Function at 0x1400175b0
Capabilities:
Delete file
Delete service
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1400a2060]
xor rax, rsp
mov qword [rbp + 0x128], rax
mov r15, rcx
xor r14d, r14d
mov r12d, r14d
mov rsi, qword [rdx]
mov r13, qword [rdx + 8]
cmp rsi, r13
je 0x140017e64
lea rdi, str.h__n_
mov rcx, qword [str.h__n_]
cmp rcx, rdi
je 0x14001763a
test byte [rcx + 0x1c], 0x80
je 0x14001763a
cmp byte [rcx + 0x19], 4
jb 0x14001763a
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x140017625
mov r9, qword [rsi]
mov edx, 0x10
lea r8, [0x14008f668]
mov rcx, qword [rcx + 0x10]
call fcn.1400050c0
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140017647
mov rdx, qword [rsi]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400071b0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.140011e90
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400176c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400176bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017ea9
call fcn.14004c810
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
cmp dword [rbp + 0x110], 0
jne 0x140017e10
cmp dword [rbp + 0x114], 0
jne 0x140017e10
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140006ab0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r14
mov ecx, 0x20
call fcn.14004cab8
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
lea rbx, [rax + 0x20]
mov qword [rbp - 0x68], rbx
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x58], rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x30], rcx
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140006ab0
mov qword [rbp - 0x40], rbx
mov rdx, rbx
mov rcx, rbx
call fcn.1400193a0
mov qword [rbp - 0x70], rbx
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x50]
call fcn.140017130
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400177c7
mov rdx, qword [rbp - 0x70]
call fcn.1400193a0
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x78]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400177b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017eaf
call fcn.14004c810
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r14
lea r9, [fcn.140006940]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x60]
call fcn.14004caf4
cmp dword [rbp - 0x48], 0
jne 0x140017d96
cmp dword [rbp - 0x44], 0
jne 0x140017d96
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x50]
call fcn.140015d50
nop
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rbp - 0x78]
call fcn.1400160a0
movzx ebx, al
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14001787b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017876
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017eb5
call fcn.14004c810
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400178ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400178c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017ebb
call fcn.14004c810
test bl, bl
je 0x1400178ee
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140017bf8
lea r9, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae r9, qword [rbp + 0xa0]
cmp qword [rbp + 0xb0], 0xc
jne 0x140017953
mov r8d, 0xc
lea r10, str.Early_Launch
mov rax, r10
movzx ecx, word [r9]
mov edx, 0x45
cmp cx, dx
jb 0x140017953
sub r9, r10
cmp cx, dx
ja 0x140017953
cmp r8, 1
je 0x1400179ff
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140017933
xor al, al
test al, al
je 0x1400179d2
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x78]
call fcn.140016b00
nop
cmp qword [rbp - 0x68], 0
je 0x140017c6b
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x60]
call fcn.140006ab0
lea rcx, [rsp + 0x60]
call fcn.140016e70
test al, al
je 0x140017c6b
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400179d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400179cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017ec1
call fcn.14004c810
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140017a06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
xor edi, edi
mov dword [rbp - 0x20], eax
xor al, al
jmp 0x140017a80
mov al, 1
jmp 0x140017955
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rdx, qword [rbp + 0x10]
mov r8d, 0xf01ff
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140017a45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 0x20], r14d
xor al, al
jmp 0x140017a80
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 0x80], r14d
lea r8, [rbp - 0x80]
mov edx, 0xc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov dword [rbp - 0x20], eax
test ebx, ebx
setne al
mov byte [rbp - 0x18], al
mov qword [rbp - 0x28], rdi
test al, al
jne 0x140017a9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x140017cd7
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140017aa9
mov rdx, qword [rsi]
xor r14d, r14d
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x78]
call fcn.1400071b0
nop
mov dword [rbp - 0x58], r14d
mov qword [rbp + 0x120], r14
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.140014780
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea r9, [rbp - 0x58]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.newdev.dll_DiUninstallDriverA]
mov ebx, eax
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140017b47
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017b42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017ec7
call fcn.14004c810
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
test ebx, ebx
jne 0x140017b69
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x140017b7c
cmp dword [rbp - 0x58], 0
je 0x140017b7a
mov ecx, 0xbc2
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov bl, 1
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140017bbc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017bb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017ea3
call fcn.14004c810
test bl, bl
jne 0x140017bd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x490
jne 0x140017cff
inc r12d
test rdi, rdi
je 0x140017be3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rbp - 0x10]
call fcn.140013e40
add rsi, 0x20
xor r14d, r14d
jmp 0x1400175f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.h__n_]
cmp rcx, rdi
je 0x140017c40
test byte [rcx + 0x1c], 0x80
je 0x140017c40
cmp byte [rcx + 0x19], 2
jb 0x140017c40
lea rax, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rax, qword [rbp + 0x50]
mov edx, 0x13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.1400165f0
mov dword [rbp - 0x80], 4
mov dword [rbp - 0x7c], 3
mov dword [r15], r12d
mov dword [r15 + 4], ebx
mov rcx, qword [rbp - 0x80]
mov qword [r15 + 8], rcx
lea rcx, [rbp - 0x10]
call fcn.140013e40
jmp 0x140017e76
mov dword [rbp - 0x80], 4
mov dword [rbp - 0x7c], 3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15], r12d
mov dword [r15 + 4], eax
mov rax, qword [rbp - 0x80]
mov qword [r15 + 8], rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140017d88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017ccd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017ec1
call fcn.14004c810
jmp 0x140017d88
mov r8, qword [str.h__n_]
lea rax, str.h__n_
cmp r8, rax
je 0x140017d5c
test byte [r8 + 0x1c], 0x80
je 0x140017d5c
cmp byte [r8 + 0x19], 2
jb 0x140017d5c
mov edx, 0x14
jmp 0x140017d25
mov r8, qword [str.h__n_]
lea rax, str.h__n_
cmp r8, rax
je 0x140017d5c
test byte [r8 + 0x1c], 0x80
je 0x140017d5c
cmp byte [r8 + 0x19], 2
jb 0x140017d5c
mov edx, 0x15
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
mov qword [rsp + 0x30], rcx
cmovae rax, qword [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9d, r14d
mov rcx, qword [r8 + 0x10]
call fcn.1400166c0
mov dword [rbp - 0x80], 4
mov dword [rbp - 0x7c], 4
mov dword [r15], r12d
mov dword [r15 + 4], r14d
mov rax, qword [rbp - 0x80]
mov qword [r15 + 8], rax
test rdi, rdi
je 0x140017d88
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rbp - 0x10]
call fcn.140013e40
jmp 0x140017e76
mov ebx, dword [rbp - 0x4c]
mov rcx, qword [str.h__n_]
cmp rcx, rdi
je 0x140017de8
test byte [rcx + 0x1c], 0x80
je 0x140017de8
cmp byte [rcx + 0x19], 2
jb 0x140017de8
cmp qword [rsi + 0x18], 8
jb 0x140017dbb
mov rsi, qword [rsi]
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rax, qword [rbp + 0x10]
mov edx, 0x12
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.1400166c0
mov dword [rbp - 0x80], 4
mov dword [rbp - 0x7c], 6
mov dword [r15 + 4], ebx
mov dword [r15], r12d
mov rax, qword [rbp - 0x80]
mov qword [r15 + 8], rax
lea rcx, [rbp - 0x10]
call fcn.140013e40
jmp 0x140017e76
mov rcx, qword [str.h__n_]
cmp rcx, rdi
je 0x140017e4a
test byte [rcx + 0x1c], 0x80
je 0x140017e4a
cmp byte [rcx + 0x19], 2
jb 0x140017e4a
cmp qword [rsi + 0x18], 8
jb 0x140017e32
mov rsi, qword [rsi]
mov edx, 0x11
mov r9, rsi
lea r8, [0x14008f668]
mov rcx, qword [rcx + 0x10]
call fcn.1400050c0
mov dword [rbp - 0x80], 4
mov dword [rbp - 0x7c], 6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15 + 4], eax
jmp 0x140017dfa
mov dword [r15], r12d
mov dword [r15 + 4], r14d
mov rax, qword [0x14008f3e0]
mov qword [r15 + 8], rax
mov rax, r15
mov rcx, qword [rbp + 0x128]
xor rcx, rsp
call fcn.14004c7f0
mov rbx, qword [rsp + 0x280]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140059a5c
nop
call fcn.140059a5c
nop
call fcn.140059a5c
nop
call fcn.140059a5c
nop
call fcn.140059a5c
int3
call fcn.140059a5c
nop
call fcn.140059a5c
int3