Function at 0x14004b3f0
Capabilities:
Continue service
Delete service
Pause service
Resume thread
Start service
Stop service
Suspend thread
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword gs:[0x30]
xor esi, esi
mov r9d, 1
mov qword [rsp + 0x28], rsi
mov r8d, r9d
mov ebx, esi
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x20]
lea rcx, [rsp + 0x70]
movzx eax, word [rdx + 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rdx + 0x78]
lea rdx, [0x140154098]
mov qword [rsp + 0x78], rax
lea rax, [0x14004b3e0]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhParseCommandLine
mov rcx, qword [0x14015e780]
lea rax, str.process
mov r8b, 1
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004bbe6
mov r9, qword [0x14015e788]
test r9, r9
je 0x14004b569
mov r8, qword [r9]
mov ecx, esi
shr r8, 1
je 0x14004b4c9
mov rdx, qword [r9 + 8]
nop word [rax + rax]
movzx eax, word [rdx]
sub ax, 0x30
cmp ax, 0xa
jae 0x14004b4c9
inc rcx
add rdx, 2
cmp rcx, r8
jb 0x14004b4b0
cmp rcx, r8
jne 0x14004b57c
movups xmm0, xmmword [r9]
xor r14b, r14b
movq r9, xmm0
movups xmmword [rsp + 0x38], xmm0
mov r10, qword [rsp + 0x40]
test r9, r9
je 0x14004b50a
movzx eax, word [r10]
cmp ax, 0x2d
je 0x14004b4ff
cmp ax, 0x2b
jne 0x14004b50a
jmp 0x14004b502
mov r14b, 1
add r10, 2
sub r9, 2
shr r9, 1
mov r11b, 1
mov rdi, rsi
mov rdx, rsi
je 0x14004b55c
mov qword [rsp + 0x268], r15
lea r15, [0x1401212a0]
nop word [rax + rax]
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r15 + rax*4]
cmp r8d, 0xa
jae 0x14004b549
lea rcx, [rdi + rdi*4]
lea rdi, [r8 + rcx*2]
jmp 0x14004b54c
xor r11b, r11b
inc rdx
cmp rdx, r9
jb 0x14004b530
mov r15, qword [rsp + 0x268]
test r14b, r14b
je 0x14004b564
neg rdi
test r11b, r11b
jne 0x14004b5dd
mov eax, 0xc000000d
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, 5
lea rcx, [rsp + 0x48]
call sym.ProcessHacker.exe_PhEnumProcessesEx
mov ebx, eax
test eax, eax
js 0x14004c01f
mov r14, qword [rsp + 0x48]
mov rdx, qword [0x14015e788]
mov rcx, r14
call sym.ProcessHacker.exe_PhFindProcessInformationByImageName
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
xor edx, edx
mov r8, r14
test rax, rax
jne 0x14004b5d3
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000225
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdi, qword [rax + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x14015e790]
lea rax, str.terminate
mov r8b, 1
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b661
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 1
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14004c01d
cmp qword [0x14015a2a8], rsi
mov rdi, qword [rbp + 0x1b0]
je 0x14004b648
xor edx, edx
mov rcx, rdi
call fcn.140019770
mov ebx, eax
cmp eax, 0xc00000bb
jne 0x14004b655
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov ebx, eax
mov rcx, qword [rbp + 0x1b0]
jmp 0x14004c017
mov rcx, qword [0x14015e790]
lea rax, str.suspend
mov r8b, 1
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b6c1
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 0x800
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rcx, qword [rbp + 0x1b0]
call sym.ProcessHacker.exe_PhSuspendProcess
mov rcx, qword [rbp + 0x1b0]
jmp 0x14004c015
mov rcx, qword [0x14015e790]
lea rax, str.resume
mov r8b, 1
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b721
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 0x800
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rcx, qword [rbp + 0x1b0]
call sym.ProcessHacker.exe_PhResumeProcess
mov rcx, qword [rbp + 0x1b0]
jmp 0x14004c015
mov rcx, qword [0x14015e790]
lea rax, str.priority
mov r8b, 1
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b8d3
mov rcx, qword [0x14015e798]
test rcx, rcx
je 0x14004b569
lea rax, str.idle
mov qword [rbp - 0x40], 8
mov r8b, 1
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b78a
mov sil, 1
jmp 0x14004b87d
mov rcx, qword [0x14015e798]
lea rax, str.normal
mov r8b, 1
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x30], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b7bc
mov sil, 2
jmp 0x14004b87d
mov rcx, qword [0x14015e798]
lea rax, str.high
mov r8b, 1
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b7ee
mov sil, 3
jmp 0x14004b87d
mov rcx, qword [0x14015e798]
lea rax, str.realtime
mov r8b, 1
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b81d
mov sil, 4
jmp 0x14004b87d
mov rcx, qword [0x14015e798]
lea rax, str.abovenormal
mov r8b, 1
mov qword [rbp + 8], rax
lea rdx, [rbp]
mov qword [rbp], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b84c
mov sil, 6
jmp 0x14004b87d
mov rcx, qword [0x14015e798]
lea rax, str.belownormal
mov r8b, 1
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b569
mov sil, 5
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 0x200
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rcx, qword [rbp + 0x1b0]
lea r8, [rbp + 0x1a0]
mov r9d, 2
mov byte [rbp + 0x1a0], 0
mov byte [rbp + 0x1a1], sil
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x1b0]
jmp 0x14004c015
mov rcx, qword [0x14015e790]
lea rax, str.iopriority
mov r8b, 1
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x20], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004ba05
mov rcx, qword [0x14015e798]
test rcx, rcx
je 0x14004b569
lea rax, str.verylow
mov qword [rbp + 0x30], 0xe
mov r8b, 1
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14004b9cd
mov rcx, qword [0x14015e798]
lea rax, [0x14012ad58]
mov r8b, 1
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x40], 6
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b969
mov esi, 1
jmp 0x14004b9cd
mov rcx, qword [0x14015e798]
lea rax, str.normal
mov r8b, 1
mov qword [rbp + 0x58], rax
lea rdx, [rbp + 0x50]
mov qword [rbp + 0x50], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b99a
mov esi, 2
jmp 0x14004b9cd
mov rcx, qword [0x14015e798]
lea rax, str.high
mov r8b, 1
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x60]
mov qword [rbp + 0x60], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004b569
mov esi, 3
mov r8, rdi
lea rcx, [rbp + 0x1b0]
mov edx, 0x200
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rcx, qword [rbp + 0x1b0]
mov edx, esi
call sym.ProcessHacker.exe_PhSetProcessIoPriority
mov rcx, qword [rbp + 0x1b0]
jmp 0x14004c015
mov rcx, qword [0x14015e790]
lea rax, str.pagepriority
mov r8b, 1
mov qword [rbp + 0x78], rax
lea rdx, [rbp + 0x70]
mov qword [rbp + 0x70], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004baa0
mov rcx, qword [0x14015e798]
test rcx, rcx
je 0x14004b569
lea r8, [rsp + 0x50]
mov edx, 0xa
call sym.ProcessHacker.exe_PhStringToInteger64
mov eax, dword [rsp + 0x50]
lea rcx, [rbp + 0x1b0]
mov r8, rdi
mov dword [rbp + 0x1a8], eax
mov edx, 0x200
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rcx, qword [rbp + 0x1b0]
lea r8, [rbp + 0x1a8]
mov r9d, 4
lea edx, [r9 + 0x23]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x1b0]
jmp 0x14004c015
mov rcx, qword [0x14015e790]
lea rax, str.injectdll
mov r8b, 1
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x80]
mov qword [rbp + 0x80], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004bb33
cmp qword [0x14015e798], rsi
je 0x14004b569
mov edx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
lea rcx, [rbp + 0x1b0]
or edx, 0x3a
mov r8, rdi
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rdx, qword [0x14015e798]
lea r8, [rsp + 0x58]
mov rcx, qword [rbp + 0x1b0]
mov qword [rsp + 0x58], 0xfffffffffd050f80
mov rdx, qword [rdx + 8]
call sym.ProcessHacker.exe_PhInjectDllProcess
mov rcx, qword [rbp + 0x1b0]
jmp 0x14004c015
mov rcx, qword [0x14015e790]
lea rax, str.unloaddll
mov r8b, 1
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x90]
mov qword [rbp + 0x90], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004c01d
cmp qword [0x14015e798], rsi
je 0x14004b569
mov edx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
lea rcx, [rbp + 0x1b0]
or edx, 0x3a
mov r8, rdi
call sym.ProcessHacker.exe_PhOpenProcess
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rdx, qword [0x14015e798]
lea r8, [rsp + 0x68]
mov rcx, qword [rbp + 0x1b0]
call fcn.14004c170
mov ebx, eax
test eax, eax
js 0x14004b655
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rcx, qword [rbp + 0x1b0]
mov qword [rsp + 0x60], 0xfffffffffd050f80
call sym.ProcessHacker.exe_PhUnloadDllProcess
