Function at 0x7ff65c527310
Capabilities:
Delete file
Delete service
Get common file path
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rbx, rcx
xor esi, esi
call fcn.7ff65c523aa0
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov dword [rsp + 0x2c], esi
movdqa xmm0, xmmword [0x7ff65c6423b0]
movdqu xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [str.iqvw64e.sys]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [0x7ff65c63e3c8]
mov word [rsp + 0x28], ax
movzx eax, byte [0x7ff65c63e3ca]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], sil
xor edx, edx
xor ecx, ecx
mov r8d, 2
call qword [sym.imp.advapi32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x7ff65c522de3
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8d, 0x10020
mov rcx, rax
call qword [sym.imp.advapi32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x7ff65c522dda
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.advapi32.dll_ControlService]
test eax, eax
je 0x7ff65c522dd1
mov rcx, rbx
call qword [sym.imp.advapi32.dll_DeleteService]
mov rcx, rbx
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x7ff65c522e23
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65c522e1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65c522e1e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65c618c48
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x80]
call sub.vcruntime140.dll_memset
lea rdx, [rbp - 0x80]
mov ecx, 0x104
call qword [sym.imp.kernel32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], sil
jne 0x7ff65c522e60
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.7ff65c4f3550
nop
mov r8d, 1
lea rdx, [0x7ff65c63e3cc]
lea rcx, [rsp + 0x40]
call fcn.7ff65c518330
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0xb
lea rdx, str.iqvw64e.sys
lea rcx, [rsp + 0x20]
call fcn.7ff65c518330
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x7ff65c522f48
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65c522f43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65c522f43
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65c618c48
movdqa xmm0, xmmword [0x7ff65c642360]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x7ff65c522f9b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65c522f96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65c522f96
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65c618c48
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, qword [rsp + 0x60]
call qword [sym.imp.ucrtbase.dll_remove]
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x7ff65c522ff2
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65c522fed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65c522fed
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65c618c48
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
push rsi
sub rsp, 0x40
call fcn.7ff65c522930
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x7ff65c5273b0
mov rdx, qword [0x7ff65c7aae80]
xorps xmm0, xmm0
sub rdx, qword [0x7ff65c7aae78]
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
je 0x7ff65c527396
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x60], rdi
call fcn.7ff65c527450
mov rdx, qword [0x7ff65c7aae78]
mov rbx, qword [0x7ff65c7aae80]
mov rdi, qword [rsp + 0x20]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.vcruntime140.dll_memmove
lea rax, [rbx + rdi]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.7ff65c525b30
mov rcx, rsi
test rax, rax
jne 0x7ff65c5273b8
call 0x7ff65c522cf0
xor al, al
add rsp, 0x40
pop rsi
ret
add rsp, 0x40
pop rsi
jmp 0x7ff65c522cf0