Function at 0x140001fa0
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14005b0e8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [0x1417bba30]
mov rax, qword [rcx + 0x1d8]
test rax, rax
je 0x140001fe1
mov rcx, rax
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x1417bba30]
mov rax, qword [rcx + 0x1e0]
test rax, rax
je 0x140001ffd
mov rcx, rax
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x1417bba30]
mov rax, qword [rcx + 0x1e8]
test rax, rax
je 0x140002019
mov rcx, rax
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x1417bba30]
mov rax, qword [rcx + 0x1f0]
test rax, rax
je 0x140002035
mov rcx, rax
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x1417bba30]
mov rax, qword [rcx + 0x200]
test rax, rax
je 0x140002099
mov rcx, rax
call qword [0x1417fbd90]
mov rcx, qword [0x1417fbd80]
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rcx, qword [0x1417bba30]
xorps xmm0, xmm0
movups xmmword [0x1417fbd80], xmm0
movups xmmword [0x1417fbd90], xmm0
movups xmmword [0x1417fbda0], xmm0
movups xmmword [0x1417fbdb0], xmm0
movups xmmword [0x1417fbdc0], xmm0
movups xmmword [0x1417fbdd0], xmm0
movups xmmword [0x1417fbde0], xmm0
movups xmmword [0x1417fbdf0], xmm0
mov rbx, qword [rcx + 0x1d0]
cmp byte [rbx], 0
jbe 0x1400020b9
mov rcx, qword [rbx + 8]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x1417bba30]
mov byte [rbx], 0
mov rcx, qword [rcx + 0x1d0]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x1417bba30]
xor esi, esi
mov rbx, qword [rcx + 0x1c8]
cmp word [rbx + 2], si
jbe 0x1400020f1
mov rcx, qword [rbx + 8]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x1417bba30]
mov word [rbx + 2], si
mov rcx, qword [rcx + 0x1c8]
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [0x1417bba30]
mov rdi, qword [rbx + 0x210]
test rdi, rdi
je 0x1400021e2
mov rcx, qword [rdi + 0x230]
xor eax, eax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x20], xmm0
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000217c
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edx, edx
mov qword [rdi + 0x230], rsi
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rdi + 0x220], rax
test rax, rax
je 0x14000217c
mov rdx, qword [rdi + 8]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rdi + 0x228], rax
mov rcx, qword [rdi + 0x228]
test rcx, rcx
je 0x1400021b9
lea r8, [rsp + 0x20]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rdi + 0x228]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [rdi + 0x228]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x228], rsi
mov rcx, qword [rdi + 0x220]
test rcx, rcx
je 0x1400021d2
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x220], rsi
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [0x1417bba30]
mov rdi, qword [rbx + 0x220]
test rdi, rdi
je 0x14000225b
mov rbx, qword [rdi + 8]
mov rax, qword [rbx]
test rax, rax
je 0x140002216
nop word [rax + rax]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_free]
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x140002200
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x140002237
mov rcx, rax
call fcn.140011720
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x140002222
mov rcx, qword [rdi + 8]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [0x1417bba30]
cmp qword [rbx + 0x230], rsi
je 0x14000228a
mov rbx, qword [rbx + 0x230]
mov ecx, 1
call fcn.14002dea0
cmp rbx, rax
je 0x140002283
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
mov rbx, qword [0x1417bba30]
xor edx, edx
mov r8d, 0x10250
mov rcx, rbx
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x240]
call qword [sym.imp.msvcrt.dll_free]
mov qword [0x1417bba30], rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140029990
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret