Function at 0x140004e60
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, rcx
xor ebx, ebx
call fcn.14001e37c
mov rdi, rax
call fcn.14001e360
cmp rdi, 0x989680
jne 0x140004e9a
imul rdi, rax, 0x64
jmp 0x140004ebb
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
mov rdi, rax
imul rax, rcx, 0x3b9aca00
add rdi, rax
mov qword [rsp + 0xa8], rbp
xor edx, edx
mov qword [rsp + 0xb0], r12
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x70], r15
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140004efd
lea rdi, str.CDriverInstaller::DeleteService__:_OpenSCManager_failed:_ErrorCode:___d__
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
jmp 0x1400050c0
cmp qword [0x14005fd18], 8
lea rdx, [0x14005fd00]
mov r8d, 0x10024
mov rcx, rsi
cmovae rdx, qword [0x14005fd00]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x140004f40
lea rdi, str.CDriverInstaller::DeleteService__:_OpenService_failed:_ErrorCode:___d__
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
jmp 0x1400050c0
lea rax, [rsp + 0x38]
mov r9d, 0x24
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140004f79
lea rdi, str.DriverInstaller::DeleteService__:_QueryServiceStatusEx_failed___d__n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
jmp 0x1400050c0
mov eax, dword [rsp + 0x44]
cmp eax, 1
je 0x140005091
cmp eax, 3
je 0x140004fbb
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140004fb7
lea rdi, str.CDriverInstaller::DeleteService__:_ControlService_failed___d__n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
jmp 0x1400050c0
mov eax, dword [rsp + 0x44]
cmp eax, 1
je 0x140005091
mov r15d, 0x3e8
movabs r12, 0x112e0be826d694b3
mov eax, dword [rsp + 0x58]
cmp rax, 0x2710
jbe 0x140004fe7
mov eax, 0x2710
jmp 0x140004fee
cmp rax, r15
cmovb rax, r15
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140005a90
lea rax, [rsp + 0x38]
mov r9d, 0x24
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400050f0
cmp dword [rsp + 0x44], 1
je 0x140005091
call fcn.14001e37c
mov rbp, rax
call fcn.14001e360
cmp rbp, 0x989680
jne 0x140005048
imul rcx, rax, 0x64
jmp 0x140005069
cqo
idiv rbp
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbp
mov rcx, rax
imul rax, r8, 0x3b9aca00
add rcx, rax
sub rcx, rdi
mov rax, r12
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 0x14
jg 0x1400050d6
cmp dword [rsp + 0x44], 1
jne 0x140004fd4
lea r8, str.CDriverInstaller::DeleteService__:_MonitorFunction_stopped_successfully_n
mov edx, 0xc8
lea rcx, [r14 + 0x18]
call fcn.140007ee0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140005102
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.CDriverInstaller::DeleteService__:_DeleteService_failed:_ErrorCode:___d__
mov r9d, eax
lea rcx, [r14 + 0x18]
mov edx, 0xc8
call fcn.140007ee0
xor dil, dil
jmp 0x14000511a
lea rcx, [r14 + 0x18]
mov edx, 0xc8
lea r8, str.CDriverInstaller::DeleteService__:_Wait_timed_out_n
call fcn.140007ee0
xor dil, dil
jmp 0x14000511a
lea rdi, str.CDriverInstaller::DeleteService__:_QueryServiceStatusEx_failed___d__n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
jmp 0x1400050c0
lea r8, str.CDriverInstaller::DeleteService__:_DeleteService_success_
mov edx, 0xc8
lea rcx, [r14 + 0x18]
call fcn.140007ee0
mov dil, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15, qword [rsp + 0x70]
movzx eax, dil
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001f770
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbx
ret