mov rcx, qword [rbp + 0x1b0]
jmp 0x14004c015
mov rcx, qword [0x14015e780]
lea rax, str.service
mov r8b, 1
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa0]
mov qword [rbp + 0xa0], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004be8b
cmp qword [0x14015e788], rbx
je 0x14004b569
mov rcx, qword [0x14015e790]
lea rax, str.start
mov r8b, 1
mov qword [rbp + 0xb8], rax
lea rdx, [rbp + 0xb0]
mov qword [rbp + 0xb0], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004bcb1
mov rcx, qword [0x14015e788]
mov edx, 0x10
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
jne 0x14004bc9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14004c01f
movzx eax, ax
or eax, 0xc0070000
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x14004be59
mov rcx, qword [0x14015e790]
lea rax, str.continue
mov r8b, 1
mov qword [rbp + 0xc8], rax
lea rdx, [rbp + 0xc0]
mov qword [rbp + 0xc0], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004bd1f
mov rcx, qword [0x14015e788]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14004bc7a
lea r8, [rbp + 0x140]
mov edx, 3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x14004be59
mov rcx, qword [0x14015e790]
lea rax, str.pause
mov r8b, 1
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0xd0]
mov qword [rbp + 0xd0], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004bd8d
mov rcx, qword [0x14015e788]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14004bc7a
lea r8, [rbp + 0x140]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x14004be59
mov rcx, qword [0x14015e790]
lea rax, str.stop
mov r8b, 1
mov qword [rbp + 0xe8], rax
lea rdx, [rbp + 0xe0]
mov qword [rbp + 0xe0], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004bdf8
mov rcx, qword [0x14015e788]
mov edx, 0x20
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14004bc7a
lea r8, [rbp + 0x140]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x14004be59
mov rcx, qword [0x14015e790]
lea rax, [0x140128048]
mov r8b, 1
mov qword [rbp + 0xf8], rax
lea rdx, [rbp + 0xf0]
mov qword [rbp + 0xf0], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004c01d
mov rcx, qword [0x14015e788]
mov edx, 0x10000
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14004bc7a
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14004be72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14004be72
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [0x14015e780]
lea rax, str.thread
mov r8b, 1
mov qword [rbp + 0x108], rax
lea rdx, [rbp + 0x100]
mov qword [rbp + 0x100], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004c01d
mov rcx, qword [0x14015e788]
test rcx, rcx
je 0x14004b569
lea r8, [rsp + 0x30]
mov edx, 0xa
call sym.ProcessHacker.exe_PhStringToInteger64
test al, al
je 0x14004b569
mov rcx, qword [0x14015e790]
lea rax, str.terminate
mov r8b, 1
mov qword [rbp + 0x118], rax
lea rdx, [rbp + 0x110]
mov qword [rbp + 0x110], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004bf50
mov r8, qword [rsp + 0x30]
lea rcx, [rbp + 0x1b8]
mov edx, 1
call sym.ProcessHacker.exe_PhOpenThread
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rcx, qword [rbp + 0x1b8]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateThread]
jmp 0x14004c00e
mov rcx, qword [0x14015e790]
lea rax, str.suspend
mov r8b, 1
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x120]
mov qword [rbp + 0x120], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004bfb0
mov r8, qword [rsp + 0x30]
lea rcx, [rbp + 0x1b8]
mov edx, 2
call sym.ProcessHacker.exe_PhOpenThread
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rcx, qword [rbp + 0x1b8]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
jmp 0x14004c00e
mov rcx, qword [0x14015e790]
lea rax, str.resume
mov r8b, 1
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x130]
mov qword [rbp + 0x130], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14004c01d
mov r8, qword [rsp + 0x30]
lea rcx, [rbp + 0x1b8]
mov edx, 2
call sym.ProcessHacker.exe_PhOpenThread
mov ebx, eax
test eax, eax
js 0x14004c01d
mov rcx, qword [rbp + 0x1b8]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rcx, qword [rbp + 0x1b8]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret