Function at 0x1400a0650
Capabilities:
Delete service

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x148], rbx
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rdi, r8
mov r12, rdx
mov qword [rsp + 0x28], rdx
mov r13, qword [rbp + 0x7f]
mov byte [rsp + 0x20], 0
cmp qword [rcx + 0x10], 0
je 0x1400a0a82
cmp qword [rdx + 0x10], 0
je 0x1400a0a82
cmp qword [r8 + 0x10], 0
je 0x1400a0a82
xor r15b, r15b
xor r14b, r14b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x1400a0751
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400a06e7
mov rdx, qword [rdi]
mov r8d, 0xf01ff
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x1400a0713
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x1400a0713
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a0728
mov r15b, 1
test rbx, rbx
je 0x1400a0728
movzx r14d, r15b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r15b, r15b
je 0x1400a0757
test r14b, r14b
jne 0x1400a0757
test r13, r13
je 0x1400a0a8f
mov dword [r13], 0x4db
jmp 0x1400a0a8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x31], 0xf750e6c3
mov dword [rbp - 0x2d], 0x11d138ee
mov dword [rbp - 0x29], 0xc000e585
mov dword [rbp - 0x25], 0xee95c24f
xor ebx, ebx
lea r8, str..cat
mov rdx, r12
lea rcx, [rbp - 0x11]
call fcn.140037460
nop
xor r8d, r8d
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x39]
call qword [sym.imp.WINTRUST.dll_CryptCATAdminAcquireContext]
test eax, eax
je 0x1400a07d3
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
xor r8d, r8d
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.WINTRUST.dll_CryptCATAdminRemoveCatalog]
test eax, eax
jne 0x1400a07c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor edx, edx
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.WINTRUST.dll_CryptCATAdminReleaseContext]
jmp 0x1400a07db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r13, r13
je 0x1400a07e4
mov dword [r13], ebx
lea rcx, [rbp - 0x11]
call fcn.14000c300
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x1400a0880
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400a0814
mov rdx, qword [rdi]
mov r8d, 0xf01ff
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400a086d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x1400a0851
mov byte [rsp + 0x20], 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400a0888
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400a0888
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400a0888
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r13, r13
je 0x1400a0891
mov dword [r13], ebx
cmp byte [rsp + 0x20], 0
je 0x1400a0a7b
mov r14d, 0x64
mov dword [rbp - 0x39], r14d
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor bl, bl
xor esi, esi
xor r15b, r15b
cmp qword [rdi + 0x10], rsi
jne 0x1400a08d2
mov esi, 0x57
jmp 0x1400a096f
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
je 0x1400a0955
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400a08f7
mov rdx, qword [rdi]
mov r8d, 0xf01ff
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
jne 0x1400a0932
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x1400a0932
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14d, dword [rbp - 0x39]
jmp 0x1400a095d
mov bl, 1
test r14, r14
je 0x1400a0946
movzx r15d, bl
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14d, dword [rbp - 0x39]
jmp 0x1400a095d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test bl, bl
jne 0x1400a096f
cmp esi, 0x430
jne 0x1400a096f
mov bl, 1
movzx r15d, bl
add r14d, 0xffffffff
mov dword [rbp - 0x39], r14d
je 0x1400a098a
test bl, bl
je 0x1400a0a72
test r15b, r15b
jne 0x1400a08b0
test bl, bl
je 0x1400a0a72
test r15b, r15b
jne 0x1400a0a5e
mov byte [rsp + 0x20], 1
lea rdx, str.System32drivers
lea rcx, [rsp + 0x38]
call fcn.14000d360
nop
call fcn.1400a1750
mov rbx, rax
lea r8, str..sys
mov rdx, qword [rsp + 0x28]
lea rcx, [rbp - 0x59]
call fcn.140037460
mov rdi, rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, rax
lea rcx, [rbp - 0x11]
call fcn.14000c320
nop
lea r8, [rbp - 0x11]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140082f50
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.1400256d0
nop
lea rcx, [rbp - 0x11]
call fcn.14000c300
nop
mov r8, rdi
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x79]
call fcn.140082ed0
nop
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.1400927b0
nop
lea rcx, [rbp - 0x79]
call fcn.14000c300
nop
lea rcx, [rbp - 0x31]
call fcn.14000c300
nop
lea rcx, [rbp - 0x59]
call fcn.14000c300
nop
lea rcx, [rsp + 0x38]
call fcn.14000c300
movzx eax, byte [rsp + 0x20]
jmp 0x1400a0a91
test r13, r13
je 0x1400a0a7b
mov dword [r13], 0x431
movzx eax, byte [rsp + 0x20]
jmp 0x1400a0a91
test r13, r13
je 0x1400a0a7b
mov dword [r13], esi
movzx eax, byte [rsp + 0x20]
jmp 0x1400a0a91
test r13, r13
je 0x1400a0a8f
mov dword [r13], 0x57
xor al, al
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140282c10
mov rbx, qword [rsp + 0x148]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret