Function at 0x140005190
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14005b060]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rcx
mov eax, dword [0x14005bc50]
mov r13d, 0x7fffffff
cmp eax, r13d
sete sil
mov byte [rbp - 0x25], sil
mov ecx, 0x7530
test sil, sil
cmovne eax, ecx
mov dword [0x14005bc50], eax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rbp - 0x21], rax
test rax, rax
jne 0x14000528b
mov rbx, qword [0x14005eb48]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8d, [rdi + 1]
lea rdx, str.Unable_to_open_Service_Control_Manager___d_
lea rcx, [rbp - 0x11]
call fcn.14000edc0
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140005280
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000527b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005783
call fcn.14001c70c
mov r14d, 0x2a
jmp 0x140005725
mov r8d, 0x10024
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rbp - 0x19], rax
test rax, rax
jne 0x14000541c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x29], eax
mov r14, qword [0x14005eb48]
cmp eax, 0x424
jne 0x140005337
mov r9, r15
lea r8d, [rbx + 1]
lea rdx, str.Service__ls_not_installed
lea rcx, [rbp - 0x11]
call fcn.14000edc0
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, r14
call fcn.14000f340
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14000532c
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005327
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005789
call fcn.14001c70c
mov r14d, 0x2b
jmp 0x140005716
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x29]
call fcn.140001820
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000534f
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x29]
mov dword [rsp + 0x20], eax
mov r9, r15
mov r8d, 3
lea rdx, str.Unable_to_open_service__ls__0x_X___s
lea rcx, [rbp - 0x11]
call fcn.14000edc0
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, r14
call fcn.14000f340
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x1400053c5
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000578f
call fcn.14001c70c
mov qword [rbp - 1], 0
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14000568f
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000568a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000577d
jmp 0x14000568a
mov rcx, rbx
call fcn.140004940
mov r12d, eax
cmp eax, 0x1f
jne 0x140005435
lea r14d, [rax + 0xb]
jmp 0x140005716
mov r14, qword [0x14005eb48]
mov r9, r15
mov r8d, 1
lea rdx, str.Uninstalling_service__ls
lea rcx, [rbp - 0x11]
call fcn.14000edc0
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, r14
call fcn.14000f340
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x1400054a6
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005795
call fcn.14001c70c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140005697
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x29], eax
mov r14, qword [0x14005eb48]
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x29]
cmp eax, 0x430
jne 0x1400055ba
call fcn.140001820
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400054ea
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x29]
mov dword [rsp + 0x20], eax
mov r9, r15
mov r8d, 3
lea rdx, str.Service__ls_already_marked_for_deletion__0x_X___s
lea rcx, [rbp - 0x11]
call fcn.14000edc0
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, r14
call fcn.14000f340
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140005560
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000555b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000579b
call fcn.14001c70c
mov qword [rbp - 1], 0
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x1400055af
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400055aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057a1
call fcn.14001c70c
mov r14d, 0x32
jmp 0x140005716
call fcn.140001820
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400055ca
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x29]
mov dword [rsp + 0x20], eax
mov r9, r15
mov r8d, 3
lea rdx, str.Failed_to_uninstall_service__ls__0x_X___s
lea rcx, [rbp - 0x11]
call fcn.14000edc0
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, r14
call fcn.14000f340
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140005640
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000563b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057a7
call fcn.14001c70c
mov qword [rbp - 1], 0
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14000568f
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000568a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057ad
call fcn.14001c70c
mov r14d, 0x2a
jmp 0x140005716
mov r14, qword [0x14005eb48]
mov r9, r15
mov r8d, 1
lea rdx, str.Successfully_uninstalled_service__ls
lea rcx, [rbp - 0x11]
call fcn.14000edc0
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, r14
call fcn.14000f340
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140005704
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005777
call fcn.14001c70c
cmp r12d, 0x1e
mov r14d, 0x28
je 0x140005716
mov r14d, 0x29
test rbx, rbx
je 0x140005725
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rdi, rdi
je 0x140005734
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov ecx, dword [0x14005bc50]
test sil, sil
cmovne ecx, r13d
mov dword [0x14005bc50], ecx
mov eax, r14d
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14001c460
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
int3