Function at 0x140007ed0
Capabilities:
Delete service
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rdi, rdx
mov ebx, ecx
lea rcx, [0x1400af1f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
cmp ebx, 1
jle 0x140007f58
lea rdx, str.install
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
jne 0x140007f2c
call fcn.1400060c0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
lea rdx, str.uninstall
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
jne 0x140007f58
call fcn.140007a10
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rax, qword [str.RtkBtManServ]
mov qword [rsp + 0x28], rax
lea rax, [0x140007060]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [0x140089a08]
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x60
lea rdx, str.RunService
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, str.CurrentProcessID_from_RunService_is__d
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x62
lea rdx, str.RunService
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_StartServiceCtrlDispatcherW]
lea rcx, str.RunService_normal
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x43
lea rdx, str.wmain
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
cmp dword [0x1400af1c4], 0
je 0x14000815a
call fcn.1400030f0
mov rcx, rax
test rax, rax
je 0x14000816c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, str.uninstall_service_entry
lea rcx, [rsp + 0x70]
call fcn.140005e90
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140008115
mov r8d, 0x10024
mov rdx, qword [str.RtkBtManServ]
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400080e2
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x1400080ce
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, str.DeleteService_failed:_GetLastError__0x__x
lea rcx, [rsp + 0x70]
call fcn.140005e90
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x14000813e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, str.OpenService_failed:_GetLastError__0x__x
lea rcx, [rsp + 0x70]
call fcn.140005e90
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x14000813e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, str.OpenSCManager_failed:_GetLastError__0x__x
lea rcx, [rsp + 0x70]
call fcn.140005e90
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000815a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002850
int3