Function at 0x14001eca0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1401f41c0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rdi, rcx
call fcn.140067ee0
lea rdx, str.AcService.run
mov rcx, rax
call fcn.140068190
call fcn.140067ee0
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.140028280
nop
cmp qword [rax + 0x18], 0xf
jbe 0x14001ed01
mov rax, qword [rax]
mov r8, rax
lea rdx, str.Starting_up_AcService__s_
mov rcx, rbx
call fcn.140067e40
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14001ed4f
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ed4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f2c7
call fcn.14016aab8
lea rcx, [rsp + 0x68]
call fcn.140064a00
nop
call fcn.140067ee0
mov rbx, rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call fcn.140064d60
nop
cmp qword [rax + 0x18], 0xf
jbe 0x14001ed7b
mov rax, qword [rax]
mov rcx, qword [rsp + 0x68]
mov edx, dword [rcx + 0xc]
mov r10d, dword [rcx + 8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
mov r9d, dword [rcx + 4]
mov r8d, dword [rcx]
lea rdx, str.Windows_version_is__d._d._d._d____s_
mov rcx, rbx
call fcn.140067e40
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14001ede7
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ede2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f2cd
call fcn.14016aab8
call fcn.14001da50
call fcn.14001f5d0
call fcn.14005a420
mov rcx, rdi
test al, al
je 0x14001ee04
call fcn.140019250
jmp 0x14001ee18
xor edx, edx
call fcn.140019450
mov edx, 1
mov rcx, rdi
call fcn.140019450
mov rbx, qword [0x1401f90b8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov ecx, 0x20
call fcn.14016aa7c
mov qword [rbp - 0x80], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movdqu xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [str.AcService.LogKeepDays]
movups xmmword [rax], xmm0
mov ecx, dword [0x14019d708]
mov dword [rax + 0x10], ecx
movzx ecx, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
mov esi, 7
mov r8d, esi
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140062a30
mov ebx, eax
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14001eebb
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001eeb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f2d3
call fcn.14016aab8
test ebx, ebx
cmovle ebx, esi
mov eax, ebx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.140063ab0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x60]
call fcn.140191ec0
lea rdx, [rbp - 0x60]
lea rcx, str.stopservice.txt
call fcn.14005a030
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xb0]
call fcn.140191ec0
lea rdx, [rbp + 0xb0]
lea rcx, str.RestartService.exe
call fcn.14005a030
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp byte [rdi + 0x28], 0
jne 0x14001ef42
lea rcx, [0x1401f90a0]
call fcn.14004d700
mov rcx, rdi
call fcn.14001c340
mov ecx, 0xb8
call fcn.14016aa7c
mov qword [rsp + 0x48], rax
lea rsi, [rdi + 0x30]
xor r14d, r14d
test rax, rax
je 0x14001ef72
mov rdx, rsi
mov rcx, rax
call fcn.14000f320
jmp 0x14001ef75
mov rax, r14
mov qword [0x1401f9048], rax
call fcn.14001a070
mov ecx, 0x18
call fcn.14016aa7c
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14001efa2
mov qword [rax], rsi
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x14001efa5
mov rax, r14
mov qword [0x1401f9068], rax
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140009940
nop
lea rdx, [rsp + 0x50]
mov rcx, qword [0x1401f9068]
call fcn.140009590
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14001d430
mov ecx, 8
call fcn.14016aa7c
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14001eff9
mov rcx, rax
call fcn.140056810
jmp 0x14001effc
mov rax, r14
mov qword [0x1401f9060], rax
mov rcx, rax
call fcn.1400575b0
test al, al
jne 0x14001f033
call fcn.140067ee0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.AcService.initInfoISM:_InfoISM_not_found__error:__d
mov rcx, rbx
call fcn.140067c40
xor al, al
jmp 0x14001f049
call fcn.140067ee0
lea rdx, str.AcService.initInfoISM:_InfoISM_is_installed
mov rcx, rax
call fcn.140067e40
mov al, 1
mov byte [reloc.WS2_32.dll_accept], al
mov rcx, rdi
call fcn.14001a5e0
mov rcx, rdi
call fcn.14001c6c0
mov rcx, rdi
call fcn.14001c630
mov rcx, rdi
call fcn.14001c5d0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0xa0000
mov rdx, qword [0x1401f9050]
lea rcx, [rsp + 0x48]
call fcn.1400802d0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140080830
mov ecx, 0x20
call fcn.14016aa7c
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001f0c1
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14004dfd0
jmp 0x14001f0c4
mov rax, r14
mov qword [0x1401f9088], rax
mov rcx, rax
call fcn.14004e0d0
mov rcx, qword [0x1401f9068]
call fcn.14000c060
mov ecx, 0x40
call fcn.14016aa7c
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001f11a
mov qword [rax], rsi
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], r14
mov qword [rax + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rax + 0x20], 0
jmp 0x14001f11d
mov rax, r14
mov qword [0x1401f9058], rax
mov rcx, rax
call fcn.1400387f0
mov rcx, rdi
call fcn.14001cd90
mov ecx, 0x30
call fcn.14016aa7c
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001f154
mov rdx, rsi
mov rcx, rax
call fcn.1400164d0
jmp 0x14001f157
mov rax, r14
mov qword [0x1401f9040], rax
mov rbx, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
cmp rbx, rdi
je 0x14001f1ad
nop dword [rax + rax]
cmp dword [rbx + 8], 0
je 0x14001f1a4
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbx + 8], eax
je 0x14001f2ea
movups xmm0, xmmword [rbx]
movaps xmmword [rbp - 0x80], xmm0
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.140167b98
test eax, eax
jne 0x14001f2df
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp rbx, rdi
jne 0x14001f170
call fcn.140067ee0
lea rdx, str.AcService_stopped
mov rcx, rax
call fcn.140067e40
nop
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14001f25e
mov rdi, qword [rsp + 0x58]
cmp rbx, rdi
je 0x14001f1f9
nop word [rax + rax]
mov rcx, rbx
call fcn.140007570
add rbx, 0xe8
cmp rbx, rdi
jne 0x14001f1e0
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
sub rcx, rbx
movabs rax, 0x469ee58469ee5847
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0xe8
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001f248
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f2d9
mov rcx, rbx
call fcn.14016aab8
mov qword [rsp + 0x50], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001f29a
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f295
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f2c1
call fcn.14016aab8
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14016ab50
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140170de4
int3
call fcn.140170de4
nop
call fcn.140170de4
nop
call fcn.140170de4
int3
call fcn.140170de4
nop
mov ecx, 2
call fcn.140167d28
int3
mov ecx, 5
call fcn.140167d28
int3