Function at 0x1400078c0
Capabilities:
Delete service
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14002cf88]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r13d, 1
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov ebx, r13d
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x140007b0d
mov r8d, r13d
lea rdx, str.WmiApSrv
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
xor edi, edi
test rax, rax
setne dil
test rax, rax
je 0x14000794c
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test edi, edi
je 0x140007afc
xor ebp, ebp
mov esi, r13d
mov edi, 0x80070000
lea r15d, [rbp + 5]
mov eax, r15d
dec r15d
test eax, eax
je 0x140007a72
mov r8d, 0x24
lea rdx, str.WmiApSrv
mov rcx, r14
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x140007a3b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
je 0x140007a09
cmp dword [rsp + 0x24], r13d
je 0x140007a02
lea r8, [rsp + 0x20]
mov edx, r13d
mov rcx, r12
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
nop dword [rax + rax]
test eax, eax
jne 0x140007a04
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
sub eax, 0x425
je 0x1400079fb
xor esi, esi
cmp eax, r13d
je 0x140007a04
test ecx, ecx
jg 0x1400079f6
mov ebx, ecx
jmp 0x140007a22
movzx ebx, cx
jmp 0x140007a20
cmp dword [rsp + 0x24], r13d
jne 0x140007a22
xor esi, esi
mov ebp, r13d
jmp 0x140007a22
xor esi, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140007a22
movzx ebx, ax
or ebx, edi
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test esi, esi
jne 0x140007962
jmp 0x140007a72
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140007a52
movzx eax, ax
or eax, edi
test eax, eax
jns 0x140007a6d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140007a72
movzx ebx, ax
or ebx, edi
jmp 0x140007a72
mov ebx, 0x80004005
test ebp, ebp
je 0x140007afc
mov r8d, 0x10000
lea rdx, str.WmiApSrv
mov rcx, r14
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140007ac5
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
nop dword [rax + rax]
xor ebx, ebx
mov rcx, rsi
test eax, eax
sete bl
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x140007afc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140007adc
movzx eax, ax
or eax, edi
test eax, eax
jns 0x140007af7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140007afc
movzx ebx, ax
or ebx, edi
jmp 0x140007afc
mov ebx, 0x80004005
mov rcx, r14
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x140007b49
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, 0x80070000
test eax, eax
jle 0x140007b29
movzx eax, ax
or eax, edi
test eax, eax
jns 0x140007b44
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140007b49
movzx ebx, ax
or ebx, edi
jmp 0x140007b49
mov ebx, 0x80004005
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001fe0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret