Function at 0x140001604
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x780]
sub rsp, 0x880
mov r10b, byte [0x140004378]
movsd xmm1, qword [0x140004370]
movabs rax, 0xc5fbe32254bf99
mov rsi, rdx
mov r14d, ecx
mov r8d, 6
movsd qword [rsp + 0x30], xmm1
mov qword [rbp + 0x7c8], rax
lea r9, [rbp + 0x7ce]
xor ebx, ebx
mov byte [rsp + 0x38], r10b
mov r11d, 0x80000007
mov eax, r8d
and eax, r11d
jge 0x140001674
dec eax
or eax, 0xfffffff8
inc eax
cdqe
mov cl, byte [rsp + rax + 0x30]
add byte [r9], cl
dec r9
dec r8d
jns 0x140001665
movzx eax, word [0x140004388]
movsd xmm0, qword [0x140004380]
mov edi, 8
movsd qword [rsp + 0x30], xmm1
mov byte [rsp + 0x38], r10b
lea r8, [rsp + 0x48]
movsd qword [rsp + 0x40], xmm0
mov word [rsp + 0x48], ax
mov edx, edi
mov eax, edx
and eax, r11d
jge 0x1400016c4
dec eax
or eax, 0xfffffff8
inc eax
cdqe
mov cl, byte [rsp + rax + 0x30]
add byte [r8], cl
dec r8
dec edx
jns 0x1400016b6
mov eax, dword [0x14000438c]
movsd qword [rsp + 0x30], xmm1
mov byte [rsp + 0x38], r10b
mov dword [rbp + 0x7c0], eax
movzx eax, word [0x140004390]
mov edx, 4
mov word [rbp + 0x7c4], ax
lea r8, [rbp + 0x7c4]
mov eax, edx
and eax, r11d
jge 0x140001713
dec eax
or eax, 0xfffffff8
inc eax
cdqe
mov cl, byte [rsp + rax + 0x30]
add byte [r8], cl
dec r8
dec edx
jns 0x140001705
lea rax, [rbp + 0x370]
lea rcx, [0x140006050]
mov rdx, rdi
mov r12d, 0x80
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
add rcx, r12
movups xmmword [rax + 0x60], xmm0
add rax, r12
movups xmmword [rax - 0x10], xmm1
dec rdx
jne 0x14000173a
movups xmm0, xmmword [rcx]
lea r9, [rbp + 0x7b0]
lea r8, [rbp + 0x370]
lea rdx, [0x140006020]
lea rcx, [0x140006030]
mov dword [rsp + 0x28], ebx
movups xmmword [rax], xmm0
mov dword [rbp + 0x7b0], 0x410
mov dword [rsp + 0x20], ebx
call fcn.140001b80
test eax, eax
jne 0x140001815
lea rax, [rsp + 0x70]
lea rcx, [rbp + 0x370]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
add rcx, r12
movups xmmword [rax + 0x60], xmm0
add rax, r12
movups xmmword [rax - 0x10], xmm1
dec rdi
jne 0x1400017cc
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140001dcc
cmp r14d, 1
jle 0x140001903
mov rdx, qword [rsi + 8]
lea rcx, [rbp + 0x7c8]
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x140001864
call fcn.140001e60
test eax, eax
jne 0x14000185c
call fcn.14000239c
jmp 0x14000193e
or eax, 0xffffffff
jmp 0x14000193e
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x140001903
call fcn.140002634
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x1400018a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
or ebx, 0xffffffff
jmp 0x1400018ff
lea rdx, [0x140006a60]
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x1400018d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ebx, [rsi - 2]
jmp 0x1400018ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400018ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfffffffd
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x14000193e
lea rax, [0x140006a60]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rax
lea rax, [0x140002140]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x58], rax
mov dword [0x140006a38], ebx
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
neg eax
sbb eax, eax
neg eax
dec eax
mov rbx, qword [rsp + 0x8b8]
add rsp, 0x880
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret