Function at 0x15bbba0
Capabilities:
Terminate process

Disassembly:
lea rcx, [0x03e48820]
jmp 0x15d05f0
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x039f1190]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rcx
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x34], 0
xor r14b, r14b
call fcn.017cff80
test al, al
jne 0x15d0649
mov eax, 0x80004005
jmp 0x15d0bbd
lea rax, [0x03a6cbe0]
mov qword [0x039f5148], rax
lea rax, [0x03a6f690]
mov qword [0x03e5eeb8], rax
xor r12d, r12d
mov qword [rsp + 0x48], r12
lea rcx, [0x017f0030]
call qword [sym.imp.MSVCR80.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
mov qword [rsp + 0x48], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x15d06a5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov esi, 1
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x15d06aa
mov esi, 1
mov byte [rsp + 0x34], 1
mov rcx, rbx
call fcn.015c35b0
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x15d06c6
jmp 0x15d0b6d
mov rdi, rsi
mov qword [rsp + 0x38], rsi
nop
movsxd rax, dword [rbx + 0x10]
cmp rdi, rax
jge 0x15d06f9
mov rdx, qword [rbx + 0x18]
mov rdx, qword [rdx + rdi*8]
lea rcx, [0x015d0ce8]
call qword [sym.imp.MSVCR80.dll_wprintf]
add rdi, 1
mov qword [rsp + 0x38], rdi
jmp 0x15d06d0
lea rcx, [0x0156e0cc]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov qword [rsp + 0x38], rsi
lea r15, [0x01000000]
movsxd rax, dword [rbx + 0x10]
cmp rsi, rax
jge 0x15d0783
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x15d0778
cmp qword [rax + rsi*8], 0
je 0x15d0778
mov rax, qword [rax + rsi*8]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x15d0740
cmp cx, 0x2f
je 0x15d0740
jmp 0x15d0778
movzx eax, word [rax + 2]
add eax, 0xffffffc1
cmp eax, 0x36
ja case.0x15d0762.64
cdqe
movzx eax, byte [r15 + rax + 0x5d0bf4]
mov ecx, dword [r15 + rax*4 + 0x5d0bec]
add rcx, r15
jmp rcx
mov r14b, 1
mov byte [rsp + 0x36], r14b
jmp 0x15d07f4
test r14b, r14b
jne 0x15d07f4
jmp 0x15d0778
add rsi, 1
mov qword [rsp + 0x38], rsi
jmp 0x15d0712
test r14b, r14b
jne 0x15d07f4
lea rcx, [0x03a6bd30]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
setne al
test al, al
je 0x15d07ab
mov edi, r12d
mov dword [rsp + 0x30], r12d
jmp 0x15d0b7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
je 0x15d07ec
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x20], 0x1000000f
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov ecx, 0xc1010000
call fcn.0124e580
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x15d0b6d
mov r14b, 1
mov byte [rsp + 0x36], r14b
movsxd rax, dword [rbx + 0x10]
cmp eax, 1
jge 0x15d0820
lea r8, [0x015d0cc8]
mov edx, 0x120
lea rcx, [0x0156dfe0]
call fcn.017eea00
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x15d0b6d
mov r12, rax
mov qword [rsp + 0x40], rax
mov r13, qword [rbx + 0x18]
mov qword [rsp + 0x50], r13
mov word [rsp + 0x80], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x82]
call sub.MSVCR80.dll_memset
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea r8, [rsp + 0x80]
mov edx, 0x104
call fcn.017aef90
test eax, eax
jns 0x15d08a0
mov r9d, 0x104
mov r8, qword [0x01580f70]
mov rdx, r9
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCR80.dll_wcsncpy_s]
mov word [rsp + 0x286], 0
nop
nop
cmp r12, 1
jle 0x15d0af9
sub r12, 1
mov qword [rsp + 0x40], r12
add r13, 8
mov qword [rsp + 0x50], r13
mov rsi, qword [r13]
movzx eax, word [rsi]
cmp ax, 0x2d
je 0x15d08d1
cmp ax, 0x2f
je 0x15d08d1
jmp 0x15d08a0
movzx eax, word [rsi + 2]
add eax, 0xffffffc1
cmp eax, 0x3b
ja case.0x15d08f7.71
cdqe
movzx eax, byte [r15 + rax + 0x5d0c50]
mov ecx, dword [r15 + rax*4 + 0x5d0c2c]
add rcx, r15
jmp rcx
mov rcx, rbx
call fcn.015c3710
xor edi, edi
mov dword [rsp + 0x30], edi
jmp 0x15d0b7f
cmp r12, 1
jle 0x15d09f4
lea rdx, [r13 + 8]
mov rax, qword [rdx]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x15d09f4
cmp cx, 0x2f
je 0x15d09f4
sub r12, 1
mov qword [rsp + 0x40], r12
mov r13, rdx
mov qword [rsp + 0x50], rdx
cmp rax, 0
je 0x15d0950
mov rsi, rax
jmp 0x15d0957
lea rsi, [0x01187df8]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdx, qword [0x01580f70]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
jne 0x15d099e
mov r9d, 0x104
mov r8, qword [0x01580f70]
mov rdx, r9
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCR80.dll_wcsncpy_s]
jmp 0x15d0a12
mov r9d, 0x104
mov r8, qword [0x01580f80]
mov rdx, r9
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCR80.dll_wcsncpy_s]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, qword [0x01580f80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r9d, 0x104
sub r9, rcx
mov r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCR80.dll_wcsncat_s]
jmp 0x15d0a12
mov r9d, 0x104
mov r8, qword [0x01580f70]
mov rdx, r9
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCR80.dll_wcsncpy_s]
mov word [rsp + 0x286], 0
lea rdx, [rsp + 0x80]
lea rcx, [0x015d0c90]
call qword [sym.imp.MSVCR80.dll_wprintf]
jmp case.0x15d08f7.71
mov r8d, 5
lea rdx, [0x0156e098]
lea rcx, [rsi + 2]
call qword [sym.imp.MSVCR80.dll__wcsnicmp]
test eax, eax
je case.0x15d08f7.71
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.015cc3a0
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x15d0a77
jmp 0x15d0b6d
movzx eax, word [rsi + 2]
cmp eax, 0x49
je 0x15d0aac
cmp eax, 0x69
je 0x15d0aac
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.015c49c0
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x15d0ad3
jmp 0x15d0b6d
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.015c43e0
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x15d0ad3
jmp 0x15d0b6d
xor edi, edi
mov dword [rsp + 0x30], edi
jmp 0x15d0b7f
mov byte [rbx + 8], 1
jmp case.0x15d08f7.71
mov byte [rbx + 0xb], 1
jmp case.0x15d08f7.71
mov byte [rbx + 0xc], 1
jmp case.0x15d08f7.71
mov byte [rbx + 9], 1
jmp 0x15d08a0
test r14b, r14b
je 0x15d0b1e
mov rax, qword [0x039f11b0]
cmp qword [rax + 0x168], 0
je 0x15d0b16
mov rax, qword [rax + 0x168]
or qword [rax + 0x248], 1
mov r8b, 1
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.015cc3a0
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x15d0b3d
jmp 0x15d0b6d
mov rcx, rbx
call fcn.013f4a50
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x15d0b51
jmp 0x15d0b6d
xor edi, edi
mov dword [rsp + 0x30], edi
jmp 0x15d0b7f
call fcn.01348e60
mov r8d, eax
mov dl, 1
mov rcx, rbx
call fcn.015c62b0
cmp byte [rbx + 9], 0
jne 0x15d0b96
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call fcn.015c8c40
cmp byte [rsp + 0x34], 0
je 0x15d0bab
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.MSVCR80.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
call fcn.017cb760
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.01003340
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret