x80], xmm0
mov rbx, qword [rsp + 0x118]
cmp rbx, qword [rsp + 0x120]
jbe 0x14001ea8b
call fcn.1400679f0
mov rdi, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov r12, qword [rsp + 0x88]
mov qword [rsp + 0x50], r12
mov r15, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x80]
nop word [rax + rax]
cmp qword [rsp + 0xb8], rdi
jbe 0x14001eadf
call fcn.1400679f0
test rbx, rbx
je 0x14001eaee
cmp rbx, qword [rsp + 0xa0]
je 0x14001eaf3
call fcn.1400679f0
cmp r12, rdi
je 0x14001fa4a
mov qword [rsp + 0x270], 7
mov qword [rsp + 0x268], r14
mov word [rsp + 0x258], r14w
xor r8d, r8d
lea rdx, [0x1400ad318]
lea rcx, [rsp + 0x250]
call fcn.140001870
nop
test rsi, rsi
jne 0x14001eb40
call fcn.1400679f0
mov rdx, r14
jmp 0x14001eb43
mov rdx, qword [rsi]
cmp r15, qword [rdx + 0x20]
jb 0x14001eb4e
call fcn.1400679f0
cmp qword [r15 + 0x18], 0
je 0x14001f64f
test rsi, rsi
jne 0x14001eb68
call fcn.1400679f0
mov rdx, r14
jmp 0x14001eb6b
mov rdx, qword [rsi]
cmp r15, qword [rdx + 0x20]
jb 0x14001eb76
call fcn.1400679f0
cmp qword [r15 + 0x20], 8
jb 0x14001eb86
lea r14, [r15 + 8]
mov rax, qword [r14]
jmp 0x14001eb8d
lea r14, [r15 + 8]
mov rax, r14
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov qword [rsp + 0x30], rax
lea rax, str.iterDriversName
mov qword [rsp + 0x28], rax
lea rax, str.Parameter___s_:__s
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
test rbx, rbx
jne 0x14001ebe6
call fcn.1400679f0
xor ecx, ecx
mov rdx, rcx
jmp 0x14001ebe9
mov rdx, qword [rbx]
cmp r12, qword [rdx + 0x20]
jb 0x14001ebf4
call fcn.1400679f0
cmp qword [r12 + 0x20], 8
jb 0x14001ec0e
add r12, 8
mov rax, qword [r12]
mov qword [rsp + 0x98], rax
jmp 0x14001ec1a
add r12, 8
mov qword [rsp + 0x98], r12
mov rdi, qword [rsp + 0xf0]
mov rbp, rdi
mov rax, qword [rsp + 0xe8]
cmp rax, rdi
jbe 0x14001ec47
call fcn.1400679f0
mov rdi, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xe8]
mov rsi, rax
cmp rax, rdi
jbe 0x14001ec64
call fcn.1400679f0
mov rdi, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xd0]
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], rsi
movaps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x1a0], xmm0
cmp rax, rdi
jbe 0x14001ec9f
call fcn.1400679f0
mov rbx, qword [rsp + 0xd0]
lea r8, [rsp + 0x98]
mov rdx, rbp
mov rcx, rsi
call fcn.140027160
mov rsi, rax
mov rcx, qword [rsp + 0x1a0]
test rcx, rcx
je 0x14001ecc7
cmp rcx, rbx
je 0x14001eccc
call fcn.1400679f0
cmp rsi, rdi
je 0x14001f41b
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
lea rax, str.Se_ha_encontrado_el_servicio
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rbp, qword [rsp + 0x70]
mov rcx, rbp
call fcn.1400144a0
mov r8d, 0xe
lea rdx, str._DriversRoot__
lea rcx, [rsp + 0x250]
call fcn.140001870
mov rsi, qword [rsp + 0x60]
test rsi, rsi
jne 0x14001ed41
call fcn.1400679f0
xor ebx, ebx
mov rdx, rbx
jmp 0x14001ed46
mov rdx, qword [rsi]
xor ebx, ebx
cmp r15, qword [rdx + 0x20]
jb 0x14001ed51
call fcn.1400679f0
cmp qword [r15 + 0x20], 8
jb 0x14001ed5d
mov rdx, qword [r14]
jmp 0x14001ed60
mov rdx, r14
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x250]
call fcn.14000a130
lea rdx, [rsp + 0x258]
cmp qword [rsp + 0x270], 8
cmovae rdx, qword [rsp + 0x258]
lea rcx, [rsp + 0x170]
call fcn.1400084e0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.140001500
nop
cmp qword [rsp + 0x190], 8
jb 0x14001edd8
mov rcx, qword [rsp + 0x178]
call fcn.140065920
lea rcx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rcx, qword [rsp + 0x1e0]
xor edx, edx
call fcn.140067f44
test eax, eax
jne 0x14001ee78
cmp dword [rsp + 0x44], eax
je 0x14001ee78
cmp dword [rsp + 0x40], eax
jne 0x14001ee78
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov qword [rsp + 0x30], rax
lea rax, str.Driver_File_found
mov qword [rsp + 0x28], rax
lea rax, str.Parameter___s_:__s
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
mov r12, qword [rsp + 0x50]
xor r14d, r14d
jmp 0x14001f31b
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetServices_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001f2cc
mov qword [rsp + 0x248], 7
mov qword [rsp + 0x240], rbx
mov word [rsp + 0x230], bx
mov r13, qword [rsp + 0x80]
test r13, r13
jne 0x14001eedd
call fcn.1400679f0
mov rdx, rbx
jmp 0x14001eee1
mov rdx, qword [r13]
mov rdi, qword [rsp + 0x50]
cmp rdi, qword [rdx + 0x20]
jb 0x14001eef1
call fcn.1400679f0
cmp qword [rdi + 0x20], 8
jb 0x14001eefc
mov r12, qword [r12]
mov rdx, r12
mov rcx, rbp
call fcn.14004dcb0
mov r8d, 0x22
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rsp + 0x228]
call fcn.140001870
mov rbx, qword [rsp + 0x240]
test rbx, rbx
je 0x14001efe6
test rbx, rbx
je 0x14001efcc
cmp rbx, 0xffffffffffffffff
jbe 0x14001ef47
or rcx, 0xffffffffffffffff
jmp 0x14001ef4b
lea rcx, [rbx - 1]
lea rax, [rsp + 0x230]
mov rsi, qword [rsp + 0x230]
mov rbp, qword [rsp + 0x248]
cmp rbp, 8
cmovae rax, rsi
lea rdi, [rax + rcx*2]
nop
mov ecx, 1
lea rax, [0x1400ad338]
movzx edx, word [rdi]
nop
cmp word [rax], dx
je 0x14001efa7
add rax, 2
sub rcx, 1
jne 0x14001ef80
lea rcx, [rsp + 0x228]
call fcn.1400016d0
cmp rdi, rax
je 0x14001efcc
sub rdi, 2
jmp 0x14001ef70
lea rax, [rsp + 0x230]
cmp rbp, 8
cmovae rax, rsi
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14001efcc
lea rax, [rdi + 1]
cmp rbx, rax
je 0x14001efe6
mov r8d, 1
lea rdx, [0x1400ad338]
lea rcx, [rsp + 0x228]
call fcn.14000a130
test r13, r13
jne 0x14001eff7
call fcn.1400679f0
xor ecx, ecx
mov rdx, rcx
jmp 0x14001effb
mov rdx, qword [r13]
mov r12, qword [rsp + 0x50]
cmp r12, qword [rdx + 0x20]
jb 0x14001f00b
call fcn.1400679f0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r12
lea rcx, [rsp + 0x228]
call fcn.140001720
mov rbx, qword [rsp + 0x240]
test rbx, rbx
je 0x14001f0f8
test rbx, rbx
je 0x14001f0cc
cmp rbx, 0xffffffffffffffff
jbe 0x14001f048
or rcx, 0xffffffffffffffff
jmp 0x14001f04c
lea rcx, [rbx - 1]
lea rax, [rsp + 0x230]
mov rsi, qword [rsp + 0x230]
mov rbp, qword [rsp + 0x248]
cmp rbp, 8
cmovae rax, rsi
lea rdi, [rax + rcx*2]
mov ecx, 1
lea rax, [0x1400ad338]
movzx edx, word [rdi]
nop
cmp word [rax], dx
je 0x14001f0a7
add rax, 2
sub rcx, 1
jne 0x14001f080
lea rcx, [rsp + 0x228]
call fcn.1400016d0
cmp rdi, rax
je 0x14001f0cc
sub rdi, 2
jmp 0x14001f070
lea rax, [rsp + 0x230]
cmp rbp, 8
cmovae rax, rsi
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14001f0cc
lea rax, [rdi + 1]
cmp rbx, rax
je 0x14001f108
mov r8d, 1
lea rdx, [0x1400ad338]
lea rcx, [rsp + 0x228]
call fcn.14000a130
mov rbp, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x230]
jmp 0x14001f108
mov rbp, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x230]
lea r8, [rsp + 0x230]
cmp rbp, 8
cmovae r8, rsi
xor r9d, r9d
mov rdx, 0xffffffff80000002
mov rbp, qword [rsp + 0x70]
mov rcx, rbp
call fcn.140034db0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13b, 1
mov rsi, qword [rsp + 0x60]
test rsi, rsi
jne 0x14001f156
call fcn.1400679f0
xor eax, eax
mov rdx, rax
jmp 0x14001f159
mov rdx, qword [rsi]
cmp r15, qword [rdx + 0x20]
jb 0x14001f164
call fcn.1400679f0
cmp qword [r15 + 0x20], 8
jb 0x14001f16e
mov r14, qword [r14]
mov rdx, r14
mov rcx, rbp
call fcn.140020d20
lea rcx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rcx, qword [rsp + 0x1e0]
xor edx, edx
call fcn.140067f44
test eax, eax
jne 0x14001f233
cmp dword [rsp + 0x40], eax
je 0x14001f233
lea rcx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rcx, qword [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001f233
lea rbx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rbx, qword [rsp + 0x1e0]
lea rdi, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae rdi, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
lea rax, str.Error_removing_service___s_:__d
mov qword [rsp + 0x20], rax
mov r9, rdi
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, rbp
call fcn.1400144a0
lea rax, [rsp + 0x230]
cmp qword [rsp + 0x248], 8
cmovae rax, qword [rsp + 0x230]
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
lea rax, str.Parameter___i_:__s
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
nop
cmp qword [rsp + 0x248], 8
jb 0x14001f2aa
mov rcx, qword [rsp + 0x230]
call fcn.140065920
mov qword [rsp + 0x248], 7
xor r14d, r14d
mov qword [rsp + 0x240], r14
mov word [rsp + 0x230], r14w
jmp 0x14001f31b
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
lea rcx, str.RegOpenKeyEx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
lea rax, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, rbp
call fcn.1400144a0
mov r12, qword [rsp + 0x50]
xor r14d, r14d
cmp dword [rsp + 0x44], 0
jne 0x14001f9b9
lea rcx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rcx, qword [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001f3ad
lea rbx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rbx, qword [rsp + 0x1e0]
lea rdi, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae rdi, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
lea rax, str.Error_removing_service___s_:__d
mov qword [rsp + 0x20], rax
mov r9, rdi
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rbp
call fcn.1400144a0
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 2
lea rax, str.Parameter___i_:__s
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
mov r13b, 1
mov rbx, qword [rsp + 0x80]
jmp 0x14001f9c1
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
lea rax, str.No_est
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rbp, qword [rsp + 0x70]
mov rcx, rbp
call fcn.1400144a0
mov r8d, 0xe
lea rdx, str._DriversRoot__
lea rcx, [rsp + 0x250]
call fcn.140001870
mov rsi, qword [rsp + 0x60]
test rsi, rsi
jne 0x14001f488
call fcn.1400679f0
xor r12d, r12d
mov rdx, r12
jmp 0x14001f48e
mov rdx, qword [rsi]
xor r12d, r12d
cmp r15, qword [rdx + 0x20]
jb 0x14001f499
call fcn.1400679f0
cmp qword [r15 + 0x20], 8
jb 0x14001f4a5
mov rdx, qword [r14]
jmp 0x14001f4a8
mov rdx, r14
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x250]
call fcn.14000a130
lea rdx, [rsp + 0x258]
cmp qword [rsp + 0x270], 8
cmovae rdx, qword [rsp + 0x258]
lea rcx, [rsp + 0x170]
call fcn.1400084e0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.140001500
nop
cmp qword [rsp + 0x190], 8
jb 0x14001f520
mov rcx, qword [rsp + 0x178]
call fcn.140065920
lea rcx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rcx, qword [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001f5a7
lea rbx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rbx, qword [rsp + 0x1e0]
lea rdi, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae rdi, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
lea rax, str.Error_removing_service___s_:__d
mov qword [rsp + 0x20], rax
mov r9, rdi
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rbp
call fcn.1400144a0
test rsi, rsi
jne 0x14001f5b6
call fcn.1400679f0
mov rdx, r12
jmp 0x14001f5b9
mov rdx, qword [rsi]
cmp r15, qword [rdx + 0x20]
jb 0x14001f5c4
call fcn.1400679f0
cmp qword [r15 + 0x20], 8
jb 0x14001f5ce
mov r14, qword [r14]
mov rdx, r14
mov rcx, rbp
call fcn.140020d20
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rdx, qword [rsp + 0x1e0]
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 3
lea rax, str.Parameter___i_:__s
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
mov r13b, 1
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
xor r14d, r14d
jmp 0x14001f9c1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetServices_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001f9c1
mov qword [rsp + 0x220], 7
mov qword [rsp + 0x218], r14
mov word [rsp + 0x208], r14w
lea r8d, [rax + 0x22]
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rsp + 0x200]
call fcn.140001870
mov rbx, qword [rsp + 0x218]
test rbx, rbx
je 0x14001f786
test rbx, rbx
je 0x14001f76c
cmp rbx, 0xffffffffffffffff
jbe 0x14001f6dc
or rcx, 0xffffffffffffffff
jmp 0x14001f6e0
lea rcx, [rbx - 1]
lea rax, [rsp + 0x208]
mov rsi, qword [rsp + 0x208]
mov rbp, qword [rsp + 0x220]
cmp rbp, 8
cmovae rax, rsi
lea rdi, [rax + rcx*2]
nop word [rax + rax]
mov ecx, 1
lea rax, [0x1400ad338]
movzx edx, word [rdi]
nop
cmp word [rax], dx
je 0x14001f747
add rax, 2
sub rcx, 1
jne 0x14001f720
lea rcx, [rsp + 0x200]
call fcn.1400016d0
cmp rdi, rax
je 0x14001f76c
sub rdi, 2
jmp 0x14001f710
lea rax, [rsp + 0x208]
cmp rbp, 8
cmovae rax, rsi
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14001f76c
lea rax, [rdi + 1]
cmp rbx, rax
je 0x14001f786
mov r8d, 1
lea rdx, [0x1400ad338]
lea rcx, [rsp + 0x200]
call fcn.14000a130
mov r13, qword [rsp + 0x80]
test r13, r13
jne 0x14001f79d
call fcn.1400679f0
mov rdx, r14
jmp 0x14001f7a1
mov rdx, qword [r13]
cmp r12, qword [rdx + 0x20]
jb 0x14001f7ac
call fcn.1400679f0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r12
lea rcx, [rsp + 0x200]
call fcn.140001720
mov rbx, qword [rsp + 0x218]
test rbx, rbx
je 0x14001f898
test rbx, rbx
je 0x14001f86c
cmp rbx, 0xffffffffffffffff
jbe 0x14001f7e9
or rcx, 0xffffffffffffffff
jmp 0x14001f7ed
lea rcx, [rbx - 1]
lea rax, [rsp + 0x208]
mov rsi, qword [rsp + 0x208]
mov rbp, qword [rsp + 0x220]
cmp rbp, 8
cmovae rax, rsi
lea rdi, [rax + rcx*2]
mov ecx, 1
lea rax, [0x1400ad338]
movzx edx, word [rdi]
cmp word [rax], dx
je 0x14001f847
add rax, 2
sub rcx, 1
jne 0x14001f820
lea rcx, [rsp + 0x200]
call fcn.1400016d0
cmp rdi, rax
je 0x14001f86c
sub rdi, 2
jmp 0x14001f811
lea rax, [rsp + 0x208]
cmp rbp, 8
cmovae rax, rsi
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14001f86c
lea rax, [rdi + 1]
cmp rbx, rax
je 0x14001f8a8
mov r8d, 1
lea rdx, [0x1400ad338]
lea rcx, [rsp + 0x200]
call fcn.14000a130
mov rbp, qword [rsp + 0x220]
mov rsi, qword [rsp + 0x208]
jmp 0x14001f8a8
mov rbp, qword [rsp + 0x220]
mov rsi, qword [rsp + 0x208]
lea r8, [rsp + 0x208]
cmp rbp, 8
cmovae r8, rsi
xor r9d, r9d
mov rdx, 0xffffffff80000002
mov rbp, qword [rsp + 0x70]
mov rcx, rbp
call fcn.140034db0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13b, 1
mov rsi, qword [rsp + 0x60]
test rsi, rsi
jne 0x14001f8f4
call fcn.1400679f0
mov rdx, r14
jmp 0x14001f8f7
mov rdx, qword [rsi]
cmp r15, qword [rdx + 0x20]
jb 0x14001f902
call fcn.1400679f0
cmp qword [r15 + 0x20], 8
jb 0x14001f90f
mov rdx, qword [r15 + 8]
jmp 0x14001f913
lea rdx, [r15 + 8]
mov rcx, rbp
call fcn.140020d20
lea rdx, [rsp + 0x208]
cmp qword [rsp + 0x220], 8
cmovae rdx, qword [rsp + 0x208]
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 4
lea rax, str.Parameter___i_:__s
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rbp
call fcn.1400144a0
nop
cmp qword [rsp + 0x220], 8
jb 0x14001f992
mov rcx, qword [rsp + 0x208]
call fcn.140065920
mov qword [rsp + 0x220], 7
mov qword [rsp + 0x218], r14
mov word [rsp + 0x208], r14w
mov rbx, qword [rsp + 0x80]
jmp 0x14001f9c1
mov rbx, qword [rsp + 0x80]
cmp qword [rsp + 0x270], 8
jb 0x14001f9d9
mov rcx, qword [rsp + 0x258]
call fcn.140065920
mov qword [rsp + 0x270], 7
mov qword [rsp + 0x268], r14
mov word [rsp + 0x258], r14w
test rbx, rbx
jne 0x14001fa05
call fcn.1400679f0
mov rdx, r14
jmp 0x14001fa08
mov rdx, qword [rbx]
cmp r12, qword [rdx + 0x20]
jb 0x14001fa13
call fcn.1400679f0
add r12, 0x28
mov qword [rsp + 0x50], r12
test rsi, rsi
jne 0x14001fa2b
call fcn.1400679f0
mov rdx, r14
jmp 0x14001fa2e
mov rdx, qword [rsi]
cmp r15, qword [rdx + 0x20]
jb 0x14001fa39
call fcn.1400679f0
add r15, 0x28
mov rdi, qword [rsp + 0xc0]
jmp 0x14001ead0
test r13b, r13b
jne 0x14001fa97
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x28], eax
lea rax, str.Service_no_Deleted___d____d_
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, rbp
call fcn.1400144a0
nop
lea rcx, [rsp + 0x140]
call fcn.140026d60
nop
mov rcx, qword [rsp + 0x140]
call fcn.140065920
nop
lea rcx, [rsp + 0xd0]
call fcn.140026d60
nop
mov rcx, qword [rsp + 0xd0]
call fcn.140065920
jmp 0x14001fb2b
xor r14d, r14d
mov dword [rsp + 0x4c], r14d
mov dword [rsp + 0x48], r14d
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
lea rax, str.Empty
mov qword [rsp + 0x20], rax
lea edx, [r14 + 0x1e]
lea r8d, [r14 + 1]
mov rcx, rbp
call fcn.1400144a0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x4c]
mov rdx, rbx
mov rcx, rbp
call fcn.140023750
mov r13b, 1
cmp qword [rsp + 0x1f8], 8
jb 0x14001fb43
mov rcx, qword [rsp + 0x1e0]
call fcn.140065920
mov qword [rsp + 0x1f8], 7
mov qword [rsp + 0x1f0], r14
mov word [rsp + 0x1e0], r14w
lea rcx, [rsp + 0x100]
call fcn.140026d60
nop
mov rcx, qword [rsp + 0x100]
call fcn.140065920
nop
lea rcx, [rsp + 0xa0]
call fcn.140026d60
nop
mov rcx, qword [rsp + 0xa0]
call fcn.140065920
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
movzx edi, r13b
mov dword [rsp + 0x28], edi
lea rax, str.Return_code__0x_x_
mov qword [rsp + 0x20], rax
mov edx, 0x28
lea r8d, [rdx - 0x27]
mov rcx, rbp
call fcn.1400144a0
lea r9, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 8
cmovae r9, qword [rsp + 0x1b8]
lea rax, str.Function_end
mov qword [rsp + 0x20], rax
mov edx, 0x32
lea r8d, [rdx - 0x31]
mov rcx, rbp
call fcn.1400144a0
nop
cmp qword [rsp + 0x1d0], 8
jb 0x14001fc2a
mov rcx, qword [rsp + 0x1b8]
call fcn.140065920
mov eax, edi
jmp 0x14001fc2c
mov eax, edi
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140064b70
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret