Function at 0x140057110
Capabilities:
Delete service

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r13, rcx
lea rcx, [rsp + 0x40]
call fcn.140057720
test eax, eax
jne 0x140057363
cmp qword [0x140182ea8], 0
je 0x140057363
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, str.ProcObsrv.NT.Wdf
test rdx, 0xffffffffffff0000
jne 0x1400571b3
movzx edi, dx
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x1400571c4
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400029f0
jmp 0x1400571c4
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140002120
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x40]
xor r14d, r14d
or rsi, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x140057224
movzx edi, cx
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x140057319
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400029f0
mov rbx, qword [rsp + 0x28]
jmp 0x140057319
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x14005729a
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140057319
cmp dword [rdx + 0x10], eax
jge 0x140057270
cmp dword [rbx - 0xc], eax
jge 0x140057263
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x140057319
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140057286
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
jmp 0x140057319
mov r12d, dword [rbx - 0x10]
lea rbp, [rsp + 0x40]
sub rbp, rbx
sar rbp, 1
test ecx, ecx
jns 0x1400572b8
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400572da
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.1400020c0
mov rbx, qword [rsp + 0x28]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rbp, r12
lea r12, [rax + rax]
mov r9, r12
ja 0x1400572fe
lea r8, [rbx + rbp*2]
call fcn.1400d4ebc
jmp 0x140057308
lea r8, [rsp + 0x40]
call fcn.1400d4e34
cmp edi, dword [rbx - 0xc]
jg 0x140057426
mov dword [rbx - 0x10], edi
mov word [r12 + rbx], r14w
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
call qword [0x140182ea8]
test eax, eax
je 0x14005736a
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140057346
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, qword [rsp + 0x20]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140057363
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor al, al
jmp 0x140057431
mov r8d, 0xf01ff
lea rdx, str.ProcObsrv
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400573ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400573aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x140057346
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x1400573be
mov bpl, 1
jmp 0x1400573c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor bpl, bpl
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
call qword [0x140182c98]
movzx edi, bpl
test eax, eax
cmovne edi, r14d
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140057403
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, qword [rsp + 0x20]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140057420
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
movzx eax, dil
jmp 0x140057431
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret