Function at 0x1400042e0
Capabilities:
Delete service
Encode data using xor
Generate random numbers using a mersenne twister
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1450]
mov eax, 0x1550
call fcn.14003bc90
sub rsp, rax
movaps xmmword [rsp + 0x1540], xmm6
mov rax, qword [0x140083030]
xor rax, rsp
mov qword [rbp + 0x1430], rax
xor esi, esi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x58], esi
lea r8, [rsp + 0x58]
call fcn.140005650
mov rbx, qword [0x140083cb8]
test rbx, rbx
je 0x140005382
cmp qword [0x140083cd8], rsi
je 0x140005382
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x58], eax
cmp qword [0x140083c78], rsi
jne 0x140004371
cmp eax, 2
jne 0x140005382
movabs rax, 0x7ffffffffffffffe
movabs rdx, 0x7fffffffffffffff
cmp qword [0x140083c58], rsi
jne 0x140004460
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
lea r14, [0x140083ca8]
cmp qword [0x140083cc0], 8
cmovae r14, qword [0x140083ca8]
cmp rbx, 8
jae 0x1400043d0
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x68], 7
jmp 0x140004450
mov rdi, rbx
or rdi, 7
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, rdx
ja 0x1400053c4
add rcx, rcx
cmp rcx, 0x1000
jb 0x140004426
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400053c4
mov rcx, rax
call fcn.14003b570
mov rcx, rax
test rax, rax
je 0x1400053d6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004435
test rcx, rcx
je 0x140004432
call fcn.14003b570
jmp 0x140004435
mov rax, rsi
mov qword [rbp - 0x80], rax
lea r8, [rbx*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14003d6c0
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], rbx
lea rbx, [rbp - 0x80]
mov r14d, 1
jmp 0x1400044b7
lea r8, [0x14007827c]
lea rdx, [0x140083c48]
lea rcx, [rbp - 0x60]
call fcn.140007270
nop
mov dword [rsp + 0x50], 2
lea rdx, [0x140083ca8]
mov rcx, rax
call fcn.140007160
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rbx, [rbp - 0x38]
mov r14d, 0x106
mov rdx, qword [0x140083d00]
cmp rdx, 8
jb 0x1400044fd
mov rcx, qword [0x140083ce8]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400044f8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400053ca
mov rcx, r8
call fcn.14003b67c
movups xmm0, xmmword [rbx]
movups xmmword [0x140083ce8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140083cf8], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
test r14b, 4
je 0x14000456c
and r14d, 0xfffffffb
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14000456c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004566
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053ca
call fcn.14003b67c
nop
test r14b, 2
je 0x1400045c6
and r14d, 0xfffffffd
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400045b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053d0
call fcn.14003b67c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], si
test r14b, 1
je 0x140004610
and r14d, 0xfffffffe
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140004610
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000460b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053d6
call fcn.14003b67c
mov r8d, 0x1a
lea rdx, [0x140078280]
lea r12, [0x140083c88]
mov rcx, r12
call fcn.140001d60
mov qword [rbp - 0x18], rsi
mov qword [rbp - 8], rsi
mov qword [rbp], 7
mov word [rbp - 0x18], si
mov r8d, 0x11
lea rdx, str.PROD_REG_PATH
lea rcx, [rbp - 0x18]
call fcn.140001d60
nop
lea r9, [rbp - 0x18]
mov rbx, qword [rbp - 0x18]
mov r15, qword [rbp]
cmp r15, 8
cmovae r9, rbx
mov rcx, r12
cmp qword [0x140083ca0], 8
cmovae rcx, qword [0x140083c88]
mov rdi, qword [rbp - 8]
mov qword [rsp + 0x20], rdi
mov rdx, qword [0x140083c98]
call fcn.14000bf00
mov rdx, rax
cmp rax, 0xffffffffffffffff
je 0x1400046cc
lea r9, [0x140083ce8]
cmp qword [0x140083d00], 8
cmovae r9, qword [0x140083ce8]
mov rax, qword [0x140083cf8]
mov qword [rsp + 0x20], rax
mov r8, rdi
call fcn.1400104f0
xor dil, dil
jmp 0x1400046cf
mov dil, 1
cmp r15, 8
jb 0x14000470a
lea rdx, [r15*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140004702
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053be
mov rcx, rbx
call fcn.14003b67c
lea r13, [0x140078080]
test dil, dil
je 0x140004724
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call fcn.140001d60
mov rdx, r12
lea rcx, [rbp - 0x38]
call fcn.140001c40
mov rbx, rax
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140004740
mov rdx, qword [rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400049ce
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400047a7
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400047a2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400053ee
mov rcx, r8
call fcn.14003b67c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 0xf
mov r8d, 0x36
lea rdx, str.Product_registry_entry_is_missing._Trying_to_create_it
lea rcx, [rbp - 0x60]
call fcn.1400038c0
lea rcx, [rbp - 0x60]
call fcn.1400024d0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov rdi, qword [0x140083c98]
cmp qword [0x140083ca0], 8
cmovae r12, qword [0x140083c88]
cmp rdi, 8
jae 0x140004828
movups xmm0, xmmword [r12]
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x68], 7
lea rdx, [rbp - 0x80]
jmp 0x1400048c9
mov rbx, rdi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400053e8
add rcx, rcx
cmp rcx, 0x1000
jb 0x140004892
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400053e8
mov rcx, rax
call fcn.14003b570
mov rcx, rax
test rax, rax
je 0x1400053dc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400048a1
test rcx, rcx
je 0x14000489e
call fcn.14003b570
jmp 0x1400048a1
mov rax, rsi
mov qword [rbp - 0x80], rax
lea r8, [rdi*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.14003d6c0
mov qword [rbp - 0x68], rbx
lea rdx, [rbp - 0x80]
cmp rbx, 8
cmovae rdx, qword [rbp - 0x80]
mov qword [rbp - 0x70], rdi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000497d
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140004944
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000493f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053e2
call fcn.14003b67c
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 0xf
mov r8d, 0x27
lea rdx, str.Unable_to_create_product_registry_entry
lea rcx, [rbp - 0x60]
call fcn.1400038c0
lea rcx, [rbp - 0x60]
call fcn.1400026f0
mov eax, 0xfffffffe
jmp 0x140005389
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140004a27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053e2
call fcn.14003b67c
jmp 0x140004a27
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140004a18
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004a13
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400053ee
mov rcx, r8
call fcn.14003b67c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
call fcn.140011b38
mov edx, eax
mov dword [rbp + 0x13f4], 0xffffffff
mov dword [rbp + 0x74], eax
mov ecx, 1
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rbp + rcx*4 + 0x74], edx
inc rcx
cmp rcx, 0x270
jb 0x140004a40
mov dword [rbp + 0x70], 0x270
lea rcx, [rbp + 0x70]
call fcn.140007a20
mov ecx, eax
mov eax, 0x6680a41
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
cmp eax, 0x419a02
jae 0x140004a66
mov eax, 0x6680a41
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3e7
sub ecx, eax
lea edx, [rcx - 0x7fffffff]
mov r8d, 0x80000000
lea eax, [rdx + r8]
lea ecx, [rdx - 0x80000000]
cmp edx, r8d
cmovae ecx, eax
movd xmm6, ecx
cvtdq2pd xmm6, xmm6
divsd xmm6, qword [0x140079200]
call fcn.140005430
movzx eax, byte [0x140086b2a]
mov byte [0x140086b28], al
test al, al
jne 0x140004b01
xorps xmm0, xmm0
comisd xmm6, xmm0
jb 0x140004afd
movsd xmm0, qword [0x1400791f0]
comisd xmm0, xmm6
ja 0x140004b01
xor al, al
jmp 0x140004b03
mov al, 1
mov byte [0x140086b29], al
lea r8, [0x140083ca8]
lea rdx, str._pn:
lea rcx, [rbp + 0x48]
call fcn.1400073e0
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x140004b68
lea r15, [rcx + 6]
mov qword [rbx + 0x10], r15
mov rdi, rbx
cmp rdx, 8
jb 0x140004b4b
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0xc
lea rdx, str.__lpn:
call fcn.14003d6c0
mov word [rdi + r15*2], si
jmp 0x140004b88
mov qword [rsp + 0x20], 6
lea r9, str.__lpn:
mov edx, 6
mov rcx, rbx
call fcn.1400076a0
mov rbx, rax
mov qword [rbp - 0x18], rsi
mov qword [rbp - 8], rsi
mov qword [rbp], rsi
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
bts r14d, 9
lea rdx, [0x140083cc8]
lea rcx, [rbp - 0x18]
call fcn.140007160
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
bts r14d, 0xa
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x140004c3f
lea rdi, [rcx + 6]
mov qword [rbp - 0x70], rdi
lea rbx, [rbp - 0x80]
cmp rdx, 8
cmovae rbx, qword [rbp - 0x80]
lea rcx, [rbx + rcx*2]
mov r8d, 0xc
lea rdx, str.__url:
call fcn.14003d6c0
mov word [rbx + rdi*2], si
lea rax, [rbp - 0x80]
jmp 0x140004c5d
mov qword [rsp + 0x20], 6
lea r9, str.__url:
mov edx, 6
lea rcx, [rbp - 0x80]
call fcn.1400076a0
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
bts r14d, 0xb
lea rdx, [0x140083c68]
lea rcx, [rbp + 0x28]
call fcn.140007160
mov qword [rbp + 8], rsi
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
bts r14d, 0xc
mov dword [rsp + 0x50], r14d
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x140004d10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053f4
call fcn.14003b67c
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], si
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140004d60
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053fa
call fcn.14003b67c
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], si
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x140004db0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004dab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005400
call fcn.14003b67c
mov qword [rbp - 8], rsi
mov qword [rbp], 7
mov word [rbp - 0x18], si
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x140004e00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004dfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005406
call fcn.14003b67c
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], si
cmp qword [0x140083c58], 0
jne 0x140004e59
mov qword [rbp + 0x1400], rsi
mov qword [rbp + 0x1410], rsi
mov qword [rbp + 0x1418], 7
mov word [rbp + 0x1400], si
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp + 0x1400]
call fcn.140001d60
lea rax, [rbp + 0x1400]
or r14d, 8
jmp 0x140004e75
lea r8, [0x140083c48]
lea rdx, str.__bn:
lea rcx, [rbp - 0x60]
call fcn.1400073e0
nop
or r14d, 0x10
mov dword [rsp + 0x50], r14d
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140007160
nop
test r14b, 0x10
je 0x140004ee6
and r14d, 0xffffffef
mov dword [rsp + 0x50], r14d
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140004ed6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ed1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000540c
call fcn.14003b67c
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], si
test r14b, 8
je 0x140004f3b
and r14d, 0xfffffff7
mov dword [rsp + 0x50], r14d
mov rdx, qword [rbp + 0x1418]
cmp rdx, 8
jb 0x140004f3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005412
call fcn.14003b67c
mov r8d, dword [0x140086b2c]
test r8d, r8d
je 0x140005034
lea r9, [rbp + 0x142a]
jns 0x140004fa0
neg r8d
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140004f60
add r9, 0xfffffffffffffffe
mov eax, 0x2d
mov word [r9], ax
jmp 0x140004fd0
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140004fa0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], si
lea rax, [rbp + 0x142a]
cmp r9, rax
je 0x140005009
lea r8, [rbp + 0x142a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x60]
call fcn.140001d60
or r14d, 0x6000
or r14d, 0x20
mov dword [rsp + 0x50], r14d
lea r8, [rbp - 0x60]
lea rdx, str.__dt:
lea rcx, [rbp - 0x38]
call fcn.140007550
nop
or r14d, 0x40
jmp 0x140005072
mov qword [rbp + 0x1400], rsi
mov qword [rbp + 0x1410], rsi
mov qword [rbp + 0x1418], 7
mov word [rbp + 0x1400], si
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp + 0x1400]
call fcn.140001d60
lea rax, [rbp + 0x1400]
bts r14d, 7
mov dword [rsp + 0x50], r14d
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140007160
nop
test r14b, r14b
jns 0x1400050d5
btr r14d, 7
mov rdx, qword [rbp + 0x1418]
cmp rdx, 8
jb 0x1400050d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005418
call fcn.14003b67c
nop
test r14b, 0x40
je 0x14000512f
and r14d, 0xffffffbf
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14000511f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000511a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000541e
call fcn.14003b67c
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], si
test r14b, 0x20
je 0x140005175
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140005175
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005170
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005424
call fcn.14003b67c
lea rax, str.__dev
cmp byte [0x140086b2b], 0
cmovne r13, rax
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [r13 + rdx*2], 0
jne 0x140005190
mov rcx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1400051da
lea rdi, [rdx + rcx]
mov qword [rbp + 0x18], rdi
lea rbx, [rbp + 8]
cmp r8, 8
cmovae rbx, qword [rbp + 8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r13
call fcn.14003d6c0
mov word [rbx + rdi*2], si
jmp 0x1400051eb
mov qword [rsp + 0x20], rdx
mov r9, r13
lea rcx, [rbp + 8]
call fcn.1400076a0
mov eax, dword [rsp + 0x58]
cmp eax, 1
jne 0x140005210
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x38]
call fcn.140001c40
mov rcx, rax
call fcn.140006950
mov esi, eax
jmp 0x140005342
cmp eax, 2
jne 0x1400052dc
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], 7
lea r8d, [rax + 0x15]
lea rdx, str.Uninstalling_service...
lea rcx, [rbp - 0x38]
call fcn.140001d60
lea rcx, [rbp - 0x38]
call fcn.140002220
call fcn.140008a10
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000526b
lea esi, [rax - 5]
jmp 0x140005342
mov r8d, 0xf01ff
lea rdx, str.rsSyncSvc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000529a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea esi, [rbx - 8]
jmp 0x140005342
lea r8, [rbp - 0x60]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400052b5
lea esi, [rax - 9]
jmp 0x1400052c8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, 0xfffffff6
test eax, eax
cmove esi, ecx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140005342
lea rax, str.rsSyncSvc
mov qword [rsp + 0x60], rax
lea rax, [0x140006c80]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x140005312
lea esi, [rax - 3]
jmp 0x140005342
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], 7
mov r8d, 0x18
lea rdx, str.Sync_Service:_Main:_Exit
lea rcx, [rbp - 0x38]
call fcn.140001d60
lea rcx, [rbp - 0x38]
call fcn.140002220
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x14000537e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005379
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053be
call fcn.14003b67c
mov eax, esi
jmp 0x140005389
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x1430]
xor rcx, rsp
call fcn.14003b550
lea r11, [rsp + 0x1550]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140047598
int3
call fcn.1400013b0
nop
call fcn.140047598
nop
call fcn.140047598
nop
call fcn.140047598
int3
call fcn.140047598
int3
call fcn.140047598
int3
call fcn.1400013b0
int3
call fcn.140047598
nop
call fcn.140047598
nop
call fcn.140047598
nop
call fcn.140047598
nop
call fcn.140047598
nop
call fcn.140047598
nop
call fcn.140047598
nop
call fcn.140047598
nop
call fcn.140047598
nop
call fcn.140047598
int3