Function at 0x7ff7ec5c55a0
Capabilities:
Stop service
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
movabs rax, 0xd55c01fddb179bb9
movabs r15, 0x3eec3f6f02182f08
mov qword [rbp + 0x138], rax
xor r14d, r14d
mov rax, qword [rbp + 0x138]
movabs r12, 0xd55c019ead64f7d7
mov qword [rsp + 0x20], rax
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x138], r15
mov r8, rbx
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x28], rax
mov qword [rbp + 0x138], r12
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x138], r15
mov rax, qword [rbp + 0x138]
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rbp + 0x48], rax
lea rax, [rsp + 0x20]
pxor xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
inc r8
cmp byte [rax + r8], r14b
jne 0x7ff7ec5c5657
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x230], rdi
lea rcx, [rbp - 0x80]
call fcn.7ff7ec5666c0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.advapi32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x7ff7ec5c56da
cmp qword [rbp - 0x68], 0x10
lea rdx, [rbp - 0x80]
mov r8d, 0x20
mov rcx, rax
cmovae rdx, qword [rbp - 0x80]
call qword [sym.imp.advapi32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x7ff7ec5c56d1
lea r8, [rbp + 0xa0]
mov edx, 1
mov rcx, rax
call qword [sym.imp.advapi32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x7ff7ec5c5718
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7ec5c5713
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7ec5c5713
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff7ec61e988
mov qword [rbp - 0x70], r14
movabs rax, 0xd55c019ead0790a1
mov qword [rbp - 0x68], 0xf
mov r8, rbx
mov byte [rbp - 0x80], r14b
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x138], r15
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x138], r12
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x138], r15
mov rax, qword [rbp + 0x138]
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rbp + 0x58], rax
lea rax, [rsp + 0x30]
pxor xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
inc r8
cmp byte [rax + r8], r14b
jne 0x7ff7ec5c57a5
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.7ff7ec5666c0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.advapi32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x7ff7ec5c5820
cmp qword [rbp - 0x48], 0x10
lea rdx, [rbp - 0x60]
mov r8d, 0x20
mov rcx, rax
cmovae rdx, qword [rbp - 0x60]
call qword [sym.imp.advapi32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x7ff7ec5c5817
lea r8, [rbp + 0xc0]
mov edx, 1
mov rcx, rax
call qword [sym.imp.advapi32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x7ff7ec5c585e
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7ec5c5859
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7ec5c5859
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff7ec61e988
mov qword [rbp - 0x50], r14
movabs rax, 0xd55c019ead0f90a1
mov qword [rbp - 0x48], 0xf
mov r8, rbx
mov byte [rbp - 0x60], r14b
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x138], r15
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x138], r12
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x138], r15
mov rax, qword [rbp + 0x138]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rbp + 0x68], rax
lea rax, [rsp + 0x40]
pxor xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 0xf
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x7ff7ec5c58f0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.7ff7ec5666c0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.advapi32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x7ff7ec5c596b
cmp qword [rbp - 0x28], 0x10
lea rdx, [rbp - 0x40]
mov r8d, 0x20
mov rcx, rax
cmovae rdx, qword [rbp - 0x40]
call qword [sym.imp.advapi32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x7ff7ec5c5962
lea r8, [rbp + 0xe0]
mov edx, 1
mov rcx, rax
call qword [sym.imp.advapi32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x7ff7ec5c59a9
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7ec5c59a4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7ec5c59a4
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff7ec61e988
mov qword [rbp - 0x30], r14
movabs rax, 0xb07278ffdf1090a1
mov qword [rbp - 0x28], 0xf
mov r8, rbx
mov byte [rbp - 0x40], r14b
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x50], rax
movabs rax, 0x3eec3f6f02184a70
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x138], r12
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x138], r15
mov rax, qword [rbp + 0x138]
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp + 0x78], rax
lea rax, [rsp + 0x50]
pxor xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 0xf
inc r8
cmp byte [rax + r8], r14b
jne 0x7ff7ec5c5a40
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x20]
call fcn.7ff7ec5666c0
lea rcx, [rbp - 0x20]
call fcn.7ff7ec5c7b00
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x7ff7ec5c5a9e
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7ec5c5a99
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7ec5c5a99
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff7ec61e988
mov qword [rbp - 0x10], r14
movabs rax, 0xa13260ecc2089681
mov qword [rbp - 8], 0xf
mov r8, rbx
mov byte [rbp - 0x20], r14b
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x60], rax
movabs rax, 0x3eec3f6f67604a26
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x138], r12
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x138], r15
mov rax, qword [rbp + 0x138]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp + 0x88], rax
lea rax, [rsp + 0x60]
pxor xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rbp], r14
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 0xf
nop
inc r8
cmp byte [rax + r8], r14b
jne 0x7ff7ec5c5b40
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.7ff7ec5666c0
lea rcx, [rbp]
call fcn.7ff7ec5c7b00
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x7ff7ec5c5b9e
mov rcx, qword [rbp]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7ec5c5b99
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7ec5c5b99
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff7ec61e988
mov qword [rbp + 0x10], r14
movabs rax, 0xa13264f7c127bb99
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r14b
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x70], rax
movabs rax, 0x3e89470a2c685f49
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x78], rax
mov qword [rbp + 0x138], r12
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x138], r15
mov rax, qword [rbp + 0x138]
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp + 0x98], rax
lea rax, [rsp + 0x70]
pxor xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 0xf
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x7ff7ec5c5c40
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x20]
call fcn.7ff7ec5666c0
lea rcx, [rbp + 0x20]
call fcn.7ff7ec5c7b00
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x7ff7ec5c5ca1
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7ec5c5c9c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7ec5c5c9c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff7ec61e988
mov ecx, 0xfa0
mov byte [0x7ff7ec6f40d2], r14b
mov byte [0x7ff7ec6f41c2], 1
call qword [sym.imp.kernel32.dll_Sleep]
mov rdi, qword [rsp + 0x230]
mov rbx, qword [rsp + 0x240]
add rsp, 0x200
pop r15
pop r14
pop r12
pop rsi
pop rbp
jmp fcn.7ff7ec566240