Function at 0x1400998f0
Capabilities:
Delete file
Delete service
Query service status
Stop service

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xe0
mov rax, qword [0x1401b66f8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rcx, qword [0x1401bb0d8]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
mov qword [r11 - 0x10], r14
call qword [sym.imp.USER32.dll_IsWindow]
xor r14d, r14d
movabs r12, 0x7fffffffffffffff
test eax, eax
je 0x140099bd6
cmp byte [reloc.WS2_32.dll_accept], r14b
je 0x140099953
mov byte [reloc.WS2_32.dll_accept], r14b
mov rdx, qword [0x1401bb9c0]
lea r8, [rbp + 0x17]
sub rdx, qword [0x1401bb9b8]
sar rdx, 2
mov dword [rbp + 0x17], r14d
call fcn.14009a990
movabs rdi, 0x7ffffffffff0bdbe
nop dword [rax]
mov rax, qword [0x1401bb9a0]
mov rcx, qword [rax + 0x90]
test rcx, rcx
je 0x140099a12
lea rdx, [rbp + 0x17]
mov dword [rbp + 0x17], r14d
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp + 0x17], 0x103
jne 0x140099a12
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400999c8
imul rax, rax, 0x64
jmp 0x1400999e6
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jg 0x140099a00
add rax, 0xf4240
lea rcx, [rbp + 0x17]
mov qword [rbp + 0x17], rax
call fcn.140024100
jmp 0x140099980
lea rcx, [rbp + 0x17]
mov qword [rbp + 0x17], r12
call fcn.140024100
jmp 0x140099980
mov rax, qword [0x1401b6830]
xorps xmm1, xmm1
movss xmm0, dword [rax + 0x144]
ucomiss xmm0, xmm1
jp 0x140099a2b
je 0x140099a39
mov dword [rax + 0x144], r14d
mov rax, qword [0x1401b6830]
movss xmm0, dword [rax + 0x18c]
ucomiss xmm0, xmm1
jp 0x140099a48
je 0x140099a56
mov dword [rax + 0x18c], r14d
mov rax, qword [0x1401b6830]
movss xmm0, dword [rax + 0x1b8]
ucomiss xmm0, xmm1
jp 0x140099a65
je 0x140099a73
mov dword [rax + 0x1b8], r14d
mov rax, qword [0x1401b6830]
movss xmm0, dword [rax + 0x228]
ucomiss xmm0, xmm1
jp 0x140099a82
je 0x140099a89
mov dword [rax + 0x228], r14d
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140099aa7
imul rbx, rax, 0x64
jmp 0x140099ac8
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
movabs rsi, 0x12a05f1ff
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x1401bb9a0]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x140099b0e
lea rdx, [rbp + 0x17]
mov dword [rbp + 0x17], r14d
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp + 0x17], 0x103
je 0x140099b7c
mov rax, qword [0x1401bb9a0]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140099b35
lea rdx, [rbp + 0x17]
mov dword [rbp + 0x17], r14d
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp + 0x17], 0x103
je 0x140099b7c
mov rax, qword [0x1401bb9a0]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140099b5c
lea rdx, [rbp + 0x17]
mov dword [rbp + 0x17], r14d
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp + 0x17], 0x103
je 0x140099b7c
mov rax, qword [0x1401bb9a0]
mov rcx, qword [rax + 0x70]
test rcx, rcx
je 0x140099bd6
lea rdx, [rbp + 0x17]
mov dword [rbp + 0x17], r14d
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp + 0x17], 0x103
jne 0x140099bd6
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x140099b9a
imul rax, rax, 0x64
jmp 0x140099bb8
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
sub rax, rbx
cmp rax, rsi
jg 0x140099bd6
lea rcx, [rbp + 0x17]
mov qword [rbp + 0x17], 1
call fcn.14001e620
jmp 0x140099ae0
cmp byte [0x1401bb694], r14b
mov qword [rsp + 0xd0], r15
jne 0x140099d5a
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x140099d74
cmp byte [reloc.WLDAP32.dll_Ordinal_60], r14b
movsd xmm0, qword [str.d__RNHO_]
movzx ecx, word [0x140197430]
movsd qword [rbp - 0x69], xmm0
mov word [rbp - 0x61], cx
je 0x140099c50
xor byte [rbp - 0x68], 0x34
xor byte [rbp - 0x67], 0x35
xor byte [rbp - 0x66], 0x36
xor byte [rbp - 0x65], 0x37
xor byte [rbp - 0x64], 0x38
xor byte [rbp - 0x63], 0x39
xor byte [rbp - 0x62], 0x3a
xor byte [rbp - 0x61], 0x3b
xor byte [rbp - 0x60], 0x3c
mov byte [rbp - 0x69], 0x57
mov r8d, 0xf01ff
lea rdx, [rbp - 0x69]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
jne 0x140099c79
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140099d74
lea rdx, [rbp + 0x1f]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140099e99
cmp dword [rbp + 0x23], 2
jne 0x140099d48
lea r8, [rbp + 0x1f]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140099e99
cmp dword [rbp + 0x23], 2
jne 0x140099d37
movabs r15, 0x7fffffffe2329afe
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x140099ce0
imul rax, rax, 0x64
jmp 0x140099cfe
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, r15
jg 0x140099d0f
add rax, 0x1dcd6500
mov qword [rbp + 0x17], rax
jmp 0x140099d13
mov qword [rbp + 0x17], r12
lea rcx, [rbp + 0x17]
call fcn.140024100
lea rdx, [rbp + 0x1f]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140099e99
cmp dword [rbp + 0x23], 2
je 0x140099cc2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x140099e99
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [0x1401bb7e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x1401bb6c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rbp - 0x59]
call fcn.1400982b0
lea rcx, [rbp - 0x11]
call fcn.14000c460
lea rcx, [rbp - 0x31]
call fcn.14000c460
lea rcx, [rbp - 0x51]
call fcn.14000c460
call fcn.140060380
call fcn.14005f650
mov rbx, qword [0x1401bb110]
mov qword [0x1401bb110], rbx
call fcn.140038330
mov r15, qword [rsp + 0xd0]
mov r12, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xf8]
mov qword [0x1401bb110], r14
test rbx, rbx
je 0x140099e5e
mov rcx, rbx
call fcn.14004dbf0
mov r8, qword [0x1401bb110]
test r8, r8
je 0x140099e55
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140099e4a
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1401bb0e0]
mov r14, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xf0]
test rcx, rcx
je 0x140099e7f
call fcn.1400c0230
call fcn.1400c12c0
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14012e5c0
add rsp, 0xe0
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140099d74